Edit tour

Windows Analysis Report
Xeno Executor.exe

Overview

General Information

Sample name:	Xeno Executor.exe
Analysis ID:	1570765
MD5:	36517f5bfae396a1d223e7491a3044cc
SHA1:	591a20349741340b21e0d3ea7d70a7df4043e925
SHA256:	e5d7e8537578b6c2f2ad9d842c51fcda0535c82b4e84c52537afe852687aa5f2
Tags:	exeuser-aachum
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Xeno Executor.exe (PID: 7676 cmdline: "C:\Users\user\Desktop\Xeno Executor.exe" MD5: 36517F5BFAE396A1D223E7491A3044CC)

Xeno Executor.exe (PID: 7756 cmdline: "C:\Users\user\Desktop\Xeno Executor.exe" MD5: 36517F5BFAE396A1D223E7491A3044CC)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "5.252.155.28", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "703", "self_destruct": true, "extensions": "none", "links": "none", "grabber_max_size": 1048576}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: Xeno Executor.exe PID: 7756	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: Xeno Executor.exe PID: 7756	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Process Memory Space: Xeno Executor.exe PID: 7756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.Xeno Executor.exe.140000000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
7.2.Xeno Executor.exe.140000000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T02:12:18.874077+0100	2049441	1	A Network Trojan was detected	192.168.2.7	49701	5.252.155.28	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T02:12:18.874077+0100	2050806	1	A Network Trojan was detected	192.168.2.7	49701	5.252.155.28	15666	TCP
2024-12-08T02:12:18.993941+0100	2050806	1	A Network Trojan was detected	192.168.2.7	49701	5.252.155.28	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T02:12:18.874077+0100	2050807	1	A Network Trojan was detected	192.168.2.7	49701	5.252.155.28	15666	TCP
2024-12-08T02:12:18.993941+0100	2050807	1	A Network Trojan was detected	192.168.2.7	49701	5.252.155.28	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 7.2.Xeno Executor.exe.140000000.0.raw.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "5.252.155.28", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "703", "self_destruct": true, "extensions": "none", "links": "none", "grabber_max_size": 1048576}

Multi AV Scanner detection for submitted file

Source: Xeno Executor.exe	ReversingLabs: Detection: 48%
Source: Xeno Executor.exe	Virustotal: Detection: 58%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: Xeno Executor.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140077BA0 CryptUnprotectData,LocalFree,	7_2_0000000140077BA0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140078020 BCryptDecrypt,BCryptDecrypt,	7_2_0000000140078020
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400783C0 BCryptCloseAlgorithmProvider,	7_2_00000001400783C0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140078440 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,Concurrency::cancel_current_task,	7_2_0000000140078440
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D5660 BCryptCloseAlgorithmProvider,	7_2_00000001400D5660
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D5688 BCryptSetProperty,	7_2_00000001400D5688
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140033A30 BCryptDestroyKey,	7_2_0000000140033A30
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140037C20 CryptUnprotectData,LocalFree,	7_2_0000000140037C20
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140077EC0 CryptProtectData,LocalFree,	7_2_0000000140077EC0

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49702 version: TLS 1.2

Source: Xeno Executor.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400BB500 FindClose,FindFirstFileExW,GetLastError,	7_2_00000001400BB500
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400BB5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	7_2_00000001400BB5B0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D54A0 FindFirstFileExW,	7_2_00000001400D54A0

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_00000001400873F0 GetLogicalDriveStringsW,

7_2_00000001400873F0

Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.7:49701 -> 5.252.155.28:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.7:49701 -> 5.252.155.28:15666

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 5.252.155.28:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: WORLDSTREAMNL WORLDSTREAMNL

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.7:49701 -> 5.252.155.28:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28
Source: unknown	TCP traffic detected without corresponding DNS query: 5.252.155.28

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_0000000140085240 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,Concurrency::cancel_current_task,

7_2_0000000140085240

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: Xeno Executor.exe, 00000007.00000003.1330445171.000001CF3C881000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000002.2522160496.000001CF3C890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTy
Source: Xeno Executor.exe, 00000007.00000003.1330445171.000001CF3C881000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000002.2522160496.000001CF3C890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotosh
Source: Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Xeno Executor.exe, 00000007.00000003.1331055519.000001CF3ACD6000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1346884496.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1346449596.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1347973430.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1349929772.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344651900.000001CF3ACF7000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1343381202.000001CF3D635000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D636000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1343381202.000001CF3D635000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D636000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1343381202.000001CF3D635000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D636000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: Xeno Executor.exe, 00000007.00000003.1352251079.000001CF3D7F8000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D659000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D651000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1352013074.000001CF3CA80000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1352013074.000001CF3CA88000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D67C000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356155482.000001CF3D76D000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356155482.000001CF3D775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: Xeno Executor.exe, 00000007.00000003.1352251079.000001CF3D7F8000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D659000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D651000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1352013074.000001CF3CA80000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1352013074.000001CF3CA88000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D67C000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356155482.000001CF3D76D000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356155482.000001CF3D775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Xeno Executor.exe, 00000007.00000003.1352623889.000001CF3D928000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1352013074.000001CF3CA8F000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356155482.000001CF3D77D000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Xeno Executor.exe, 00000007.00000003.1352623889.000001CF3D928000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1352013074.000001CF3CA8F000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356155482.000001CF3D77D000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D661000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49702 version: TLS 1.2

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_0000000140085B70 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

7_2_0000000140085B70

Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014008A430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	7_2_000000014008A430
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D56F8 NtQuerySystemInformation,	7_2_00000001400D56F8
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D5720 NtQueryObject,	7_2_00000001400D5720
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140089D30 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	7_2_0000000140089D30

Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014007F020	7_2_000000014007F020
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140088030	7_2_0000000140088030
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014008D050	7_2_000000014008D050
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014006D080	7_2_000000014006D080
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400320B0	7_2_00000001400320B0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014009918C	7_2_000000014009918C
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140085240	7_2_0000000140085240
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140045310	7_2_0000000140045310
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140066350	7_2_0000000140066350
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140030450	7_2_0000000140030450
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014003D570	7_2_000000014003D570
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400BB5B0	7_2_00000001400BB5B0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014008C5CB	7_2_000000014008C5CB
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014003E610	7_2_000000014003E610
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400C0658	7_2_00000001400C0658
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400876A0	7_2_00000001400876A0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014002F730	7_2_000000014002F730
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140086860	7_2_0000000140086860
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140065970	7_2_0000000140065970
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014003CA10	7_2_000000014003CA10
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140085B70	7_2_0000000140085B70
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140034B70	7_2_0000000140034B70
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140031B90	7_2_0000000140031B90
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140032CA0	7_2_0000000140032CA0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014003ECB0	7_2_000000014003ECB0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014002FE20	7_2_000000014002FE20
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400A2E3C	7_2_00000001400A2E3C
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140049F80	7_2_0000000140049F80
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400A30B8	7_2_00000001400A30B8
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014009F0D8	7_2_000000014009F0D8
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400070E0	7_2_00000001400070E0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014005C0F0	7_2_000000014005C0F0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400AC128	7_2_00000001400AC128
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D5140	7_2_00000001400D5140
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140093150	7_2_0000000140093150
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D5160	7_2_00000001400D5160
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140096164	7_2_0000000140096164
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D5168	7_2_00000001400D5168
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140006180	7_2_0000000140006180
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400A71D8	7_2_00000001400A71D8
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140091220	7_2_0000000140091220
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400702C0	7_2_00000001400702C0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014007E2F0	7_2_000000014007E2F0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140095394	7_2_0000000140095394
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400763A6	7_2_00000001400763A6
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400283D0	7_2_00000001400283D0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400AA3C8	7_2_00000001400AA3C8
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400293F0	7_2_00000001400293F0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014007B420	7_2_000000014007B420
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014005C420	7_2_000000014005C420
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014008A430	7_2_000000014008A430
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400AA44F	7_2_00000001400AA44F
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014005B480	7_2_000000014005B480
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400A14E4	7_2_00000001400A14E4
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140026510	7_2_0000000140026510
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140025520	7_2_0000000140025520
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140086540	7_2_0000000140086540
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140095598	7_2_0000000140095598
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140006610	7_2_0000000140006610
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014009666C	7_2_000000014009666C
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400A8674	7_2_00000001400A8674
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400A36A8	7_2_00000001400A36A8
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400A46E4	7_2_00000001400A46E4
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140054720	7_2_0000000140054720
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140062750	7_2_0000000140062750
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014008A780	7_2_000000014008A780
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014005B780	7_2_000000014005B780
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014009579C	7_2_000000014009579C
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014009F7E6	7_2_000000014009F7E6
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400398CD	7_2_00000001400398CD
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014007C8E0	7_2_000000014007C8E0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014009A924	7_2_000000014009A924
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140033A30	7_2_0000000140033A30
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400A6A68	7_2_00000001400A6A68
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140030A80	7_2_0000000140030A80
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140075AB0	7_2_0000000140075AB0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014005BAB0	7_2_000000014005BAB0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140060AC0	7_2_0000000140060AC0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140051AF0	7_2_0000000140051AF0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140078B00	7_2_0000000140078B00
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400ABB90	7_2_00000001400ABB90
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140057CEB	7_2_0000000140057CEB
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140090D14	7_2_0000000140090D14
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140074D40	7_2_0000000140074D40
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140098D50	7_2_0000000140098D50
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140005DB0	7_2_0000000140005DB0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014005BDD0	7_2_000000014005BDD0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014003ADD0	7_2_000000014003ADD0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140037E70	7_2_0000000140037E70
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140030E80	7_2_0000000140030E80
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140080E90	7_2_0000000140080E90
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140075EF0	7_2_0000000140075EF0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_000000014003BF40	7_2_000000014003BF40
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400BFFBC	7_2_00000001400BFFBC

Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: String function: 000000014002E1D0 appears 33 times
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: String function: 0000000140036940 appears 41 times
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: String function: 00000001400486B0 appears 92 times
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: String function: 000000014002BA80 appears 32 times
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: String function: 0000000140098254 appears 34 times

Source: Xeno Executor.exe

Static PE information: Number of sections : 11 > 10

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@1/2

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_000000014008B9B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

7_2_000000014008B9B0

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_000000014003E610 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

7_2_000000014003E610

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_0000000140074D40 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

7_2_0000000140074D40

Source: C:\Users\user\Desktop\Xeno Executor.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963857C1C36

Source: Xeno Executor.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Xeno Executor.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Xeno Executor.exe	ReversingLabs: Detection: 48%
Source: Xeno Executor.exe	Virustotal: Detection: 58%

Source: unknown	Process created: C:\Users\user\Desktop\Xeno Executor.exe "C:\Users\user\Desktop\Xeno Executor.exe"
Source: C:\Users\user\Desktop\Xeno Executor.exe	Process created: C:\Users\user\Desktop\Xeno Executor.exe "C:\Users\user\Desktop\Xeno Executor.exe"
Source: C:\Users\user\Desktop\Xeno Executor.exe	Process created: C:\Users\user\Desktop\Xeno Executor.exe "C:\Users\user\Desktop\Xeno Executor.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Xeno Executor.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Xeno Executor.exe

Static file information: File size 4269056 > 1048576

Source: Xeno Executor.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x38c000

Source: Xeno Executor.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Xeno Executor.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Xeno Executor.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Xeno Executor.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Xeno Executor.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Xeno Executor.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_000000014003D570 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

7_2_000000014003D570

Source: Xeno Executor.exe	Static PE information: section name: .00cfg
Source: Xeno Executor.exe	Static PE information: section name: .gxfg
Source: Xeno Executor.exe	Static PE information: section name: .retplne
Source: Xeno Executor.exe	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_000000014004CAB2 push rdi; retf 0004h

7_2_000000014004CAB5

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_000000014007C600 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

7_2_000000014007C600

Source: C:\Users\user\Desktop\Xeno Executor.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_7-67696

Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400BB500 FindClose,FindFirstFileExW,GetLastError,	7_2_00000001400BB500
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400BB5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	7_2_00000001400BB5B0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D54A0 FindFirstFileExW,	7_2_00000001400D54A0

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_00000001400873F0 GetLogicalDriveStringsW,

7_2_00000001400873F0

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_0000000140099038 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

7_2_0000000140099038

Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: Xeno Executor.exe	Binary or memory string: VBoxGuest
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Xeno Executor.exe	Binary or memory string: VBoxMouse
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Xeno Executor.exe	Binary or memory string: VBoxTray
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000003.1331055519.000001CF3ACD6000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1346884496.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1346449596.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1347973430.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1349929772.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8g
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Xeno Executor.exe, 00000007.00000003.1331055519.000001CF3ACD6000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1346884496.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1346449596.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1347973430.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1349929772.000001CF3ACD9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Xeno Executor.exe	Binary or memory string: VBoxMRXNP
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW k
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Xeno Executor.exe	Binary or memory string: VBoxHook
Source: Xeno Executor.exe	Binary or memory string: VBoxSF
Source: Xeno Executor.exe, 00000007.00000003.1346970475.000001CF3D71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\Xeno Executor.exe	API call chain: ExitProcess graph end node			graph_7-67646
Source: C:\Users\user\Desktop\Xeno Executor.exe	API call chain: ExitProcess graph end node			graph_7-67641

Source: C:\Users\user\Desktop\Xeno Executor.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_000000014008A430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

7_2_000000014008A430

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_00000001400AF2B8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_00000001400AF2B8

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_00000001400BD804 GetLastError,IsDebuggerPresent,OutputDebugStringW,

7_2_00000001400BD804

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_000000014003D570 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

7_2_000000014003D570

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_00000001400A9EEC GetProcessHeap,

7_2_00000001400A9EEC

Source: C:\Users\user\Desktop\Xeno Executor.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400AF2B8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00000001400AF2B8
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_00000001400D52E0 SetUnhandledExceptionFilter,	7_2_00000001400D52E0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: 7_2_0000000140097F68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0000000140097F68

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Xeno Executor.exe

Memory written: C:\Users\user\Desktop\Xeno Executor.exe base: 140000000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\Xeno Executor.exe

Thread register set: target process: 7756

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_000000014007B420 ShellExecuteW,

7_2_000000014007B420

Source: C:\Users\user\Desktop\Xeno Executor.exe

Process created: C:\Users\user\Desktop\Xeno Executor.exe "C:\Users\user\Desktop\Xeno Executor.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_00000001400ADF10 cpuid

7_2_00000001400ADF10

Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: GetLocaleInfoW,	7_2_000000014009E020
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: EnumSystemLocalesW,	7_2_00000001400A9030
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_00000001400A90C8
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: GetLocaleInfoEx,FormatMessageA,	7_2_00000001400BB170
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: GetLocaleInfoW,	7_2_00000001400A9310
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: GetLocaleInfoW,	7_2_00000001400D53A0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_00000001400A9468
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: GetLocaleInfoW,	7_2_00000001400A9518
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_00000001400A964C
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: EnumSystemLocalesW,	7_2_000000014009DAE0
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	7_2_00000001400A8C04
Source: C:\Users\user\Desktop\Xeno Executor.exe	Code function: EnumSystemLocalesW,	7_2_00000001400A8F60

Source: C:\Users\user\Desktop\Xeno Executor.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 5_2_00007FF6E3E2FDE4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00007FF6E3E2FDE4

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_0000000140086150 GetUserNameW,

7_2_0000000140086150

Source: C:\Users\user\Desktop\Xeno Executor.exe

Code function: 7_2_00000001400876A0 GetTimeZoneInformation,

7_2_00000001400876A0

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: Xeno Executor.exe PID: 7756, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 7.2.Xeno Executor.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Xeno Executor.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Xeno Executor.exe PID: 7756, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\config
Source: Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: Xeno Executor.exe, 00000007.00000003.1390249511.000001CF3F507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "software": "Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzNF0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K",
Source: Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: Xeno Executor.exe, 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\Xeno Executor.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\Xeno Executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Xeno Executor.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: Xeno Executor.exe PID: 7756, type: MEMORYSTR

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: Xeno Executor.exe PID: 7756, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 7.2.Xeno Executor.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Xeno Executor.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Xeno Executor.exe PID: 7756, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 Access Token Manipulation	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	211 Process Injection	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Xeno Executor.exe	49%	ReversingLabs	Win64.Trojan.MeduzaStealer
Xeno Executor.exe	58%	Virustotal		Browse
Xeno Executor.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ns.adobe.hotosh	Xeno Executor.exe, 00000007.00000003.1330445171.000001CF3C881000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000002.2522160496.000001CF3C890000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1343381202.000001CF3D635000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D636000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1343381202.000001CF3D635000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D636000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ns.a.0/sTy	Xeno Executor.exe, 00000007.00000003.1330445171.000001CF3C881000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000002.2522160496.000001CF3C890000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1343381202.000001CF3D635000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D636000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344651900.000001CF3ACF7000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org	Xeno Executor.exe, 00000007.00000003.1352251079.000001CF3D7F8000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D659000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D651000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1352013074.000001CF3CA80000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1352013074.000001CF3CA88000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D67C000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356155482.000001CF3D76D000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356155482.000001CF3D775000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Xeno Executor.exe, 00000007.00000003.1344330666.000001CF3D64E000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1344138386.000001CF3ACF2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D661000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D661000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	Xeno Executor.exe, 00000007.00000003.1357781449.000001CF3D6A9000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1357762679.000001CF3CFFA000.00000004.00000020.00020000.00000000.sdmp, Xeno Executor.exe, 00000007.00000003.1356421465.000001CF3D6A8000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.252.155.28	unknown	Russian Federation		49981	WORLDSTREAMNL	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570765
Start date and time:	2024-12-08 02:11:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Xeno Executor.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@1/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 64% Number of executed functions: 76 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Xeno Executor.exe, PID 7676 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.252.155.28	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse
5.252.155.28	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
104.26.13.205	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	172.67.74.152
	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	TECHNICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Shipping Documents 72908672134.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	y1rS62yprs.exe	Get hash	malicious	Babadeda	Browse	104.26.13.205
	apilibx64.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Delta.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.36.51
	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.185.163
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.24.90
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.185.163
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	8.44.96.113
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
WORLDSTREAMNL	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	5.252.155.28
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	5.252.155.28
	spc.elf	Get hash	malicious	Mirai	Browse	213.108.199.252
	https://kbprinters.com/serviciodecorreo/login	Get hash	malicious	Unknown	Browse	217.23.10.192
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	194.88.105.30
	1Zp7qa5zFD.exe	Get hash	malicious	AsyncRAT	Browse	89.39.106.35
	nabx86.elf	Get hash	malicious	Unknown	Browse	45.139.57.89
	SecuriteInfo.com.Trojan.DownLoader25.33926.32281.13140.exe	Get hash	malicious	Unknown	Browse	109.236.88.70
	SecuriteInfo.com.Trojan.DownLoader25.33926.32281.13140.exe	Get hash	malicious	Unknown	Browse	109.236.88.70
	sj9eYmr725.exe	Get hash	malicious	Quasar	Browse	185.177.125.198

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	104.26.13.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	104.26.13.205
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	Bank Swift and SOA PRN00720031415453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	AdminAccounts.aspx.dll	Get hash	malicious	Matanbuchus	Browse	104.26.13.205
	AdminAccounts.aspx.dll	Get hash	malicious	Matanbuchus	Browse	104.26.13.205

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	5.07543770420625
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Xeno Executor.exe
File size:	4'269'056 bytes
MD5:	36517f5bfae396a1d223e7491a3044cc
SHA1:	591a20349741340b21e0d3ea7d70a7df4043e925
SHA256:	e5d7e8537578b6c2f2ad9d842c51fcda0535c82b4e84c52537afe852687aa5f2
SHA512:	23dac5a4cca030209d9e35ba04bf0388aa0088d5e7ba4020978e77e1eeefe7f70be60bd8ccdfb81732523b726b225c6df48d005857f5b4424ec3df52f13b6394
SSDEEP:	49152:Xl4UjB0jUuB5ykrT/v+Qcr9tF3Vm2Jzd8SgN1IRA:14UjKguKA
TLSH:	3716E067E94078FED874903489970777A63BB480873287DB2698162A5E5BBD42F3FF40
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...r_@g.........."...........9................@..............................A...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14004fdd0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67405F72 [Fri Nov 22 10:39:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ce5eab935d79deb808c783e73ea12cf9

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F80DD3ABE40h
dec eax
add esp, 28h
jmp 00007F80DD3ABCAFh
int3
int3
dec eax
mov dword ptr [esp+18h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
dec eax
mov eax, dword ptr [003B7248h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007F80DD3ABEA6h
dec eax
and dword ptr [ebp+10h], 00000000h
dec eax
lea ecx, dword ptr [ebp+10h]
call dword ptr [003AC582h]
dec eax
mov eax, dword ptr [ebp+10h]
dec eax
mov dword ptr [ebp-10h], eax
call dword ptr [003AC4D4h]
mov eax, eax
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [003AC4C0h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+18h]
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [003AC630h]
mov eax, dword ptr [ebp+18h]
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+18h]
dec eax
xor eax, dword ptr [ebp-10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3fbdb8	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x419000	0x1a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x40b000	0x6594	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x41a000	0x1e18	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3efd80	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe60a0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3fc1e0	0x3d8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x79116	0x79200	101fd131b38e4fd5c4b31887d7ad38f3	False	0.49460421504127966	data	6.44155671990377	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7b000	0x38bebc	0x38c000	160cc843cdb283940f2f610c7cff832f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x407000	0x36f8	0x1c00	7568d2f08f4ac81dae4d5e33ab60923a	False	0.17047991071428573	zlib compressed data	3.5531018656709605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x40b000	0x6594	0x6600	496dfa0147e7c873a9f17489df23c1fc	False	0.4821155024509804	data	5.74343672787325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x412000	0x38	0x200	7c2bb310d1981b513910f4cc9c8721d1	False	0.0703125	data	0.4879996533427816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x413000	0x2200	0x2200	a3fb3e1da377202334d413fbe0e439a4	False	0.4314108455882353	data	5.230691552229934	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0x416000	0x8c	0x200	8c950f651287cbc1296bcb4e8cd7e990	False	0.126953125	data	1.050583247971927
.tls	0x417000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x418000	0x1f4	0x200	d5aa635e227a5741f7ba58c4dba5b19f	False	0.525390625	data	4.216026285396426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x419000	0x1a8	0x200	d38b4cd68eb239a7aa6a06b6f8091e1d	False	0.484375	data	4.179663701400347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x41a000	0x1e18	0x2000	6ea7154105c61bbadcf24404b7fcf3ec	False	0.6947021484375	data	6.375630824063806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x419060	0x143	XML 1.0 document, ASCII text	English	United States	0.628482972136223

Imports

DLL	Import
USER32.dll	GetRawInputDeviceInfoW, GetRawInputDeviceList
KERNEL32.dll	AcquireSRWLockExclusive, AreFileApisANSI, CloseHandle, CreateFileMappingW, CreateFileW, CreateProcessA, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindFirstFileW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FormatMessageA, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileAttributesExW, GetFileInformationByHandleEx, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoEx, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetUserDefaultLCID, GlobalAlloc, GlobalFree, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, K32EnumDeviceDrivers, K32GetDeviceDriverBaseNameW, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LocalFree, MapViewOfFile, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReadProcessMemory, ReleaseSRWLockExclusive, ResumeThread, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind, SetFilePointerEx, SetLastError, SetStdHandle, SetThreadContext, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, UnmapViewOfFile, VirtualAlloc, VirtualAllocEx, VirtualFree, VirtualProtect, VirtualQuery, VirtualQueryEx, WideCharToMultiByte, WriteConsoleW, WriteFile, WriteProcessMemory
MPR.dll	WNetCloseEnum, WNetEnumResourceA, WNetOpenEnumA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T02:12:18.874077+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.7	49701	5.252.155.28	15666	TCP
2024-12-08T02:12:18.874077+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.7	49701	5.252.155.28	15666	TCP
2024-12-08T02:12:18.874077+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.7	49701	5.252.155.28	15666	TCP
2024-12-08T02:12:18.993941+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.7	49701	5.252.155.28	15666	TCP
2024-12-08T02:12:18.993941+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.7	49701	5.252.155.28	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 02:12:08.261595964 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:08.381135941 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:08.381207943 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:10.676445007 CET	49702	443	192.168.2.7	104.26.13.205
Dec 8, 2024 02:12:10.676465988 CET	443	49702	104.26.13.205	192.168.2.7
Dec 8, 2024 02:12:10.676740885 CET	49702	443	192.168.2.7	104.26.13.205
Dec 8, 2024 02:12:10.684488058 CET	49702	443	192.168.2.7	104.26.13.205
Dec 8, 2024 02:12:10.684503078 CET	443	49702	104.26.13.205	192.168.2.7
Dec 8, 2024 02:12:12.053451061 CET	443	49702	104.26.13.205	192.168.2.7
Dec 8, 2024 02:12:12.053667068 CET	49702	443	192.168.2.7	104.26.13.205
Dec 8, 2024 02:12:12.108831882 CET	49702	443	192.168.2.7	104.26.13.205
Dec 8, 2024 02:12:12.108846903 CET	443	49702	104.26.13.205	192.168.2.7
Dec 8, 2024 02:12:12.109116077 CET	443	49702	104.26.13.205	192.168.2.7
Dec 8, 2024 02:12:12.110470057 CET	49702	443	192.168.2.7	104.26.13.205
Dec 8, 2024 02:12:12.111655951 CET	49702	443	192.168.2.7	104.26.13.205
Dec 8, 2024 02:12:12.159329891 CET	443	49702	104.26.13.205	192.168.2.7
Dec 8, 2024 02:12:12.493623018 CET	443	49702	104.26.13.205	192.168.2.7
Dec 8, 2024 02:12:12.493674994 CET	443	49702	104.26.13.205	192.168.2.7
Dec 8, 2024 02:12:12.493755102 CET	49702	443	192.168.2.7	104.26.13.205
Dec 8, 2024 02:12:12.494049072 CET	49702	443	192.168.2.7	104.26.13.205
Dec 8, 2024 02:12:12.494059086 CET	443	49702	104.26.13.205	192.168.2.7
Dec 8, 2024 02:12:18.874077082 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:18.993789911 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.993803024 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.993860006 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.993906021 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.993941069 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:18.993984938 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:18.994040012 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.994071960 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.994116068 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:18.994133949 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:18.994163990 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.994178057 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.994225025 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:18.994287968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.994297981 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:18.994334936 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:18.994359016 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.114729881 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.114768028 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.114850998 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.114859104 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.114861965 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.114891052 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.114902973 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.114908934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.114932060 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.114991903 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.115004063 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.115739107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.115771055 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.115822077 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.115881920 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.115941048 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.117014885 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.117069006 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.117101908 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.117151022 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.117156982 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.117213011 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.117913961 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.117971897 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.234483957 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.234524012 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.234584093 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.234592915 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.234646082 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.234669924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.234723091 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.234734058 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.234782934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.234787941 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.234833956 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.235419035 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.235485077 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.235541105 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.235553026 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.235615969 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.235650063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.235673904 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.235699892 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.236500025 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.236541986 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.236551046 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.236582041 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.236594915 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.236604929 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.236649036 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.236691952 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.236746073 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.236747980 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.236788034 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.236860037 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.236900091 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.236910105 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.236948013 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.237018108 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.237027884 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.237081051 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.237133026 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.237159967 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.237190962 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.237209082 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.237643957 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.237664938 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.237696886 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.237711906 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.237737894 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.237790108 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.237801075 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.237838030 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354020119 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354136944 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354163885 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354197979 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354240894 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354291916 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354301929 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354337931 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354379892 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354397058 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354432106 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354490995 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354501009 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354538918 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354557991 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354562998 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354568005 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354671001 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354681015 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354712963 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354732990 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354743958 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354754925 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354795933 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354809046 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354851961 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354892969 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354923010 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354937077 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.354949951 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354990959 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.354991913 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355047941 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355096102 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355112076 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355123997 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355144978 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355158091 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355178118 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355195999 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355235100 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355302095 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355361938 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355367899 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355396986 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355442047 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355451107 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355489969 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355499029 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355562925 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355571985 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355624914 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355684996 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355695009 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355755091 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355772972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355782986 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355813026 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.355839014 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355866909 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.355966091 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356025934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356065035 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356079102 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356117964 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356120110 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356194973 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356240034 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356242895 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356261015 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356286049 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356311083 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356338024 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356348038 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356399059 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356404066 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356416941 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356467962 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356523991 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356534004 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356583118 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356645107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356656075 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356688976 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356703043 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356712103 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356765985 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356806040 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356816053 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356867075 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.356877089 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356925011 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.356976032 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.357047081 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357057095 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357110977 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.357110977 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357122898 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357166052 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.357193947 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357235909 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357269049 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357299089 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357304096 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.357358932 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.357399940 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357409954 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357444048 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.357460022 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.357480049 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357490063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.357539892 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.474589109 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.474598885 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.474644899 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.474716902 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.474754095 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.475116968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475167990 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.475214005 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475224972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475274086 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.475307941 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475332022 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475348949 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.475383997 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.475421906 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475433111 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475477934 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.475483894 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475493908 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475539923 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.475902081 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475909948 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.475954056 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.475961924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.476027012 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.476094007 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.476142883 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.476468086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.476478100 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.476511002 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.476521015 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.476558924 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.477272034 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.477294922 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.477332115 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.477333069 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.477349997 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.477366924 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.477655888 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.477675915 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.477705002 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.477720976 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.477777004 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.477804899 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.477821112 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.477855921 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.477901936 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.477912903 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.477960110 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.477987051 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478018999 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478032112 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478071928 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478105068 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478113890 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478163004 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478210926 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478257895 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478281021 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478297949 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478307009 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478332996 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478351116 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478388071 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478398085 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478442907 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478564024 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478573084 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478616953 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478656054 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478666067 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478704929 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478733063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478746891 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478786945 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478811026 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478815079 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478826046 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478869915 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.478929996 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478939056 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478971004 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.478980064 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.479022980 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.479670048 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.479712963 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.479718924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.479729891 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.479763985 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.479764938 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.479774952 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.479795933 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.479799032 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.479826927 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.479881048 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.480323076 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.480370998 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.480418921 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.480429888 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.480438948 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.480478048 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.480544090 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.480554104 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.480573893 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.480591059 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.480601072 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.480628014 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.481636047 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.481645107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.481684923 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.481694937 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.481720924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.481738091 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.481756926 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.481796980 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.481828928 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.481842041 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.481867075 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.481878042 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.481923103 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.482597113 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.482640028 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.482682943 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.482692957 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.482741117 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.482785940 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.482803106 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.482819080 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.482831955 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.482842922 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.482861042 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.484455109 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.484476089 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.484504938 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.484520912 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.484568119 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.484579086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.484611034 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.484611988 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.484628916 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.484641075 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.484654903 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.484703064 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.484720945 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.484769106 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.485641956 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.485666990 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.485718966 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.485744953 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.485754967 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.485799074 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.485845089 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.485855103 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.485888004 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.485908031 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.485925913 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487401962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487423897 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487449884 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487466097 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487472057 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487507105 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487521887 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487541914 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487684965 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487694979 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487740040 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487741947 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487785101 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487793922 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487822056 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487828016 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487868071 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487891912 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.487936020 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.487987995 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488007069 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488051891 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488053083 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488060951 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488123894 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488154888 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488164902 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488192081 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488212109 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488224983 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488243103 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488284111 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488354921 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488369942 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488394022 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488415956 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488416910 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488434076 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488475084 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488480091 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488497972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488527060 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488555908 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488580942 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488596916 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488641977 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488662958 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488672972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488694906 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488718987 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488732100 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488737106 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488786936 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488830090 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488840103 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488882065 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488924026 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488933086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488972902 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.488981009 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.488981962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489008904 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489031076 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489087105 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489120960 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489128113 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489202976 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489218950 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489229918 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489275932 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489303112 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489340067 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489355087 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489379883 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489398956 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489413977 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489434958 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489444971 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489464998 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489506006 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489514112 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489548922 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489587069 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489598989 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489630938 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489638090 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.489691973 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.489726067 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.594204903 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594218969 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594288111 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594321966 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.594345093 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594352007 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.594394922 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.594433069 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594443083 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594481945 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.594630957 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594670057 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.594700098 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594744921 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.594835043 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594844103 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594892025 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594901085 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.594904900 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.594948053 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595004082 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595052004 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595118999 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595128059 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595141888 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595153093 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595170021 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595199108 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595216990 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595227003 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595247984 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595271111 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595284939 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595320940 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595347881 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595376968 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595390081 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595418930 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595427990 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595468998 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595549107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595558882 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595598936 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595604897 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595616102 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595650911 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595726013 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595735073 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595742941 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595776081 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595798016 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595832109 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595841885 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595885992 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.595921993 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.595990896 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.596009970 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.596019030 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.596051931 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.596074104 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.596153975 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.596163988 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.596210003 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.596247911 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.596291065 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.596736908 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.596786976 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.596832991 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.596849918 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.596882105 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.596899033 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.596966028 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.596975088 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597017050 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597023010 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597068071 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597182989 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597193003 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597233057 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597254992 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597306013 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597313881 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597325087 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597335100 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597352982 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597373962 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597440958 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597455978 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597480059 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597481012 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597491980 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597508907 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597526073 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597537041 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597611904 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597621918 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597661972 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597703934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597714901 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597728968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597747087 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597764969 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597795010 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597805023 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597815037 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597856998 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597887039 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597939968 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.597970963 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597987890 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.597996950 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598018885 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598042965 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598154068 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598162889 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598182917 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598203897 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598229885 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598289013 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598309040 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598319054 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598346949 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598361969 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598371983 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598411083 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598484039 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598494053 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598534107 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598557949 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598568916 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598577976 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598609924 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598630905 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598656893 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598666906 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598711967 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598766088 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598774910 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598783016 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598822117 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598867893 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598879099 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598889112 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598970890 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.598973989 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598985910 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.598997116 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599005938 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599020004 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599035025 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599050045 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599076033 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599086046 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599128008 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599179029 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599190950 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599214077 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599220037 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599224091 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599245071 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599252939 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599253893 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599275112 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599298954 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599318027 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599344015 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599406004 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599416018 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599450111 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599457979 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599468946 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599497080 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599515915 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599522114 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599534035 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599577904 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599622011 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599673986 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599684954 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599697113 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599708080 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599724054 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599750042 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599801064 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599811077 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599827051 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599874973 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.599981070 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.599989891 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600053072 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.600081921 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600094080 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600116968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600128889 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.600140095 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600151062 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.600167990 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.600181103 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.600217104 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600227118 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600275993 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.600311041 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600352049 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600362062 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600366116 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.600399971 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600402117 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.600445032 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.600471973 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.600517988 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.601165056 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601175070 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601217031 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.601259947 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601269960 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601313114 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.601322889 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601356983 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601366043 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.601387024 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.601422071 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601464987 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.601511002 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601521015 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601530075 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601557970 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.601572990 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.601598024 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601649046 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.601706028 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601716042 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601720095 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.601771116 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602045059 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602089882 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602231979 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602256060 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602267027 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602278948 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602293968 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602313042 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602322102 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602354050 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602365017 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602369070 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602411032 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602524996 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602535009 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602567911 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602583885 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602598906 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602608919 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602636099 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.602663994 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.602679968 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.603949070 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604001045 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604041100 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604089022 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604099035 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604150057 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604161978 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604198933 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604206085 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604245901 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604266882 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604310036 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604335070 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604351044 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604367971 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604382038 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604403019 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604422092 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604433060 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604473114 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604491949 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604532957 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604542971 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.604543924 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.604579926 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.605192900 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605202913 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605247974 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.605278015 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605288029 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605331898 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.605365992 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605376005 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605413914 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.605457067 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605482101 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605490923 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605511904 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.605532885 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.605564117 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605612040 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.605654001 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605663061 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605674028 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605704069 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.605725050 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.605745077 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.605796099 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.606971025 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607029915 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.607029915 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607075930 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.607142925 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607153893 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607201099 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.607352972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607399940 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.607440948 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607489109 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.607548952 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607595921 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607597113 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.607639074 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.607790947 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607800961 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607845068 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.607887983 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607898951 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.607940912 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.607990980 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608006954 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608035088 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608048916 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608148098 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608160019 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608197927 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608321905 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608339071 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608371973 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608392954 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608407021 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608422041 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608445883 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608460903 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608597994 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608644009 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608650923 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608695030 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608876944 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.608927965 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.608961105 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609004974 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609026909 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609071970 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609113932 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609123945 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609155893 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609168053 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609179974 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609205961 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609252930 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609262943 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609304905 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609389067 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609400034 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609441996 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609450102 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609462023 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609472036 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609498024 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609524965 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609575987 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609585047 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609589100 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609638929 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609668016 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609678030 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609687090 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609697104 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609711885 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609745979 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609822989 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609833002 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609842062 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.609930038 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.609999895 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610009909 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610018015 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610028028 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610057116 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610088110 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610097885 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610106945 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610143900 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610260010 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610270023 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610282898 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610292912 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610301971 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610322952 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610356092 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610367060 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610409021 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610428095 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610439062 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610446930 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610503912 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610559940 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610569000 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610578060 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610616922 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610682011 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610692978 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610703945 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610708952 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610752106 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610775948 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610786915 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610835075 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610862017 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610862970 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610872030 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610882998 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610913992 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610933065 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.610959053 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610981941 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.610991001 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611011982 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611030102 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611037016 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611131907 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611140966 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611150980 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611186028 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611202002 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611212969 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611255884 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611264944 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611319065 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611356020 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611366034 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611390114 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611403942 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611432076 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611521959 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611531019 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611574888 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611623049 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611670971 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611728907 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611738920 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611748934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611788988 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611831903 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611841917 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611881018 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611881971 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611936092 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.611963987 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611974001 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.611996889 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.612016916 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.612036943 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.714160919 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.714238882 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.714277029 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.714315891 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.714425087 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.714478016 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.714502096 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.714545965 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.714632988 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.714679003 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.714684010 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.714724064 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.714796066 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.714845896 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.714920044 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.714967966 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.714975119 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715018034 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715075970 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715091944 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715123892 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715142965 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715150118 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715194941 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715368032 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715415001 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715415955 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715461969 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715527058 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715536118 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715575933 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715672016 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715692997 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715714931 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715730906 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715811968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715821981 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715862989 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.715904951 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.715955019 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716023922 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716034889 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716043949 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716078043 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716108084 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716149092 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716200113 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716201067 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716244936 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716398954 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716444016 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716465950 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716507912 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716557980 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716567993 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716607094 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716660976 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716720104 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716749907 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716798067 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716826916 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716875076 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.716939926 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716980934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.716986895 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.717036009 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.717118979 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.717164040 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.717227936 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.717274904 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.717425108 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.717472076 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.717509031 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.717559099 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.717752934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.717799902 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.717910051 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.717955112 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718039036 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718049049 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718090057 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718142986 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718187094 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718223095 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718251944 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718274117 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718290091 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718365908 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718386889 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718408108 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718409061 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718426943 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718444109 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718558073 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718604088 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718672037 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718719959 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718796968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718839884 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.718879938 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.718924046 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719003916 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719012976 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719059944 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719125032 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719146967 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719182014 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719201088 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719228983 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719276905 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719338894 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719387054 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719464064 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719505072 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719536066 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719583988 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719607115 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719661951 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719664097 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719703913 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719713926 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719750881 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719829082 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719840050 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719847918 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719888926 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719903946 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.719921112 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719932079 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.719969988 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720009089 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720053911 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720244884 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720253944 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720263004 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720283031 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720307112 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720354080 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720362902 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720405102 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720422983 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720433950 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720469952 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720572948 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720582962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720623016 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720647097 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720690966 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720721960 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720767021 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720814943 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720832109 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720876932 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.720937967 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720964909 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.720984936 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721014023 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721035957 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721046925 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721081972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721088886 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721129894 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721173048 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721183062 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721193075 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721216917 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721241951 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721281052 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721291065 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721333981 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721362114 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721381903 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721411943 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721436977 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721462965 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721509933 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721556902 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721565962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721596956 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721604109 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721615076 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721652031 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721764088 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721776962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721821070 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.721875906 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.721925020 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722014904 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722023964 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722033024 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722068071 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722089052 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722119093 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722129107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722181082 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722213030 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722235918 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722274065 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722284079 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722292900 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722321987 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722338915 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722342014 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722356081 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722382069 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722393036 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722469091 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722480059 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722512960 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722526073 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722532034 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722547054 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722557068 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722580910 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722605944 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722640038 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722650051 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722661018 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722676992 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722698927 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722714901 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722775936 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722786903 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722795963 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722805023 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722827911 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722858906 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.722955942 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722965956 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722975969 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722986937 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.722996950 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723012924 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723042011 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723069906 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723079920 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723089933 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723121881 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723143101 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723222017 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723232985 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723242044 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723257065 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723267078 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723308086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723310947 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723350048 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723417997 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723431110 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723442078 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723459959 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723474026 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723493099 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723534107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723576069 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723615885 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723627090 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723651886 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723658085 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723676920 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723697901 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723777056 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723823071 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723886967 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723897934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723906994 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723932028 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723937988 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723942041 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.723954916 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.723989010 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724037886 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724082947 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724179029 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724190950 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724199057 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724226952 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724241972 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724296093 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724308014 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724345922 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724381924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724427938 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724462032 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724473000 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724512100 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724525928 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724564075 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724592924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724608898 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724634886 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724647999 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724657059 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724668026 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724704027 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724864006 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724896908 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.724916935 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724942923 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.724992037 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.725039959 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.725047112 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.725085974 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.725135088 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.725178957 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.725182056 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.725193977 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.725219965 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.725233078 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.725236893 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.725272894 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.725408077 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.725431919 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.725449085 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.725476980 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726070881 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726093054 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726103067 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726116896 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726119041 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726138115 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726142883 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726147890 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726159096 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726170063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726170063 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726181984 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726197958 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726202011 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726213932 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726224899 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726232052 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726233959 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726246119 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726254940 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726257086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726268053 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726285934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726289034 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726300001 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726315022 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726317883 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726330042 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726339102 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726351023 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726357937 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726377010 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726392031 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726403952 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726403952 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726444960 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726468086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726481915 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726515055 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726532936 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726541042 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726579905 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726641893 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726653099 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726669073 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726684093 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726703882 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726761103 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726783991 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726804972 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726820946 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.726918936 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.726964951 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727047920 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727091074 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727138996 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727178097 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727209091 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727219105 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727252960 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727266073 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727308989 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727396011 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727446079 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727525949 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727564096 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727652073 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727662086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727689981 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727716923 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727721930 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727772951 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.727869034 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.727910995 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728018045 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728066921 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728075027 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728116989 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728138924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728189945 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728236914 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728270054 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728285074 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728317976 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728368998 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728416920 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728441000 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728493929 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728562117 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728610992 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728672981 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728724957 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.728894949 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.728955030 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.729000092 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.729051113 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.729142904 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.729192019 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.729240894 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.729285955 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.729371071 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.729409933 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.729422092 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.729450941 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.729542971 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.729593039 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.729607105 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.729655981 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.729790926 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.729825020 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.729954958 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730010033 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730015993 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730046988 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730118036 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730164051 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730220079 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730254889 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730261087 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730302095 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730382919 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730418921 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730438948 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730473995 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730518103 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730541945 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730568886 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730585098 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730626106 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730678082 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730716944 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730767965 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730781078 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730832100 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730854034 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730906963 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730910063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.730957031 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.730978966 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731029987 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731038094 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731081963 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731153011 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731175900 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731199980 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731229067 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731369972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731380939 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731427908 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731479883 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731527090 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731570959 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731584072 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731632948 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731658936 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731707096 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731758118 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731770992 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731802940 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731818914 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731859922 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731914043 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731925011 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.731971025 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.731977940 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732031107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732031107 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732084036 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732181072 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732191086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732239008 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732248068 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732300997 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732408047 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732424021 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732435942 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732461929 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732487917 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732553005 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732563972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732609987 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732628107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732680082 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732754946 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732805967 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732821941 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732830048 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732867956 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.732876062 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.732925892 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733005047 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733014107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733061075 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733128071 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733181000 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733242989 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733253002 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733309984 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733344078 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733386993 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733459949 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733469009 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733520031 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733525991 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733575106 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733695030 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733705044 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733751059 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733769894 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733818054 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733875036 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733884096 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.733933926 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.733979940 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.734026909 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.769534111 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.769731998 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.769807100 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.769859076 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.813214064 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.813388109 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.836632967 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.836740971 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.836782932 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.836852074 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.836879015 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.836906910 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.836956978 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.836978912 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.837030888 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.837122917 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.837169886 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.837398052 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.837451935 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.837683916 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.837718010 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.837764978 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.837801933 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.837832928 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.837848902 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.837881088 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.837937117 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.837980032 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838066101 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838112116 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838114023 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838159084 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838165045 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838177919 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838207006 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838227034 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838304996 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838315010 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838357925 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838409901 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838418961 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838459015 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838481903 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838501930 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838511944 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838555098 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838558912 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838581085 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838602066 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838624954 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838695049 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838710070 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838747978 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838814974 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838824034 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838831902 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838860035 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838867903 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838871002 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838900089 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838913918 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.838939905 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838948965 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838984966 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.838992119 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839029074 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839040995 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839060068 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839081049 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839098930 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839117050 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839144945 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839168072 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839184046 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839205027 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839215040 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839253902 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839257002 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839306116 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839359999 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839370012 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839412928 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839442015 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839489937 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839502096 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839510918 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839559078 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839560032 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839608908 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839636087 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839647055 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839672089 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839678049 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839701891 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839718103 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839744091 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839778900 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839797020 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839812994 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839857101 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839883089 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839891911 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839900017 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839922905 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839934111 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.839943886 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839987040 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.839987040 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840029955 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840035915 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840075016 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840112925 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840157032 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840181112 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840189934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840229034 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840266943 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840317011 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840328932 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840364933 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840373039 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840409040 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840415001 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840459108 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840488911 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840533018 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840548038 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840590000 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840595961 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840636015 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840665102 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840709925 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840709925 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840739965 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840758085 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840775967 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840807915 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840856075 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.840945005 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840955019 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840965033 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840972900 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.840993881 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841017008 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841068029 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841077089 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841084003 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841094017 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841118097 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841139078 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841164112 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841214895 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841253996 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841263056 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841295958 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841304064 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841305017 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841346979 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841403008 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841412067 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841466904 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841506004 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841562033 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841602087 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841645956 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841686010 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841695070 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841732979 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841743946 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841784000 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841829062 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841839075 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841857910 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841873884 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841895103 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841902971 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841928959 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841938019 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.841980934 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.841990948 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842036009 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842094898 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842103004 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842133999 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842137098 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842158079 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842169046 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842196941 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842231035 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842242002 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842272997 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842338085 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842346907 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842366934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842391968 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842397928 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842411041 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842428923 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842494011 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842519045 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842533112 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842550039 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842567921 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842577934 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842580080 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842636108 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842700958 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842710972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842740059 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842757940 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842781067 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842804909 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842817068 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842840910 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842856884 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842889071 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842901945 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842911005 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.842946053 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.842986107 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843030930 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843034029 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843060017 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843071938 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843082905 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843103886 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843117952 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843131065 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843174934 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843214989 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843247890 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843261957 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843277931 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843334913 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843343973 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843381882 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843400955 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843444109 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843571901 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843585968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843604088 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843619108 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843624115 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843627930 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843641043 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843656063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843661070 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843667030 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843676090 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843677044 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843692064 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843725920 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843727112 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843771935 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843797922 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843810081 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843843937 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843863010 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843885899 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843930006 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.843955040 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843992949 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.843998909 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844002962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844044924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844046116 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844068050 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844089985 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844105005 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844152927 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844162941 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844198942 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844211102 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844233990 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844252110 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844290972 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844300032 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844333887 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844357967 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844368935 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844412088 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844429016 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844475031 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844496965 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844506979 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844544888 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844552040 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844558001 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844587088 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844599962 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844605923 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844647884 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844650030 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844679117 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844696999 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844717979 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844794989 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844820023 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844829082 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844868898 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844887018 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844912052 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.844961882 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844973087 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.844988108 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845005035 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845024109 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845032930 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845110893 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845118999 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845155954 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845236063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845283985 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845371962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845381975 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845391035 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845431089 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845529079 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845540047 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845561028 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845572948 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845594883 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845664024 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845678091 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845696926 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845704079 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845722914 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845736027 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845793009 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845803022 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845850945 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845906973 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845946074 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.845947027 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.845984936 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846097946 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846112013 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846146107 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846159935 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846210003 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846221924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846263885 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846312046 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846343994 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846359015 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846406937 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846430063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846438885 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846477985 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846591949 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846601963 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846643925 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846762896 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846810102 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846854925 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846864939 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846904993 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.846976042 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.846985102 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847023010 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847045898 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847079992 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847095013 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847115040 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847136974 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847157955 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847223043 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847264051 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847348928 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847372055 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847381115 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847393990 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847414970 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847486019 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847534895 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847641945 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847650051 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847654104 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847706079 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847707033 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847754002 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847831011 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847840071 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847865105 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.847868919 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847887993 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.847904921 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848012924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848062038 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848104000 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848148108 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848205090 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848220110 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848246098 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848264933 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848309994 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848336935 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848354101 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848371983 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848407984 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848417044 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848453045 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848469019 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848495960 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848505020 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848551035 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848582983 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848592997 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848625898 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848640919 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848669052 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848743916 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848752975 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848757029 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848803043 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.848953962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.848963022 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849008083 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849060059 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849080086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849107027 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849123001 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849205971 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849222898 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849245071 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849262953 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849308968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849355936 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849411964 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849426031 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849436045 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849451065 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849472046 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849490881 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849535942 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849550009 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849560022 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849581957 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849600077 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849617004 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849664927 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849708080 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849715948 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849725962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849766016 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849783897 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849827051 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849829912 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849869967 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849904060 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.849948883 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.849980116 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850029945 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850084066 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850125074 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850181103 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850189924 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850229025 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850292921 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850322008 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850338936 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850378990 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850403070 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850430012 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850440025 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850481033 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850538015 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850547075 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850595951 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850637913 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850660086 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850682974 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850698948 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850785017 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850794077 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850828886 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.850895882 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850904942 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.850944996 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851048946 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851093054 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851170063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851177931 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851227045 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851320982 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851366043 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851464987 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851485968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851510048 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851526022 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851537943 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851547003 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851588011 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851643085 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851682901 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851691961 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851725101 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851767063 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851777077 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851819038 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851820946 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851865053 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851917028 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851927042 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851934910 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.851973057 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.851989031 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852016926 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852026939 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852047920 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852067947 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852083921 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852128983 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852138042 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852180958 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852235079 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852243900 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852253914 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852288961 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852297068 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852308035 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852335930 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852338076 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852355957 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852374077 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852385998 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852433920 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852447987 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852489948 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852588892 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852598906 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852608919 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852642059 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852683067 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852720976 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852756023 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852804899 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.852942944 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852952957 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.852993965 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853037119 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853081942 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853152037 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853166103 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853189945 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853194952 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853214979 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853233099 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853281021 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853296995 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853307962 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853327036 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853348017 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853427887 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853437901 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853446007 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853461027 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853470087 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853477955 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853497982 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853508949 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853625059 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853635073 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853642941 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853656054 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853688002 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853704929 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853732109 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853743076 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853753090 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853775024 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853794098 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853852034 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853862047 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853873014 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853890896 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853900909 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853902102 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853918076 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853946924 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.853988886 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.853997946 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.854038954 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.854461908 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.854470968 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.854511976 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.888890028 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.889091015 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.889278889 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.889353037 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.889417887 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.889482975 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.889537096 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.889591932 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.929368019 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.929523945 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.929609060 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.966958046 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967037916 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967142105 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967144012 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967184067 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967294931 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967336893 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967398882 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967426062 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967485905 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967494965 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967551947 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967551947 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967603922 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967679024 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967716932 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967736959 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967796087 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967817068 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967868090 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967890978 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967926025 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.967953920 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:19.967973948 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968040943 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968101978 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968153000 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968204975 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968264103 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968314886 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968389034 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968439102 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968502045 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968530893 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:19.968563080 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.008743048 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:20.008961916 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.009223938 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.009299040 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.009373903 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.009432077 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.009494066 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.009569883 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.009628057 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.009694099 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.009726048 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.048940897 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:20.049091101 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.049191952 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.049256086 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.049312115 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.049344063 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.084160089 CET	15666	49701	5.252.155.28	192.168.2.7
Dec 8, 2024 02:12:20.084400892 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.084498882 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.084568977 CET	49701	15666	192.168.2.7	5.252.155.28
Dec 8, 2024 02:12:20.084639072 CET	49701	15666	192.168.2.7	5.252.155.28

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 02:12:10.533164978 CET	192.168.2.7	1.1.1.1	0x390b	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 02:12:10.669888020 CET	1.1.1.1	192.168.2.7	0x390b	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 8, 2024 02:12:10.669888020 CET	1.1.1.1	192.168.2.7	0x390b	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 8, 2024 02:12:10.669888020 CET	1.1.1.1	192.168.2.7	0x390b	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	104.26.13.205	443	7756	C:\Users\user\Desktop\Xeno Executor.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 01:12:12 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-12-08 01:12:12 UTC	424	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 01:12:12 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ee8e2c50f267d20-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1949&min_rtt=1949&rtt_var=731&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=738&delivery_rate=1495901&cwnd=207&unsent_bytes=0&cid=cbae281e8950ac39&ts=452&x=0"
2024-12-08 01:12:12 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Target ID:	5
Start time:	20:12:05
Start date:	07/12/2024
Path:	C:\Users\user\Desktop\Xeno Executor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Xeno Executor.exe"
Imagebase:	0x7ff6e3de0000
File size:	4'269'056 bytes
MD5 hash:	36517F5BFAE396A1D223E7491A3044CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:12:06
Start date:	07/12/2024
Path:	C:\Users\user\Desktop\Xeno Executor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Xeno Executor.exe"
Imagebase:	0x7ff6e3de0000
File size:	4'269'056 bytes
MD5 hash:	36517F5BFAE396A1D223E7491A3044CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000007.00000002.2521297473.000001CF3AC59000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00007FF6E3E2FDE4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6E3E2FE10
GetCurrentThreadId.KERNEL32 ref: 00007FF6E3E2FE1E
GetCurrentProcessId.KERNEL32 ref: 00007FF6E3E2FE2A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6E3E2FE3A

Strings

HZJj1;, xrefs: 00007FF6E3E2FDF1

Memory Dump Source

Source File: 00000005.00000002.1286713785.00007FF6E3DE1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E3DE0000, based on PE: true

Associated: 00000005.00000002.1286693582.00007FF6E3DE0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1286759536.00007FF6E3E5B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1286759536.00007FF6E3E74000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1286759536.00007FF6E41CF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1286984488.00007FF6E41E7000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1287002403.00007FF6E41EB000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1287002403.00007FF6E41F3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1287043431.00007FF6E41F8000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff6e3de0000_Xeno Executor.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID: HZJj1;
API String ID: 2933794660-3872777969
Opcode ID: 66dffe7ee173be83caf6d25513cd58fc43f63803bf13eaf2a3b2507e135e52d1
Instruction ID: 410c2159adae6d3dbc0c3540fde5a32cd3fb764311c80c0fb3cf854c5e6989eb
Opcode Fuzzy Hash: 66dffe7ee173be83caf6d25513cd58fc43f63803bf13eaf2a3b2507e135e52d1
Instruction Fuzzy Hash: 7C11183BB14B068AEF008FB0E8953B833A4FB59758F441E31DA6D86BA4EF79D1548341

Analysis Process: Xeno Executor.exePID: 7756, Parent PID: 7676COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	34%
Total number of Nodes:	2000
Total number of Limit Nodes:	64

Executed Functions

Function 0000000140085B70 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 0000000140085BB1
GetSystemMetrics.USER32 ref: 0000000140085BBF
GetSystemMetrics.USER32 ref: 0000000140085BCD
GetSystemMetrics.USER32 ref: 0000000140085BDB
GetDC.USER32 ref: 0000000140085BE5
GetDeviceCaps.GDI32 ref: 0000000140085BFB
GetDeviceCaps.GDI32 ref: 0000000140085C0B
CreateCompatibleDC.GDI32 ref: 0000000140085C18
CreateCompatibleBitmap.GDI32 ref: 0000000140085C30
SelectObject.GDI32 ref: 0000000140085C46
BitBlt.GDI32 ref: 0000000140085C7C
SHCreateMemStream.SHLWAPI ref: 0000000140085CB2
SelectObject.GDI32 ref: 0000000140085CC8
DeleteDC.GDI32 ref: 0000000140085CD1
ReleaseDC.USER32 ref: 0000000140085CDC
DeleteObject.GDI32 ref: 0000000140085CE5
EnterCriticalSection.KERNEL32 ref: 0000000140085DDC
LeaveCriticalSection.KERNEL32 ref: 0000000140085DEE
IStream_Size.SHLWAPI ref: 0000000140085E25
IStream_Reset.SHLWAPI ref: 0000000140085E36
IStream_Read.SHLWAPI ref: 0000000140085EBB
SelectObject.GDI32 ref: 0000000140085F15
DeleteDC.GDI32 ref: 0000000140085F1E
ReleaseDC.USER32 ref: 0000000140085F2B
DeleteObject.GDI32 ref: 0000000140085F34

Strings

, xrefs: 0000000140085C51

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 4710b68569ca780a62200bacad1ebb062b7f91ede9e3e6ff6f294ad99d40d26f
Instruction ID: 703b3a6d47ced6971692c6e043727a25a26f8932f149495a63e694f68f4715db
Opcode Fuzzy Hash: 4710b68569ca780a62200bacad1ebb062b7f91ede9e3e6ff6f294ad99d40d26f
Instruction Fuzzy Hash: A4B12E32208BC086E761DB22E8543DEB7A5FB8DBC1F408515EB8A43B69DF38C185CB40

Function 00000001400BB5B0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000001400BB65D
GetLastError.KERNEL32 ref: 00000001400BB667
FindFirstFileW.KERNEL32 ref: 00000001400BB67E
GetLastError.KERNEL32 ref: 00000001400BB68A
FindClose.KERNEL32 ref: 00000001400BB698
__std_fs_open_handle.LIBCPMT ref: 00000001400BB72B
CloseHandle.KERNEL32 ref: 00000001400BB741
CloseHandle.KERNEL32 ref: 00000001400BB8B4

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction ID: fde7f6f548f3d5d2f6b779677d4d0ac92ef93c0439d4cbf494ca9037cd0bf826
Opcode Fuzzy Hash: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction Fuzzy Hash: 50918E32204E0147E6769FA7A8047AA23A4AB8D7F5F584714FBB6476F4DFB8CA05C740

Function 0000000140088030 Relevance: 24.4, APIs: 3, Strings: 10, Instructions: 1600COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140086C70: GetCurrentHwProfileW.ADVAPI32 ref: 0000000140086CAC

Part of subcall function 0000000140086540: EnumDisplayDevicesW.USER32 ref: 0000000140086657
Part of subcall function 0000000140086540: EnumDisplayDevicesW.USER32 ref: 00000001400866FB

Part of subcall function 0000000140086460: RegGetValueA.ADVAPI32 ref: 00000001400864C9

Part of subcall function 0000000140086150: GetUserNameW.ADVAPI32 ref: 0000000140086195

Part of subcall function 00000001400861F0: GetComputerNameW.KERNEL32 ref: 0000000140086235

GlobalMemoryStatusEx.KERNEL32 ref: 00000001400887BC
wcsftime.LIBCMT ref: 0000000140088FB2
GetModuleFileNameA.KERNEL32 ref: 0000000140089146

Strings

ram, xrefs: 000000014008889B
%d-%m-%Y, %H:%M:%S, xrefs: 0000000140088F9F
timezone, xrefs: 0000000140089454
system, xrefs: 0000000140088424, 0000000140088513, 0000000140088609, 0000000140088703, 000000014008884B, 0000000140088945, 0000000140088A38, 0000000140088BBF, 0000000140088DB0, 0000000140089031, 00000001400891F4, 000000014008940E, 00000001400895AD, 0000000140089757, 000000014008981D
703, xrefs: 0000000140089542
cpu, xrefs: 0000000140088658
computer_name, xrefs: 0000000140088994
gpu, xrefs: 0000000140088562
user_name, xrefs: 000000014008846F
time, xrefs: 0000000140089081

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$703$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-3080301907
Opcode ID: 105b35c7cd9f97e9bf0823eaba5ad81c6242bc7294dbbe056df0648c1a514868
Instruction ID: ef48f63d2ae941425971807c1aa70cd5c410dc9acdd5c2c92023eb79a0c271c1
Opcode Fuzzy Hash: 105b35c7cd9f97e9bf0823eaba5ad81c6242bc7294dbbe056df0648c1a514868
Instruction Fuzzy Hash: 34F25A33614BC085EB22DB26E8903DD77A1F799798F419616FB9D47BA9DB38C284C700

Function 0000000140065970 Relevance: 22.8, Strings: 18, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

prefs.js, xrefs: 000000014006E5E2
exists, xrefs: 0000000140065F90, 000000014006A58E, 000000014006A5DE, 000000014006A6AC, 000000014006A76E, 000000014006A83C, 000000014006CA70, 000000014006D060, 000000014006F48D, 000000014006F779
@, xrefs: 000000014006A32B
directory_iterator::directory_iterator, xrefs: 000000014006A5A5, 000000014006A853, 000000014006A875, 000000014006A8AD, 000000014006CA83, 000000014006DE23, 000000014006F4A4, 000000014006F78C
IndexedDB, xrefs: 0000000140067261, 00000001400699E3, 000000014006A173
key, xrefs: 000000014006C60E, 000000014006C740
filename, xrefs: 0000000140066D9C, 00000001400678E3, 0000000140068376, 0000000140068E23, 0000000140069793, 0000000140069F35, 000000014006D5FC, 000000014006DAE0
Profile, xrefs: 000000014006627B
gecko_browsers, xrefs: 000000014006D70F, 000000014006DBF2, 000000014006E13F
., xrefs: 0000000140065C70
@, xrefs: 0000000140069B9B
cannot use push_back() with , xrefs: 000000014006A625, 000000014006A6FE, 000000014006A7B5, 000000014006DDD5
chrome_key, xrefs: 000000014006C851, 000000014006C97F
status, xrefs: 000000014006A5B5, 000000014006A600, 000000014006A6D9, 000000014006A790, 000000014006A863, 000000014006A885, 000000014006A89B, 000000014006A8BD, 000000014006CA99, 000000014006DE11, 000000014006DE33, 000000014006DE5B, 000000014006DE83, 000000014006F764
recursive_directory_iterator::recursive_directory_iterator, xrefs: 000000014006A68F, 000000014006A6C9, 000000014006A81F
recursive_directory_iterator::operator++, xrefs: 000000014006A678, 000000014006A745, 000000014006A808
Default, xrefs: 0000000140066236
content, xrefs: 0000000140066EB7, 00000001400679CA, 000000014006845D, 0000000140068F0A, 00000001400698AE, 000000014006A03E, 000000014006D6B3, 000000014006DB94

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: .$@$@$Default$IndexedDB$Profile$cannot use push_back() with $chrome_key$content$directory_iterator::directory_iterator$exists$filename$gecko_browsers$key$prefs.js$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 0-111102830
Opcode ID: d85864b6336acd62be5f7280330fa91da0aadc80efc30bd9caf6eb99ab158536
Instruction ID: 76d522da9c60edd065d321252c96f4a617312223c2e0a99c55d01cc88780bd8f
Opcode Fuzzy Hash: d85864b6336acd62be5f7280330fa91da0aadc80efc30bd9caf6eb99ab158536
Instruction Fuzzy Hash: 40C18232200B8586EB62EF26D8843ED63A2F76C7D5F644A11FB9D437A5DB78C941C740

Function 0000000140066350 Relevance: 20.4, APIs: 1, Strings: 10, Instructions: 1136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Local State, xrefs: 0000000140065FDB
exists, xrefs: 000000014006A5DE, 000000014006A6AC, 000000014006A76E, 000000014006A83C
cannot use push_back() with , xrefs: 000000014006A625, 000000014006A6FE, 000000014006A7B5
directory_iterator::directory_iterator, xrefs: 000000014006A853, 000000014006A875, 000000014006A8AD
status, xrefs: 000000014006A600, 000000014006A6D9, 000000014006A790, 000000014006A863, 000000014006A885, 000000014006A89B, 000000014006A8BD
User Data, xrefs: 0000000140065DB1
recursive_directory_iterator::recursive_directory_iterator, xrefs: 000000014006A68F, 000000014006A6C9, 000000014006A81F
recursive_directory_iterator::operator++, xrefs: 000000014006A678, 000000014006A745, 000000014006A808
Default, xrefs: 0000000140066236
Profile, xrefs: 000000014006627B

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: Default$Local State$Profile$User Data$cannot use push_back() with $directory_iterator::directory_iterator$exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-3151314615
Opcode ID: cb657a3996e88f9932c6a43c7c3531ce994b41ef932ca5a706a954d2abf0d1c6
Instruction ID: f21b02361ede85f61df800ca6bf13452383e2cb6baab2eb8982a43a3ae70ec85
Opcode Fuzzy Hash: cb657a3996e88f9932c6a43c7c3531ce994b41ef932ca5a706a954d2abf0d1c6
Instruction Fuzzy Hash: C7D21172519BC886D6718B1AE88139BB3A1F7DC784F505625EBCC53B69EB7CC294CB00

Function 000000014003D570 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014003D65C
GetProcAddress.KERNEL32 ref: 000000014003D767
GetProcAddress.KERNEL32 ref: 000000014003D829
GetProcAddress.KERNEL32 ref: 000000014003D8A3
GetProcAddress.KERNEL32 ref: 000000014003D925
GetProcAddress.KERNEL32 ref: 000000014003D99F
GetProcAddress.KERNEL32 ref: 000000014003DA23
FreeLibrary.KERNEL32 ref: 000000014003E551

Strings

system, xrefs: 000000014003E35D
cannot use push_back() with , xrefs: 000000014003E59F
vault, xrefs: 000000014003E3B3

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: fafd76ba07d69584645bf33fa7b900a195455fa1a8abfe6877a7fd7569c5da7b
Instruction ID: 2a92ccc5b1d467f17da58c6df9da55f1dc7976cf29d812e554c759641952edc1
Opcode Fuzzy Hash: fafd76ba07d69584645bf33fa7b900a195455fa1a8abfe6877a7fd7569c5da7b
Instruction Fuzzy Hash: 15924C72205BC489DB628F26E8843DE77B5F749798F504216EB9C4BBA9EF74C684C700

Function 0000000140034B70 Relevance: 17.1, APIs: 3, Strings: 6, Instructions: 1343registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014003509B
RegQueryValueExA.ADVAPI32 ref: 00000001400350E9
RegCloseKey.ADVAPI32 ref: 0000000140035186

Strings

Wallets, xrefs: 00000001400355FC, 0000000140035C55, 0000000140036181
exists, xrefs: 0000000140036398, 00000001400363E3, 000000014003647A
directory_iterator::directory_iterator, xrefs: 0000000140036441
status, xrefs: 0000000140036403, 0000000140036413
content, xrefs: 00000001400355A3, 0000000140035BF6, 0000000140036120
filename, xrefs: 000000014003549A, 0000000140035A28, 0000000140035F59

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: Wallets$content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3677997916-331726099
Opcode ID: c7734a0d1231dce296452ad1afaca9f3a6e4d40f2e4a13ff44d22133890dc3ec
Instruction ID: 7b7ad4ccabc59f41d35c00ebb4a54e0cc5e1f704924bbbbd3f86ce4379df2c1a
Opcode Fuzzy Hash: c7734a0d1231dce296452ad1afaca9f3a6e4d40f2e4a13ff44d22133890dc3ec
Instruction Fuzzy Hash: F7E24B72615BC08AEB729F36D8803DD73A5F789798F505216EB9C4BAA9DF74C684C300

Function 0000000140032CA0 Relevance: 16.5, APIs: 3, Strings: 6, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140033022
RegQueryValueExA.ADVAPI32 ref: 000000014003306A
RegCloseKey.ADVAPI32 ref: 00000001400330F7

Strings

Wallets, xrefs: 00000001400336ED
exists, xrefs: 00000001400339BE
directory_iterator::directory_iterator, xrefs: 00000001400339DD
status, xrefs: 00000001400339F9
content, xrefs: 0000000140033694
filename, xrefs: 0000000140033500

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: Wallets$content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3677997916-331726099
Opcode ID: 6fa42396e6029cb9532ff93e4bf8fd3bbf6f65c3de85a75353121e72c8de5844
Instruction ID: 177c1d7675dde2ac949eba8f41182ce89ac29bc87b60f10449c8d26a9429c7de
Opcode Fuzzy Hash: 6fa42396e6029cb9532ff93e4bf8fd3bbf6f65c3de85a75353121e72c8de5844
Instruction Fuzzy Hash: D5824A72611BC48AEB628F3AD8803DE73A1F789798F505216EB9D57BA9DF34C584C340

Function 000000014007C600 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007F820: GetCurrentProcess.KERNEL32 ref: 000000014007F85B
Part of subcall function 000000014007F820: OpenProcessToken.ADVAPI32 ref: 000000014007F86E
Part of subcall function 000000014007F820: GetTokenInformation.ADVAPI32 ref: 000000014007F8AA
Part of subcall function 000000014007F820: CloseHandle.KERNEL32 ref: 000000014007F8CB

ExitProcess.KERNEL32 ref: 000000014007C647
OpenMutexA.KERNEL32 ref: 000000014007C762
ExitProcess.KERNEL32 ref: 000000014007C772
CreateMutexA.KERNEL32 ref: 000000014007C791
ExitProcess.KERNEL32 ref: 000000014007C7B7

Part of subcall function 000000014007FB60: GetModuleFileNameW.KERNEL32 ref: 000000014007FBAA

Part of subcall function 000000014008A780: CoInitializeEx.OLE32 ref: 000000014008A7EA

Strings

SeDebugPrivilege, xrefs: 000000014007C64E
SeImpersonatePrivilege, xrefs: 000000014007C65A

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CloseCreateCurrentFileHandleInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 4279366119-3768118664
Opcode ID: 36f185b1df742de67076eec8cb6712ace61768d659a16a8e636eab3012611ba1
Instruction ID: f0f72c2fcd6d8b6b2264c2f1e6e52021c272493f6cdf96abffc9b24865ed5704
Opcode Fuzzy Hash: 36f185b1df742de67076eec8cb6712ace61768d659a16a8e636eab3012611ba1
Instruction Fuzzy Hash: B2619F32618A8481FA62AB66E4523EE63A0FB8D7C0F505615FB8D47AF6DF3CC1418B11

Function 00000001400320B0 Relevance: 14.7, APIs: 3, Strings: 5, Instructions: 684
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140032409
RegQueryValueExA.ADVAPI32 ref: 000000014003244E
RegCloseKey.ADVAPI32 ref: 00000001400324F7

Strings

Wallets, xrefs: 000000014003296E
exists, xrefs: 0000000140032C42
directory_iterator::directory_iterator, xrefs: 0000000140032C64
content, xrefs: 0000000140032915
filename, xrefs: 0000000140032787

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: Wallets$content$directory_iterator::directory_iterator$exists$filename
API String ID: 3677997916-4231923139
Opcode ID: 9a91b14f7d960f65d34c233a383209922ffca6b72530cd8d509c60a6aacfc5ed
Instruction ID: db1664ec86df15eb83f53bf5ceff4b3bbab913ad6086724e2e1923656db5ce1d
Opcode Fuzzy Hash: 9a91b14f7d960f65d34c233a383209922ffca6b72530cd8d509c60a6aacfc5ed
Instruction Fuzzy Hash: F8724A72611BC48AEB228F36D8803DD77A1F789798F509215EB9D5BBA9DF34C684C340

Function 00000001400A2E3C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000001400A2E81

Part of subcall function 00000001400A24E8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A24FC

Part of subcall function 000000014009D3C8: HeapFree.KERNEL32 ref: 000000014009D3DE
Part of subcall function 000000014009D3C8: GetLastError.KERNEL32 ref: 000000014009D3E8

Part of subcall function 00000001400ABA84: _invalid_parameter_noinfo.LIBCMT ref: 00000001400AB9CF

_get_daylight.LIBCMT ref: 00000001400A2E70

Part of subcall function 00000001400A2548: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A255C

_get_daylight.LIBCMT ref: 00000001400A30E6
_get_daylight.LIBCMT ref: 00000001400A30F7
_get_daylight.LIBCMT ref: 00000001400A3108
GetTimeZoneInformation.KERNEL32 ref: 00000001400A312F

Strings

Eastern Standard Time, xrefs: 00000001400A31D5
Eastern Summer Time, xrefs: 00000001400A31ED

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: d27e707e32a7a668b79f18f39980f86f66c1361dc0c94ac41fd5faca01788e5a
Instruction ID: 33c1b94af872691e134a774f96405fbf90e61f0c3ac2d4846b7876194704bd86
Opcode Fuzzy Hash: d27e707e32a7a668b79f18f39980f86f66c1361dc0c94ac41fd5faca01788e5a
Instruction Fuzzy Hash: 93D1A03271024086EB26EF37D8517E967A1F7ACBD4F448236FF5947AA6DB38C4818B40

Function 0000000140085240 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000000014008540B
InternetOpenUrlA.WININET ref: 00000001400854E8
HttpQueryInfoW.WININET ref: 0000000140085549
HttpQueryInfoW.WININET ref: 00000001400855E2
InternetQueryDataAvailable.WININET ref: 0000000140085626
InternetReadFile.WININET ref: 00000001400856E9
InternetQueryDataAvailable.WININET ref: 00000001400857B4
InternetCloseHandle.WININET ref: 000000014008585E
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400858BB

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: ce3a76f5a34c2e0a500909917f6fe4a2089fd67f17f51432d2aeec27fecab31b
Instruction ID: eaeee93a036ee1abdefdafc7409104f1436ae897ae3bf0d765108de91cf4717b
Opcode Fuzzy Hash: ce3a76f5a34c2e0a500909917f6fe4a2089fd67f17f51432d2aeec27fecab31b
Instruction Fuzzy Hash: A3025A33A14B9486EB11DB6AE84039E77A5F7997D8F204215EF9C57BA8EF78C180C700

Function 00000001400C0658 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400C023C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400C027D
Part of subcall function 00000001400C023C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400C02FB
Part of subcall function 00000001400C023C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400C034C

CreateFileW.KERNEL32 ref: 00000001400C075E
CreateFileW.KERNEL32 ref: 00000001400C07AE
GetLastError.KERNEL32 ref: 00000001400C07DE
GetFileType.KERNEL32 ref: 00000001400C07F3
GetLastError.KERNEL32 ref: 00000001400C07FD
CloseHandle.KERNEL32 ref: 00000001400C0830
CloseHandle.KERNEL32 ref: 00000001400C0993
CreateFileW.KERNEL32 ref: 00000001400C09C8
GetLastError.KERNEL32 ref: 00000001400C09D7

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction ID: 83644b67ebb14751364ddfbcc329ed2d9831cfd477b754813198fa2ff24e4f8c
Opcode Fuzzy Hash: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction Fuzzy Hash: FBC19B36724B448AEB15DFAAC4907AD3761F78DBE8F015215EF2A9B7A5CB38C056C340

Function 000000014007F020 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 000000014007F261
SetFilePointer.KERNEL32 ref: 000000014007F314
ReadFile.KERNEL32 ref: 000000014007F343

Strings

exists, xrefs: 000000014007F7CA
ios_base::badbit set, xrefs: 000000014007F771, 000000014007F7EF
ios_base::failbit set, xrefs: 000000014007F77D
ios_base::eofbit set, xrefs: 000000014007F784

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 5c5fe27d13f194aec453fdf1c703f87ca3d76affe3d521e3af280ab530f96c79
Instruction ID: 0185fc879b9b74ec622a7c15d7a6a3f555fd217371db62066f43d50a43c916a9
Opcode Fuzzy Hash: 5c5fe27d13f194aec453fdf1c703f87ca3d76affe3d521e3af280ab530f96c79
Instruction Fuzzy Hash: 67321632614BC489EB21CF35D8807ED37A1F789B88F548226EB4D5BBA9EB74C645D700

Function 00000001400A30B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00000001400A30E6

Part of subcall function 00000001400A2548: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A255C

_get_daylight.LIBCMT ref: 00000001400A30F7

Part of subcall function 00000001400A24E8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A24FC

_get_daylight.LIBCMT ref: 00000001400A3108

Part of subcall function 00000001400A2518: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A252C

Part of subcall function 000000014009D3C8: HeapFree.KERNEL32 ref: 000000014009D3DE
Part of subcall function 000000014009D3C8: GetLastError.KERNEL32 ref: 000000014009D3E8

GetTimeZoneInformation.KERNEL32 ref: 00000001400A312F

Strings

Eastern Standard Time, xrefs: 00000001400A31D5
Eastern Summer Time, xrefs: 00000001400A31ED

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: a0b2f147c5ed72e73a9ba99eccd64d774068bd057930b9dd808764ab5dc4e304
Instruction ID: db0e2232302c0215c246f8571b916b6a2febf07c2da0425627d7512260a1f4b0
Opcode Fuzzy Hash: a0b2f147c5ed72e73a9ba99eccd64d774068bd057930b9dd808764ab5dc4e304
Instruction Fuzzy Hash: 68514D3261064086F722EF37E8917D96761F79CBC4F44922AFB4D47AB6DB38C5818B40

Function 000000014009918C Relevance: 9.2, APIs: 6, Instructions: 227COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400991AE
_get_daylight.LIBCMT ref: 000000014009920E
_get_daylight.LIBCMT ref: 000000014009921F
_get_daylight.LIBCMT ref: 0000000140099230
_isindst.LIBCMT ref: 0000000140099281
_isindst.LIBCMT ref: 00000001400992D4

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction ID: af26a4f8801793d3ce11611fdac42a3e64f2a46bd35c7c59f6a568dcc363727b
Opcode Fuzzy Hash: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction Fuzzy Hash: D681C7B27003454BEB598F6AC9417E873A5F75CBC8F449129FB098B7A9EB38D541CB40

Function 0000000140049F80 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 417COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000000014004A134
__std_exception_destroy.LIBVCRUNTIME ref: 000000014004A142
__std_exception_destroy.LIBVCRUNTIME ref: 000000014004A3C5
__std_exception_destroy.LIBVCRUNTIME ref: 000000014004A3D3

Strings

value, xrefs: 000000014004A05A, 000000014004A2F3

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 1a0a312c14c4b9a9553b0e30a444405b0e410a2171ffdd72e7d38aeeb9d04e96
Instruction ID: 8abbc166ef407fa0914d6b06b85154435862c1efb651b818f75f1c6fc62bbeaf
Opcode Fuzzy Hash: 1a0a312c14c4b9a9553b0e30a444405b0e410a2171ffdd72e7d38aeeb9d04e96
Instruction Fuzzy Hash: 05028C72A14BC085EB12DB7AD4803ED6761E78A7E4F515222FB9D03AEADF78C185C700

Function 000000014003E610 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003E65A
Process32FirstW.KERNEL32 ref: 000000014003E69C
Process32NextW.KERNEL32 ref: 000000014003E893
CloseHandle.KERNEL32 ref: 000000014003EB0A

Strings

[PID: , xrefs: 000000014003E6DE

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: 47a25ee8b5c82c9a2b2c365947ba00758a5183252d71e6613a97e77c179ec976
Instruction ID: bfbc4f987db6bac77f1b81780ed5057e34160ebcb8b68fb86d12c3b761a621f6
Opcode Fuzzy Hash: 47a25ee8b5c82c9a2b2c365947ba00758a5183252d71e6613a97e77c179ec976
Instruction Fuzzy Hash: 91E16E72614BC085EB22DB26E8943DE67A5F7897E8F504215FB9D07BA9DF38C284C700

Function 000000014006D080 Relevance: 8.1, Strings: 6, Instructions: 599COMMON

Download Yara Rule

Strings

prefs.js, xrefs: 000000014006E5E2
exists, xrefs: 000000014006F48D
Profiles, xrefs: 000000014006CE81
cannot use push_back() with , xrefs: 000000014006DDD5
directory_iterator::directory_iterator, xrefs: 000000014006DE23, 000000014006F4A4
status, xrefs: 000000014006DE11, 000000014006DE33, 000000014006DE5B, 000000014006DE83

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: Profiles$cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-1457875953
Opcode ID: 583c73e28accecfadc168d97d9bb04e7e7c0b97172d336abba2105cbf3bf67e8
Instruction ID: 11a6efe290b92f49e28e44d36ea43a092b01f2eba203cd018676c1bdfd9b7a94
Opcode Fuzzy Hash: 583c73e28accecfadc168d97d9bb04e7e7c0b97172d336abba2105cbf3bf67e8
Instruction Fuzzy Hash: 81522872509FC485E6B29B16E8813DAB3A5F7C9784F505626EBCC43B69EF38C594CB00

Function 000000014008B9B0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000014008B9FE
OpenProcessToken.ADVAPI32 ref: 000000014008BA11
LookupPrivilegeValueW.ADVAPI32 ref: 000000014008BA32
AdjustTokenPrivileges.ADVAPI32 ref: 000000014008BA78
CloseHandle.KERNEL32 ref: 000000014008BA98

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction ID: 8e4f8d06d2c4ddfc7e806934d087d01799faa900bb6cc1b317aeea0d8f8b28af
Opcode Fuzzy Hash: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction Fuzzy Hash: CC214832218B8086E761DB22F45439AB7A4FB8CB90F958125FB8947B68DF7DC5458B40

Function 000000014003CA10 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000000014003CA72
CredFree.ADVAPI32 ref: 000000014003D496

Strings

cannot use push_back() with , xrefs: 000000014003D4E4

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 930a2e9a1bb0917b399954ee30a2fa4a54a42119b2565512f38186b15b8f8ab5
Instruction ID: f7b8f71b35ba7077e24cf974827ed01f7a602007d80a493374c150ca5ffd965d
Opcode Fuzzy Hash: 930a2e9a1bb0917b399954ee30a2fa4a54a42119b2565512f38186b15b8f8ab5
Instruction Fuzzy Hash: A4625D72614BC489EB22CF26E8803DD7761F789798F505316EBAD57BA9DB38C294C700

Function 00000001400876A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00000001400879D0

Strings

[UTC, xrefs: 00000001400879A3

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: 69f4163a387a64d30980e57af93b300bb1dd5483a82c179968bd749bb4137c3c
Instruction ID: 52f665e2fd4094696151a96eee92445b588682f36c98eb811415d14b9ef7eede
Opcode Fuzzy Hash: 69f4163a387a64d30980e57af93b300bb1dd5483a82c179968bd749bb4137c3c
Instruction Fuzzy Hash: 06B13B32614BC88AD7718F2AE84139AB7A5F78D788F105315EBCC57B69EB78C250CB44

Function 0000000140077BA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140077BF8
LocalFree.KERNEL32 ref: 0000000140077C8A

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction ID: 4296086251868e59c58a0d25c4c96546d3d1b8368fdcc8e5a20c42b548a3eb4e
Opcode Fuzzy Hash: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction Fuzzy Hash: 8D414232614B80CAE3229F35E4407ED37A4F75978CF484229BB8C07E9ADB79C6A4C754

Function 00000001400873F0 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 0000000140087461

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 8f7b76c8c7a97eafc7baaa1f30fd7dfc3995e14b8cd39339a4877971754c2c66
Instruction ID: f2cab6ee8911013723ff3d4b8f532fa1eef750fceda41a605a97ef7ce25926e1
Opcode Fuzzy Hash: 8f7b76c8c7a97eafc7baaa1f30fd7dfc3995e14b8cd39339a4877971754c2c66
Instruction Fuzzy Hash: E1519C33A18B8082E711CF2AE48039EB7B5F789798F505215EB9C13AB9DB78D591DB40

Function 0000000140086150 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0000000140086195

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: abf913a544c6f9fdd308559da787f240108ca61f3614bb29fccc85bbbd2848d6
Instruction ID: 6386a9c63b89e62e1e7c53e5db0f7fdfe8938b55c0afa06648929fea26598edc
Opcode Fuzzy Hash: abf913a544c6f9fdd308559da787f240108ca61f3614bb29fccc85bbbd2848d6
Instruction Fuzzy Hash: 67011E3251878086EB62DF26E85539AA3A4F79C788F541215FB8D43659DBBCC1948B40

Function 0000000140086860 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

cores, xrefs: 0000000140086ABE

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: c012ebea7cea5508256f9b7b32f734d30493b7f7331743f4b8e8cd1a3cd0dcf0
Instruction ID: d3262c633b295208c5961c06593242e7b47d8fd585a162be60b5762b3157baba
Opcode Fuzzy Hash: c012ebea7cea5508256f9b7b32f734d30493b7f7331743f4b8e8cd1a3cd0dcf0
Instruction Fuzzy Hash: E2C1DEB3E14B808AEB11CB79D4403ED7761F39D7A8F105715EBA817AAADB78C285C740

Function 000000014008D050 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 000000014008D242

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: 2764dba0f84da04d7b54bcc964d0cd32bf37b2397344f3073766bb7b0663e68a
Instruction ID: 2d8851c51790dd1c3718914d1aafb06cbace47ee840a32990fd9a175e8b29b8b
Opcode Fuzzy Hash: 2764dba0f84da04d7b54bcc964d0cd32bf37b2397344f3073766bb7b0663e68a
Instruction Fuzzy Hash: 4181EF33204A9492EA56DB66E550BEE7761F799BC0F848622EF4E43BA5DF38C615C300

Function 000000014008C5CB Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

": , xrefs: 000000014008C6B1, 000000014008C75E

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: 057b35939bb715e8c3fccde18bf4a01ede3a255fa1bc5061a8c29ebb9342f7ef
Instruction ID: d32eb5bd7aa32db0d383c6563baefba3b4bb722cd0727c790415934f3a3ba72c
Opcode Fuzzy Hash: 057b35939bb715e8c3fccde18bf4a01ede3a255fa1bc5061a8c29ebb9342f7ef
Instruction Fuzzy Hash: 1C910176304A8581EB219F2AE194B9E77B1F789FC8F459002DB9E0BB65CF39C559CB00

Function 0000000140045310 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 0000000140045399

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: a7242879f608aa47813c865fc74e262a7c273f84777ad565790803f492419e94
Instruction ID: 014310bfbc4a3b67612d0ff5db8dcfc52a4721cd440e8a7597f65d7e1b9a6290
Opcode Fuzzy Hash: a7242879f608aa47813c865fc74e262a7c273f84777ad565790803f492419e94
Instruction Fuzzy Hash: 0041B2736196E04AD702CB3A84113BD7FB2E36AB89F1D8162E7D48B757D62DC216CB10

Function 000000014003ECB0 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ae9e57260c4d9c2420833d6abcaa42bc826476d953803981e3bbde9089d802
Instruction ID: 48bad8dc5ae2a98fb94f6420d9c53863b15f7aea20f291205fb5ec39bd34d449
Opcode Fuzzy Hash: a6ae9e57260c4d9c2420833d6abcaa42bc826476d953803981e3bbde9089d802
Instruction Fuzzy Hash: 2D722A72615BC489EB228B6AE8803DE73A1F78D798F504315EF9C57BA9DB78C244C704

Function 000000014002F730 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127a710e31e9e959bd1efdee8cd92842b4768b0bfe61b8490464264f99784d1a
Instruction ID: 09b45337b1f777d5d18b9b6a60bb218e0a3e2faf57d77cfaa0b1546ae7cfb2e5
Opcode Fuzzy Hash: 127a710e31e9e959bd1efdee8cd92842b4768b0bfe61b8490464264f99784d1a
Instruction Fuzzy Hash: D6F15F72A15B888AEB218B6AE44139D77A1F78C7D8F104315FFDC57B99EB78C1908B00

Function 0000000140030450 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c660904164d709bc0acbb2f48409fe5df30a48554c19a8bdbe458204b02a07d7
Instruction ID: be49e157e2d86195976c6eff1131ce5322fd73392ca890e3637407cd31db1fd4
Opcode Fuzzy Hash: c660904164d709bc0acbb2f48409fe5df30a48554c19a8bdbe458204b02a07d7
Instruction Fuzzy Hash: CFF14F72A05F888AEB218B69E44139E77A4F78C798F104315EFDC57B99EF38C1908B40

Function 000000014002FE20 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baaf814a5b2074fa26d348928cf27470832879dc243f1d708684dcff653bcd19
Instruction ID: 99921ffeac1e544745e1f80987790f99c38e85693d9ba4107b4788d85d03955b
Opcode Fuzzy Hash: baaf814a5b2074fa26d348928cf27470832879dc243f1d708684dcff653bcd19
Instruction Fuzzy Hash: 81F15F72605F888AEB618B6AE44139E77A4F38C798F104315FFDC57B99EB78C1908B40

Function 0000000140031B90 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7032578eb44d1cc3852a1f22707c9417288992426b2c68f63b2c84fe19f9a49a
Instruction ID: 6e5b374be89616aabab1282ed81929e9f4660f4cd366e2351babe77a13f61e33
Opcode Fuzzy Hash: 7032578eb44d1cc3852a1f22707c9417288992426b2c68f63b2c84fe19f9a49a
Instruction Fuzzy Hash: 83D17932B14B8089F712CBB5D4403ED37B2E79D78CF115619AF8C27AAADB348595C384

Function 000000014007EBF0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007E970: InitializeCriticalSectionEx.KERNEL32 ref: 000000014007E9C1
Part of subcall function 000000014007E970: GetLastError.KERNEL32 ref: 000000014007E9CB

EnterCriticalSection.KERNEL32 ref: 000000014007EC31
GdiplusStartup.GDIPLUS ref: 000000014007EC58
LeaveCriticalSection.KERNEL32 ref: 000000014007EC66
LeaveCriticalSection.KERNEL32 ref: 000000014007EC94
GdipGetImageEncodersSize.GDIPLUS ref: 000000014007ECA2
GdipGetImageEncoders.GDIPLUS ref: 000000014007ED36
GdipCreateBitmapFromScan0.GDIPLUS ref: 000000014007EE00
GdipSaveImageToStream.GDIPLUS ref: 000000014007EE1E
GdipDisposeImage.GDIPLUS ref: 000000014007EE83
GdipDisposeImage.GDIPLUS ref: 000000014007EE97

Strings

&, xrefs: 000000014007EDFA

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: b85d50a5cabfa6eb603eba9611f05f7ae6643928b7f11ca356d1fb5ea7c17443
Instruction ID: 9446b29d12abf54a495bb638b8da28d63bd82c1a12ea6a5149bd686255382b5b
Opcode Fuzzy Hash: b85d50a5cabfa6eb603eba9611f05f7ae6643928b7f11ca356d1fb5ea7c17443
Instruction Fuzzy Hash: 6A916D32201B809AEB22DF22E8407D8B7A4F75DBD8F558615FF0947BA4DB38C996C340

Function 000000014007FCA0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 226
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400858D0: GetUserGeoID.KERNEL32 ref: 00000001400858F7
Part of subcall function 00000001400858D0: GetGeoInfoA.KERNEL32 ref: 0000000140085911
Part of subcall function 00000001400858D0: GetGeoInfoA.KERNEL32 ref: 0000000140085961

WSAStartup.WS2_32 ref: 000000014007FDBE
socket.WS2_32 ref: 000000014007FDDB
htons.WS2_32 ref: 000000014007FE00
inet_pton.WS2_32 ref: 000000014007FE42
connect.WS2_32 ref: 000000014007FE5C
closesocket.WS2_32 ref: 000000014007FE7B
WSACleanup.WS2_32 ref: 000000014007FE81

Strings

system, xrefs: 000000014007FD2A
geo, xrefs: 000000014007FD6B
5.252.155.28, xrefs: 000000014007FF06

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: 5.252.155.28$geo$system
API String ID: 213021568-2776767760
Opcode ID: 382c9bdd5f6078fca0e4b1f10bcf8beca6fad29002a5ddc0211ae9f1951ac84f
Instruction ID: 9c75b22fce348295d9d2264736fad7ad7c0564d1dc12daef42ebe48eef3612a5
Opcode Fuzzy Hash: 382c9bdd5f6078fca0e4b1f10bcf8beca6fad29002a5ddc0211ae9f1951ac84f
Instruction Fuzzy Hash: 87B16B72B11A4089FB02DB76D4503EC33B2AB9DBA8F415626EB59176F9DE38C54AC340

Function 00000001400A092C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A0D59

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f3fc50aa6c1617f97820c214b6f357f8593fa625a947542fe4ec2dfdbb2d532b
Instruction ID: 1587d5abd9b319571573c48e8f8a5ca4e906ccd50f109f1cac320b02b794b413
Opcode Fuzzy Hash: f3fc50aa6c1617f97820c214b6f357f8593fa625a947542fe4ec2dfdbb2d532b
Instruction Fuzzy Hash: A1C1F03221478982F7639B1794403EE7BA4F7A9BD4F564211FB4A077B2CB79C885CB11

Function 000000014007EA50 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000000014007EA93
EnterCriticalSection.KERNEL32 ref: 000000014007EAA5
EnterCriticalSection.KERNEL32 ref: 000000014007EAB5
GdiplusShutdown.GDIPLUS ref: 000000014007EAC3
LeaveCriticalSection.KERNEL32 ref: 000000014007EAD0
LeaveCriticalSection.KERNEL32 ref: 000000014007EADA

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: d9c89a0b3337f62daede38d05eb99e3a5ef1a2740972e772024fc1afe76f85a6
Instruction ID: 3889bee155bcca462bb7bd3a3e3ed75a854d6cba6fbbfda9a72b78dda44c9e20
Opcode Fuzzy Hash: d9c89a0b3337f62daede38d05eb99e3a5ef1a2740972e772024fc1afe76f85a6
Instruction Fuzzy Hash: 8511E632112B9081EB11AF26E85439D73A4FB4CFAAF684615AB6D076B4DF38C897C350

Function 0000000140084A30 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 0000000140084C0C
recv.WS2_32 ref: 00000001400850EC
closesocket.WS2_32 ref: 00000001400850FE
WSACleanup.WS2_32 ref: 0000000140085104

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 2d2a226c3be6d9aac15178183d5d7ef43195daa5f04da58d8c86c7cb2957ea04
Instruction ID: b7fc1ca92b6d2f99495cefddca60008a77a9a95e78e48f0282b46bd6d156afcd
Opcode Fuzzy Hash: 2d2a226c3be6d9aac15178183d5d7ef43195daa5f04da58d8c86c7cb2957ea04
Instruction Fuzzy Hash: E9126E73618BC081EA229B16E4543DEA761F79D7E0F504612FBAD47AEADF78C584CB00

Function 000000014008A260 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000000014008A280
FreeEnvironmentStringsW.KERNEL32 ref: 000000014008A37B
RtlInitUnicodeString.NTDLL ref: 000000014008A3EE
RtlInitUnicodeString.NTDLL ref: 000000014008A3FB

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: ec2e81338b9569798ae3e5222c4d469a5045ca5b6d5585555045104ee9391ee0
Instruction ID: 87069c6435efe869352e4d7ec8a553a9e77cee2d25ee79a4713f5d8602df03e1
Opcode Fuzzy Hash: ec2e81338b9569798ae3e5222c4d469a5045ca5b6d5585555045104ee9391ee0
Instruction Fuzzy Hash: EF518C72A18B80C2EB129F1AE44039D7760FB99BD4F589215EB9903BA5DF7CD2E1C704

Function 000000014007F820 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000014007F85B
OpenProcessToken.ADVAPI32 ref: 000000014007F86E
GetTokenInformation.ADVAPI32 ref: 000000014007F8AA
CloseHandle.KERNEL32 ref: 000000014007F8CB

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction ID: 4ac3f93d2f4e81bd50ee8aef4ea7470c81fa649bc502074349a2660f854164c1
Opcode Fuzzy Hash: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction Fuzzy Hash: 8911FB32618B8082E7519F16F85039AB7A0FB89B81F549125FB9987B68CF3CC455CB40

Function 000000014007D510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007D561
RegCloseKey.ADVAPI32 ref: 000000014007D573

Strings

Profiles, xrefs: 000000014007D517

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: Profiles
API String ID: 47109696-1917249382
Opcode ID: f1dca321947a1367f0d55f51290a78f41f5e328790fa86022a41bb21031095aa
Instruction ID: 743a173df9f0781bb695bac75db67ed2816ca8ec26105740734809d53537134b
Opcode Fuzzy Hash: f1dca321947a1367f0d55f51290a78f41f5e328790fa86022a41bb21031095aa
Instruction Fuzzy Hash: EB21A132714A8486FE519B27E8507DAB760EB9CBD8F585222FB4D47BA9DE3CC481C700

Function 0000000140086460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 00000001400864C9

Strings

ProductName, xrefs: 00000001400864B4
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00000001400864BB

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: f042c0d23dc3af084ebd72cc80a6e2ef51df9749b54f9fe3e781799715c847bb
Instruction ID: 2c61a57f23ef47ca6cbf34886736e79b47f019dce9ee5dfbd1e28dea51a58d66
Opcode Fuzzy Hash: f042c0d23dc3af084ebd72cc80a6e2ef51df9749b54f9fe3e781799715c847bb
Instruction Fuzzy Hash: E1115B32208B8082EB62CF22F45139AB3A4F79DB88F514215EB9C47B69DFBCC155CB40

Function 0000000140087151 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140087169
RegEnumKeyExA.ADVAPI32 ref: 00000001400871AE
RegCloseKey.ADVAPI32 ref: 00000001400873A4

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 0ed1f0d6d75d13edb5719d14fe28ac9f731d103c8e3e7d84f0abb01f81af53c7
Instruction ID: 4eb1fa3da8fed86ec807e8835bf4fdbc3ecb00f2d9d20f4819ab5aef128a13a5
Opcode Fuzzy Hash: 0ed1f0d6d75d13edb5719d14fe28ac9f731d103c8e3e7d84f0abb01f81af53c7
Instruction Fuzzy Hash: 75717A73A04B8486EB21CB66E48479E6760F7897E8F204215FFAD17AE9DB78C1C1D700

Function 00000001400870E0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140087169
RegEnumKeyExA.ADVAPI32 ref: 00000001400871AE

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction ID: b10b6130942ee25d8504e7b0700fe5892cfaace6609e80b330833a4265116e58
Opcode Fuzzy Hash: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction Fuzzy Hash: 37318D32610B8486FB21CFA6E854B9E77A4F7887D8F204215EF9917B68DF78C596C700

Function 0000000140086E1B Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140086E37
RegQueryValueExA.ADVAPI32 ref: 0000000140086E76
RegCloseKey.ADVAPI32 ref: 0000000140086F14

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: ea5228f5b16d4af609c0401fa054ebc2f4f2b519c2caea4ab20e03b2ff287b43
Instruction ID: b17e2a14e5b4f09d81850b6fce2c63a595a4a8a1644ce2fa634cb054cfa3d14a
Opcode Fuzzy Hash: ea5228f5b16d4af609c0401fa054ebc2f4f2b519c2caea4ab20e03b2ff287b43
Instruction Fuzzy Hash: 9821A073614B8481EA619B26F49039EA760FBD97D4F505222FB8D43AA9DE3CC184CB00

Function 00000001400858D0 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00000001400858F7
GetGeoInfoA.KERNEL32 ref: 0000000140085911
GetGeoInfoA.KERNEL32 ref: 0000000140085961

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction ID: 0d4333e7acfcd10664b751b764566d9c33a0389198715772ff2fcd180fd2e377
Opcode Fuzzy Hash: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction Fuzzy Hash: 36119D3261878182D7119F62E41075EB3A2FB84BC8F455125EF8503B69DF7CD5908B44

Function 0000000140041EB0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014004209C

Strings

, xrefs: 0000000140041F33

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: 6ef822058efd17e8ec0c5c72f21aa5575f71b4af10bf0ce230ce573a459c6a25
Instruction ID: 41a150dcf48049a776dd81e3d5e3e1f932dfb0020c84a720df1c1764346652b8
Opcode Fuzzy Hash: 6ef822058efd17e8ec0c5c72f21aa5575f71b4af10bf0ce230ce573a459c6a25
Instruction Fuzzy Hash: BD516772304B4496EB168F2AD49439C73A0F788BD4F954622EF5D43BA5CF79D4A6C304

Function 0000000140086C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 0000000140086CAC

Strings

Unknown, xrefs: 0000000140086D66

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 210509c86dc14f1746e209744feb747bbd9b4430ef7c40ef9d92e801094aae68
Instruction ID: c76697db59c69994c391a94429b1edd31b5dec6b5dd5d2aab9107e630269dd8f
Opcode Fuzzy Hash: 210509c86dc14f1746e209744feb747bbd9b4430ef7c40ef9d92e801094aae68
Instruction Fuzzy Hash: 7C31AD33628BC086E712CF22E5507DAA760F799B84F546215FBC907A6ADB7CC695CB00

Function 0000000140048560 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400486A0
Concurrency::cancel_current_task.LIBCPMT ref: 000000014004879F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3c87bb3a386bfc34f94a09a15f3e95cbf4530dc945d3c867c9a23a29d9168875
Instruction ID: e93fd745ff60857ba182d59ca98009fa74ac710b246677c65970d569aa4b7534
Opcode Fuzzy Hash: 3c87bb3a386bfc34f94a09a15f3e95cbf4530dc945d3c867c9a23a29d9168875
Instruction Fuzzy Hash: BB51A472305B8485FE76AB13A5043DD6255A70CBE4F594A35FF6D0BBE6DE38C4928304

Function 000000014007EED0 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000000014007EF29
CoTaskMemFree.OLE32 ref: 000000014007EFEA

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: bd335d45d14fbdfb057b26f45b87382ee92af4e036ea24d96a9e7ed2e2078cb9
Instruction ID: f6580426b43ef9dac714e4dfbf3249b6456b6a25bef7ae8d87fb4185b3c8d812
Opcode Fuzzy Hash: bd335d45d14fbdfb057b26f45b87382ee92af4e036ea24d96a9e7ed2e2078cb9
Instruction Fuzzy Hash: EE313272A14B8481E621CF26E44135EB761F79D7F4F645315FBAC03AA5DB7CC1818B40

Function 0000000140094648 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009466F

Part of subcall function 0000000140094604: _invalid_parameter_noinfo.LIBCMT ref: 000000014009461B

_invalid_parameter_noinfo.LIBCMT ref: 0000000140094723

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction ID: 32101a8edefa4219d4514f40ed930cbc4104b78895ab28f0dc7b75847b3e3112
Opcode Fuzzy Hash: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction Fuzzy Hash: 3431BD72215A4882EF62DB56E450BE963A1A79EBD4F960111F74A473F2EB38C101C700

Function 000000014007C7CC Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003E610: CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003E65A
Part of subcall function 000000014003E610: Process32FirstW.KERNEL32 ref: 000000014003E69C

Part of subcall function 000000014003CA10: CredEnumerateA.ADVAPI32 ref: 000000014003CA72

Part of subcall function 0000000140084A30: recv.WS2_32 ref: 0000000140084C0C

ReleaseMutex.KERNEL32 ref: 000000014007C83B
CloseHandle.KERNEL32 ref: 000000014007C844

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: b1629d675231e5ac4d14c4cf23fa913f27254ded78ca0986fad54be0d956edd7
Instruction ID: 2a0b99272c1cb31f626003b2a647813df244ca7e61e09a724ce0a10173a214b2
Opcode Fuzzy Hash: b1629d675231e5ac4d14c4cf23fa913f27254ded78ca0986fad54be0d956edd7
Instruction Fuzzy Hash: F021C13262468441FAA3B7B7A4177EE6340AF8D7D0F145A15FB9A076F39E3CC0819623

Function 000000014007C7FD Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140084A30: recv.WS2_32 ref: 0000000140084C0C

ReleaseMutex.KERNEL32 ref: 000000014007C83B
CloseHandle.KERNEL32 ref: 000000014007C844

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: c7a425a98489807885e7e5fca98dbed17332bb762df1f79a308ffb48ea0b640c
Instruction ID: 03bd4b0dcebcc20fb26472061f81d4572397620754050c7a24bde8720ed44ff3
Opcode Fuzzy Hash: c7a425a98489807885e7e5fca98dbed17332bb762df1f79a308ffb48ea0b640c
Instruction Fuzzy Hash: 63110432A146C042FAA3B777A4167EE1350AF8D7D0F045615FB99076F79F3CC0818612

Function 00000001400A0E9C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00000001400A0EE8
GetLastError.KERNEL32 ref: 00000001400A0EF2

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction ID: 5e2eb42aa467ccbe49ae57b1676c20c6150fa8cb973f64d98be1cd83441f6eb1
Opcode Fuzzy Hash: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction Fuzzy Hash: 61119E72214B8482DA21DB26A404399A3A1E758BF4F584321FF791BBE9CF78C4918B40

Function 00000001400AE888 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400AE8B8

Part of subcall function 00000001400AF8DC: std::bad_alloc::bad_alloc.LIBCMT ref: 00000001400AF8E5

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400AE8BE

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction ID: 69ec061bac81c01873d89cb0c3132a81b38bc9c219e0f41160fcd813fe823014
Opcode Fuzzy Hash: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction Fuzzy Hash: 97E04260A1228959FD6A26A715163F911840B6D7F0F2C1B24BF794B2E3AE3889D58A50

Function 000000014009D3C8 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014009D3DE
GetLastError.KERNEL32 ref: 000000014009D3E8

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction ID: 4fb8939859dd21c30d764fca774206093a9adc15e80cf677a28c9fe662fd02f8
Opcode Fuzzy Hash: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction Fuzzy Hash: 34E01275B0260492FF1A67F398453E922916F9C7C2F4484246B05932B2ED3485958210

Function 000000014008F150 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014008F3A0

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c2e36c7b61d2f19615e73cfa5b5cad62d6eede3b93b99f1956f3b137ec5dff87
Instruction ID: 13db419113c6498c631838fdc6ddb0dd70937527e49e167ce5f06a1b8afcd3c4
Opcode Fuzzy Hash: c2e36c7b61d2f19615e73cfa5b5cad62d6eede3b93b99f1956f3b137ec5dff87
Instruction Fuzzy Hash: F8618977300A8485EA169E26D1543BD27A1F318FD8F548611EF6E0B7E9DB38CA96E300

Function 000000014002E2A0 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000000014002E3D3

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 37c50b5d60c5ec6126da7556f313f4cc6777d8a0e7d3b3c6bf9ff05ee4472a04
Instruction ID: c67aaed08eec3102ff5c9633327f6eea2b26d53348b9d0748cf96172b5992161
Opcode Fuzzy Hash: 37c50b5d60c5ec6126da7556f313f4cc6777d8a0e7d3b3c6bf9ff05ee4472a04
Instruction Fuzzy Hash: 02619272B50A8086FB12DF6AD4903ED23A1E75C7E8F404629FF2957BE5EE34C9958340

Function 0000000140048E80 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140049015

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 094d64f5535b959115b91f7386d9c8476bada5dc9af169b0f132f53a84b838f4
Instruction ID: 0e68d78e60faff21098140196ff033a2ffaaea4e00a4f5682bb80e4d4b41ae0d
Opcode Fuzzy Hash: 094d64f5535b959115b91f7386d9c8476bada5dc9af169b0f132f53a84b838f4
Instruction Fuzzy Hash: 9841AC72304B8485EA229F12A1043DEA262B74DBD4F580A35FFAD0B7AADE39C4858304

Function 0000000140049030 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400491AC

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6010a0514eb83637f57fba0b89439feead3e6317b939d64df0f4a94bc9744133
Instruction ID: 2922c6a58d100b8567e20699b5a529503332b7a2c0142c3a3a15086411293361
Opcode Fuzzy Hash: 6010a0514eb83637f57fba0b89439feead3e6317b939d64df0f4a94bc9744133
Instruction Fuzzy Hash: AF41C27230578585EE26EB17A5083D9A251A34CBD4F544635BF6D0BBEADE38C582C308

Function 000000014009D8C8 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009D8F0

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a6489b2be76faf22097b4e2486930154795670c0681d29dc16d0eeee0672d6c2
Instruction ID: 970956ea101780b6a44bc08ac7971c10be475c9fcb23d85d0426192894f7542c
Opcode Fuzzy Hash: a6489b2be76faf22097b4e2486930154795670c0681d29dc16d0eeee0672d6c2
Instruction Fuzzy Hash: 4D41AE3224474487EB76DB1EE5413EA73A0E76ABD4F140206EB9A876A1DB39D402CB91

Function 0000000140086290 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 0000000140086320

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 097c3a005791ee28b012612e09ea22a083e44b1245b7391d59546d3251274116
Instruction ID: d97b727fb9ae17560e619a07645ce3e94e9be86b671885bbfcad117fd56d4268
Opcode Fuzzy Hash: 097c3a005791ee28b012612e09ea22a083e44b1245b7391d59546d3251274116
Instruction Fuzzy Hash: 53517C33A14B808AE712CF79D4403DE77A0F799788F505611EB9C53AA9DF78C684CB40

Function 00000001400429B0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140042AB8

Part of subcall function 000000014002B820: __std_exception_copy.LIBVCRUNTIME ref: 000000014002B868

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: 243dfd2353d43fd601b15663e7695c94552d3828716626cc3f7a822d02133993
Instruction ID: e0c424e73107c798dbe20568d75892bd8762e32d7f1318d59332ad997fcd64de
Opcode Fuzzy Hash: 243dfd2353d43fd601b15663e7695c94552d3828716626cc3f7a822d02133993
Instruction Fuzzy Hash: 3D21D732701B4042EE2AEB16E5403E96290E758BE4F654731AF7C07BE5EE78C4E2C345

Function 00000001400A080C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A0892

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction ID: eadfb93546a9950693f2aa7559f4ccf8f1f0c25cf7c605596cfe9b5c909f97bf
Opcode Fuzzy Hash: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction Fuzzy Hash: D1316B3261065886F753AB6798413ED2B90B7ACFE5F920305BB99073F2DB7CC4818B55

Function 00000001400BE200 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BE15D

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction ID: 824ad48f941a611458d9d107f1ba3892ee12638fd4db84a9ea3f894c29f76267
Opcode Fuzzy Hash: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction Fuzzy Hash: 03116632215A8081EB629F97D4003EEA3B4B79DFC4F554821FB895B7B6DB7CC9418740

Function 00000001400BFEF8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BFF1B

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction ID: 608a15f6eaf0ef5a496612af3e2485e25ca9acab7b6d14a4bfcd21ba336913f7
Opcode Fuzzy Hash: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction Fuzzy Hash: 0A21A532214A8187EB629F6AD4407B977B0FBD9BD4F544224FB5D476EADB38C400CB00

Function 00000001400A54B4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A54DF

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 42dcc955d4fd3197300f6b05653cf2d2f457e7ff6d65b15765544b4f1739082b
Instruction ID: fd783d6a1e17b455ac1502cd21968fac34f3ce32d3c1f1488e06dd847f71ef0d
Opcode Fuzzy Hash: 42dcc955d4fd3197300f6b05653cf2d2f457e7ff6d65b15765544b4f1739082b
Instruction Fuzzy Hash: AE11A072525A40C2F312AB26E4507DDB3A2F79CBC5F450625FB96477B2CB38C8908F00

Function 0000000140080E00 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0000000140080E48

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction ID: 324eafc6b56467617a0271dfae881c0dd6149dee2f0a2b88ad16501ffcdce3d5
Opcode Fuzzy Hash: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction Fuzzy Hash: 1D01AD32714A8486EB518F1BF94075AA7A0F78CFD4F485230EF5D43B68DB38C9818700

Function 0000000140037633 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000000140037676

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction ID: 198944faf61d7ec3d1a427db0a2f838cdd5696eaf073c2c50a60053681fd637d
Opcode Fuzzy Hash: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction Fuzzy Hash: 5701FB36218AC081EA72DB57F49579BA364F78CBD4F444026EF8D43B69DE39C886CB00

Function 0000000140097374 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140097393

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction ID: 10117cc0a24eac238d1afa44782b5dd388175b2725dd5008568661bd113a274c
Opcode Fuzzy Hash: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction Fuzzy Hash: 2BE0D832215B4481EF666BBB91417EC71506B5CBF4F548321BF38033E6DB3484905711

Function 00000001400AE9D0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000001400AE9E4

Part of subcall function 00000001400B0E6C: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00000001400B0E74
Part of subcall function 00000001400B0E6C: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00000001400B0E79

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 552cadb944fbfa7d273d14e6333c601f02b0659bfbb50ac822d976667c4bc77c
Instruction ID: bac56e61feae0d415a5fce5064964b513ab6c5bfd6be6e63147963a24a6523ee
Opcode Fuzzy Hash: 552cadb944fbfa7d273d14e6333c601f02b0659bfbb50ac822d976667c4bc77c
Instruction Fuzzy Hash: 34E012705057C040FEA77AB315473FE13502B3D3C4F500649BB95431F3963648C61A22

Function 00000001400BB4C0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000001400BB4C4

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4104833be8186ecfced91f05a1dc286f8d4e1ac7fad94ea37a2bf5d234dce428
Instruction ID: 55b9ab2d4f23c47d731a4d9c5ea1b4a63ef8b7b9423aaadfc0eff3470f8c37f6
Opcode Fuzzy Hash: 4104833be8186ecfced91f05a1dc286f8d4e1ac7fad94ea37a2bf5d234dce428
Instruction Fuzzy Hash: 65C09B39F15941D2E6553F775C823C611E06B5C792F440030DB0481170DE7CC5D78721

Function 00000001400BD0B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000001400BD0BD

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction ID: fd872328199e54ae9bef307987e8fd57df0d4d182fee6eb87dab4ff849822d36
Opcode Fuzzy Hash: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction Fuzzy Hash: 0BB09236A148C0C3C612FB04E8422497331FB98B0FFD00000E78E42624CE2CCA2A8E00

Function 000000014009DA30 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000014009DA85

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 9ae9f8af891c0b94514e7ea55ed6623f4eb6cc8682cd7ae55c8d48968416ecb5
Instruction ID: 07a5c3aa508a4e6947d003ddc055f1739cb4df8b9625e4c5651f4d540c93f396
Opcode Fuzzy Hash: 9ae9f8af891c0b94514e7ea55ed6623f4eb6cc8682cd7ae55c8d48968416ecb5
Instruction Fuzzy Hash: F6F0547438560585FE5B57A754513E923806B9DBC0F4C95326F0A873F2EE3CC9A08211

Function 000000014009E8BC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000014009E8FA

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction ID: 9f1c80e48db00bc7a01722dd14718bcfc10f7deb6eb96187868d3df548336582
Opcode Fuzzy Hash: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction Fuzzy Hash: 97F01C3130128945FE9666B398457EB12806B9DBF5F4947347F2A872E2DA38C8808620

Non-executed Functions

Function 0000000140091220 Relevance: 49.1, APIs: 25, Strings: 2, Instructions: 1888COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140091557
_invalid_parameter_noinfo.LIBCMT ref: 00000001400917BA
_invalid_parameter_noinfo.LIBCMT ref: 0000000140091A7D
_invalid_parameter_noinfo.LIBCMT ref: 0000000140091D1D
memcpy_s.LIBCPMT ref: 0000000140091F2A
memcpy_s.LIBCPMT ref: 0000000140091FC6
memcpy_s.LIBCPMT ref: 000000014009247E
memcpy_s.LIBCPMT ref: 00000001400924B9
memcpy_s.LIBCPMT ref: 00000001400925E5
memcpy_s.LIBCPMT ref: 000000014009270C
memcpy_s.LIBCPMT ref: 00000001400927B7
memcpy_s.LIBCPMT ref: 00000001400927FF
memcpy_s.LIBCPMT ref: 0000000140092829
memcpy_s.LIBCPMT ref: 00000001400928DA
memcpy_s.LIBCPMT ref: 0000000140092ADA
memcpy_s.LIBCPMT ref: 0000000140092B1F
memcpy_s.LIBCPMT ref: 0000000140092BD6
memcpy_s.LIBCPMT ref: 0000000140092D03
memcpy_s.LIBCPMT ref: 00000001400923CE

Part of subcall function 0000000140093664: _invalid_parameter_noinfo.LIBCMT ref: 0000000140093696

memcpy_s.LIBCPMT ref: 0000000140092449
memcpy_s.LIBCPMT ref: 0000000140092EBD

Strings

, xrefs: 0000000140092C83
, xrefs: 0000000140092DB0

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: 49a4e64996860ac975e7d62cf44a3f3077f64a100a8fbd3398d3c45755aa41bf
Instruction ID: a657bb27cda1b9a1f0199fcee91b942ba265a0f8779d78ad39ddf276b9d33eb5
Opcode Fuzzy Hash: 49a4e64996860ac975e7d62cf44a3f3077f64a100a8fbd3398d3c45755aa41bf
Instruction Fuzzy Hash: 1503AE727146808BE7768F2AD950BEE77A1F3987C8F405119FB06A7BA8D735DA00CB40

Function 000000014008A430 Relevance: 34.3, APIs: 18, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 000000014008A473
NtAllocateVirtualMemory.NTDLL ref: 000000014008A4AB
lstrcpyW.KERNEL32 ref: 000000014008A50D
lstrcatW.KERNEL32 ref: 000000014008A5C2
NtAllocateVirtualMemory.NTDLL ref: 000000014008A649
lstrcpyW.KERNEL32 ref: 000000014008A6FC
RtlInitUnicodeString.NTDLL ref: 000000014008A711
RtlInitUnicodeString.NTDLL ref: 000000014008A726
LdrEnumerateLoadedModules.NTDLL ref: 000000014008A739
RtlReleasePebLock.NTDLL ref: 000000014008A73F

Part of subcall function 000000014007EED0: SHGetKnownFolderPath.SHELL32 ref: 000000014007EF29
Part of subcall function 000000014007EED0: CoTaskMemFree.OLE32 ref: 000000014007EFEA

CoInitializeEx.OLE32 ref: 000000014008A7EA
lstrcpyW.KERNEL32 ref: 000000014008A9C9
lstrcatW.KERNEL32 ref: 000000014008ABCE
CoGetObject.OLE32 ref: 000000014008ABEC
lstrcpyW.KERNEL32 ref: 000000014008B269
lstrcatW.KERNEL32 ref: 000000014008B48C
CoGetObject.OLE32 ref: 000000014008B4AA
CoUninitialize.OLE32 ref: 000000014008B972

Strings

0, xrefs: 000000014008B0AA

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: 0
API String ID: 1424456515-4108050209
Opcode ID: 7fc2e5d3b4b2cd19d1c4915c4930dd802a13061939fc02b21b982c9dd6b28cb1
Instruction ID: d4c865407b3b5a88cd489df068cd4ff9b7f7d0fd986f16175bd207bd1cd188c2
Opcode Fuzzy Hash: 7fc2e5d3b4b2cd19d1c4915c4930dd802a13061939fc02b21b982c9dd6b28cb1
Instruction Fuzzy Hash: 11C2B736626F988AD7908F69E88169DB3B5F788B88F106215FFCD57B18EB38C154C740

Function 00000001400293F0 Relevance: 31.0, Strings: 24, Instructions: 1029COMMON

Download Yara Rule

Strings

IMAP User, xrefs: 000000014002A0EE
POP3 Server, xrefs: 0000000140029991
NNTP Password, xrefs: 0000000140029E0E
SMTP User Name, xrefs: 000000014002958E
IMAP Password, xrefs: 000000014002A17E
NNTP User, xrefs: 0000000140029D7E
SMTP Server, xrefs: 000000014002961E
IMAP User Name, xrefs: 0000000140029FEE
Email, xrefs: 000000014002A272
POP3 User, xrefs: 0000000140029A10
POP3 User Name, xrefs: 0000000140029912
SMTP Password2, xrefs: 00000001400297AE
IMAP Password2, xrefs: 000000014002A1F3
HTTP User, xrefs: 000000014002A2F1
NNTP Server, xrefs: 0000000140029CFE
SMTP Password, xrefs: 000000014002972E
NNTP Password2, xrefs: 0000000140029E83
POP3 Password2, xrefs: 0000000140029B13
POP3 Password, xrefs: 0000000140029A9E
HTTP Server URL, xrefs: 000000014002A37E
IMAP Server, xrefs: 000000014002A06E
HTTPMail Server, xrefs: 000000014002A40E
NNTP User Name, xrefs: 0000000140029C7E
SMTP User, xrefs: 000000014002969E

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: Email$HTTP Server URL$HTTP User$HTTPMail Server$IMAP Password$IMAP Password2$IMAP Server$IMAP User$IMAP User Name$NNTP Password$NNTP Password2$NNTP Server$NNTP User$NNTP User Name$POP3 Password$POP3 Password2$POP3 Server$POP3 User$POP3 User Name$SMTP Password$SMTP Password2$SMTP Server$SMTP User$SMTP User Name
API String ID: 0-560833949
Opcode ID: 4eb451f0c1ad08b7a6288b20d54045f4b853d1a17ef6ac72d4ac4548a2847e77
Instruction ID: 3f16e7061a97687f7e741945e4b39fa092233cd998affea91303aa2af96ff760
Opcode Fuzzy Hash: 4eb451f0c1ad08b7a6288b20d54045f4b853d1a17ef6ac72d4ac4548a2847e77
Instruction Fuzzy Hash: BBC2C972A21FA889E781CF79EC816DC77B4F759748F116219FF8962B29EB309191C340

Function 0000000140006180 Relevance: 30.2, Strings: 24, Instructions: 238COMMON

Download Yara Rule

Strings

d3d9caps.dat, xrefs: 00000001400063E6
iconcache.db, xrefs: 00000001400062DE
mib.bin, xrefs: 0000000140006444
boot.ini, xrefs: 00000001400061D1
indexervolumeguid, xrefs: 0000000140006473
ntldr, xrefs: 0000000140006292
gdipfontcachev1.dat, xrefs: 00000001400063B7
boot.sdi, xrefs: 00000001400064D1
bootmgfw.efi, xrefs: 00000001400061F9
bootmgr, xrefs: 000000014000655E
BOOTNXT, xrefs: 000000014000658D
desktop.ini, xrefs: 000000014000626C
bootstat.dat, xrefs: 0000000140006415
ntuser.dat, xrefs: 0000000140006304
winre.wim, xrefs: 0000000140006500
winsipolicy.p7b, xrefs: 00000001400062B8
bootsect.bak, xrefs: 0000000140006246
ntuser.dat.log, xrefs: 000000014000632D
thumbs.db, xrefs: 0000000140006388
ntuser.ini, xrefs: 0000000140006359
wpsettings.dat, xrefs: 00000001400064A2
autorun.inf, xrefs: 00000001400061A8
bootfont.bin, xrefs: 0000000140006220
reagent.xml, xrefs: 000000014000652F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 118556049-850610325
Opcode ID: 22dcfd16a23274500c0631d97ecb7b22965bfb45e38d580db89ddce6ecc7947a
Instruction ID: 9af6f5fb2451f039e3f2e29efcbad565e8741d3969121260d1ea1181c48c6de1
Opcode Fuzzy Hash: 22dcfd16a23274500c0631d97ecb7b22965bfb45e38d580db89ddce6ecc7947a
Instruction Fuzzy Hash: 64C14562D60BC985E722DF36D8823E65361F7EE784F50A7067A8866866EF74D3C4C340

Function 0000000140057CEB Relevance: 29.3, APIs: 2, Strings: 14, Instructions: 1339COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140059311
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400593E6

Part of subcall function 000000014002BA80: __std_exception_copy.LIBVCRUNTIME ref: 000000014002BAC3

Part of subcall function 00000001400B0E88: RtlPcToFileHeader.KERNEL32 ref: 00000001400B0ED8
Part of subcall function 00000001400B0E88: RaiseException.KERNEL32 ref: 00000001400B0F19

Strings

*, xrefs: 0000000140057EFE
#base, xrefs: 0000000140058696
/, xrefs: 0000000140057ED3
#include, xrefs: 000000014005866A
object is not closed with '}', xrefs: 000000014005920F
", xrefs: 00000001400580D3
unexpected key without object, xrefs: 00000001400592EA
quote was opened but not closed., xrefs: 0000000140059236, 00000001400592AB
key opened, but never closed, xrefs: 00000001400593BF
key declared, but no value, xrefs: 000000014005925D, 0000000140059284, 0000000140059398
No closed word, xrefs: 0000000140059317, 000000014005933E
word wasnt properly ended, xrefs: 0000000140059365, 00000001400593EC
unexpected '}', xrefs: 0000000140059413
Unexpected eof, xrefs: 00000001400591E2

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-3561477107
Opcode ID: 2a5f9c0f16aeb70e18e44eca5b6abd1025d4ec856a54344e6a266d96e719af72
Instruction ID: 2bb403da8985072820bb3dd4ea3b944cd9c88b997413b6ed38cae2d55cfdd3ee
Opcode Fuzzy Hash: 2a5f9c0f16aeb70e18e44eca5b6abd1025d4ec856a54344e6a266d96e719af72
Instruction Fuzzy Hash: 98D27A72201BC489EB72DF26D8943ED23A1E749BD8F448512EF5D1BAA9DF79C685C300

Function 000000014007B420 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 000000014007B9A7

Strings

runas, xrefs: 000000014007B926
.cmd, xrefs: 000000014007B4E3
.exe, xrefs: 000000014007B56D
ios_base::badbit set, xrefs: 000000014007BBBA
.ps1, xrefs: 000000014007B4B4
ios_base::failbit set, xrefs: 000000014007BBC5
.vbs, xrefs: 000000014007B512
.exe, xrefs: 000000014007B485
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 000000014007B5B4
open, xrefs: 000000014007B91D
ios_base::eofbit set, xrefs: 000000014007BBCC

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 587946157-4093014531
Opcode ID: 15d0e6cb3b0890737360701340db1a4708e7f243a0c76d7800706a3be4d771d2
Instruction ID: e64ee07ffd1cac2cfd0fc144e315d25c75a5b9d17199e52aade8a2fe2e984c9d
Opcode Fuzzy Hash: 15d0e6cb3b0890737360701340db1a4708e7f243a0c76d7800706a3be4d771d2
Instruction Fuzzy Hash: 7A228B72A10B8489EB11DF2AE8803DD67A1F7887D8F509216FF9D47AA9DF78C584C740

Function 00000001400AA3C8 Relevance: 20.4, APIs: 8, Strings: 3, Instructions: 1156COMMON

Download Yara Rule

Strings

s, xrefs: 00000001400AB4D2
W$, xrefs: 00000001400AA530
s, xrefs: 00000001400AB3F1

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: s$s$W$
API String ID: 3215553584-4165748295
Opcode ID: 6e2b4c267e673e21a6edb627fc9ac4d69be015c1ed891353ae6bc90475eaa618
Instruction ID: 9c23e8f5d791de3a81c7dc2569aff22aa5110c8414dce3997c0390da00aabe92
Opcode Fuzzy Hash: 6e2b4c267e673e21a6edb627fc9ac4d69be015c1ed891353ae6bc90475eaa618
Instruction Fuzzy Hash: 63A2D172B142908BE7768F66D440BED77A1F3697C8F405215EB0A5BAE9D738DA80CF40

Function 000000014008A780 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014008A430: RtlAcquirePebLock.NTDLL ref: 000000014008A473
Part of subcall function 000000014008A430: NtAllocateVirtualMemory.NTDLL ref: 000000014008A4AB
Part of subcall function 000000014008A430: lstrcpyW.KERNEL32 ref: 000000014008A50D
Part of subcall function 000000014008A430: lstrcatW.KERNEL32 ref: 000000014008A5C2

CoInitializeEx.OLE32 ref: 000000014008A7EA
lstrcpyW.KERNEL32 ref: 000000014008A9C9
lstrcatW.KERNEL32 ref: 000000014008ABCE
CoGetObject.OLE32 ref: 000000014008ABEC
lstrcpyW.KERNEL32 ref: 000000014008B269
lstrcatW.KERNEL32 ref: 000000014008B48C
CoGetObject.OLE32 ref: 000000014008B4AA
CoUninitialize.OLE32 ref: 000000014008B972

Strings

0, xrefs: 000000014008B0AA

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID: 0
API String ID: 3636535045-4108050209
Opcode ID: f81eb009de86b6c444231f19861b7892c29bf8f20dd4133f3e5d2f442cec1830
Instruction ID: b9de4dd26ae70b31327b14156477d7184851864b7bbd00916b50dd9a12508fe7
Opcode Fuzzy Hash: f81eb009de86b6c444231f19861b7892c29bf8f20dd4133f3e5d2f442cec1830
Instruction Fuzzy Hash: 2FB28936626F988AD7808F69F88165EB3B5F788B88F106215FFCD57B18EB38C1548740

Function 0000000140078440 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00000001400784D8
BCryptSetProperty.BCRYPT ref: 0000000140078502
BCryptGenerateSymmetricKey.BCRYPT ref: 000000014007853B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140078661

Strings

ChainingMode, xrefs: 00000001400784F7
ChainingModeGCM, xrefs: 00000001400784F0
AES, xrefs: 00000001400784CD

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmConcurrency::cancel_current_taskGenerateOpenPropertyProviderSymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 2222192889-1213888626
Opcode ID: 274f445ca7abd8b3b94ff4ba86ac89ea7235631b092cdef40730f784da6a4864
Instruction ID: f28bd28e0eb8214e6e1a560f29bcde7bb753b3cc16860b90a9d8975a1a4d3131
Opcode Fuzzy Hash: 274f445ca7abd8b3b94ff4ba86ac89ea7235631b092cdef40730f784da6a4864
Instruction Fuzzy Hash: 5361C172710B8486FB269F66E8407D96360E78DBE4F544725BF6C0BBE6DB38C5918700

Function 00000001400A8C04 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140099EEC: GetLastError.KERNEL32 ref: 0000000140099EFB
Part of subcall function 0000000140099EEC: FlsGetValue.KERNEL32 ref: 0000000140099F10
Part of subcall function 0000000140099EEC: SetLastError.KERNEL32 ref: 0000000140099F9B

TranslateName.LIBCMT ref: 00000001400A8C6E
TranslateName.LIBCMT ref: 00000001400A8CA9
GetACP.KERNEL32 ref: 00000001400A8CF0
IsValidCodePage.KERNEL32 ref: 00000001400A8D28
GetLocaleInfoW.KERNEL32 ref: 00000001400A8EE5

Strings

utf8, xrefs: 00000001400A8E0C

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 41343eb44851c0e8f8055f3926715ba520ae6846787d1c3cb08d70e80e5c003e
Instruction ID: 8349dc3027b5bf838b073474c1dbd6b6b718dd048b030d4317e83b54c1e9017f
Opcode Fuzzy Hash: 41343eb44851c0e8f8055f3926715ba520ae6846787d1c3cb08d70e80e5c003e
Instruction Fuzzy Hash: 3B916A3220178186FB76EF63D4513E963A5F7ACBC0F448221AF59477A6EB39C991CB10

Function 00000001400A964C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140099EEC: GetLastError.KERNEL32 ref: 0000000140099EFB
Part of subcall function 0000000140099EEC: FlsGetValue.KERNEL32 ref: 0000000140099F10
Part of subcall function 0000000140099EEC: SetLastError.KERNEL32 ref: 0000000140099F9B

Part of subcall function 0000000140099EEC: FlsSetValue.KERNEL32 ref: 0000000140099F31

GetUserDefaultLCID.KERNEL32 ref: 00000001400A97BC

Part of subcall function 0000000140099EEC: FlsSetValue.KERNEL32 ref: 0000000140099F5E
Part of subcall function 0000000140099EEC: FlsSetValue.KERNEL32 ref: 0000000140099F6F
Part of subcall function 0000000140099EEC: FlsSetValue.KERNEL32 ref: 0000000140099F80

EnumSystemLocalesW.KERNEL32 ref: 00000001400A97A3
ProcessCodePage.LIBCMT ref: 00000001400A97E6
IsValidCodePage.KERNEL32 ref: 00000001400A97F8
IsValidLocale.KERNEL32 ref: 00000001400A980E
GetLocaleInfoW.KERNEL32 ref: 00000001400A986A
GetLocaleInfoW.KERNEL32 ref: 00000001400A9886

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 35311c5f5cbb088db9cafc063da405a92d1dac0a49a1e36eea51d3b328654a2c
Instruction ID: 7bd31282f7cea42ea7c1da278a9239bc261f869a6e572b599c6795b1d4aeb46e
Opcode Fuzzy Hash: 35311c5f5cbb088db9cafc063da405a92d1dac0a49a1e36eea51d3b328654a2c
Instruction Fuzzy Hash: 98716D327106508AFF52DFA2D8507ED33B4BB5CBC4F444626AF1957AA5EB38C885CB60

Function 00000001400AF2B8 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000001400AF2D4
RtlCaptureContext.KERNEL32 ref: 00000001400AF301
RtlLookupFunctionEntry.KERNEL32 ref: 00000001400AF31B
RtlVirtualUnwind.KERNEL32 ref: 00000001400AF35C
IsDebuggerPresent.KERNEL32 ref: 00000001400AF3B0
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001400AF3CD
UnhandledExceptionFilter.KERNEL32 ref: 00000001400AF3D8

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 6458172863af31e20951f5f8dc1d486a5fb90de472876968ccfd77d10a4e7fe6
Instruction ID: 3eaaca77e3044fe114672d1de19e5a1b13903de1a1951330ac21f52225543186
Opcode Fuzzy Hash: 6458172863af31e20951f5f8dc1d486a5fb90de472876968ccfd77d10a4e7fe6
Instruction Fuzzy Hash: 81314376205B8086EB61DFA1E8803ED7374F799785F44412AEB4E47BA9DF38C649CB10

Function 0000000140033A30 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 699COMMON

Download Yara Rule

Strings

Wallets, xrefs: 00000001400347D2
ios_base::badbit set, xrefs: 0000000140034A48, 0000000140034A8C
content, xrefs: 0000000140034749
filename, xrefs: 0000000140034624

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmProvider$CloseGenerateOpenPropertySymmetric
String ID: Wallets$content$filename$ios_base::badbit set
API String ID: 4024084497-1237116864
Opcode ID: 3be04f076b9296325cc5aefef03914f2986dc46e142b5b922412b7815989888e
Instruction ID: 9e4da370fed2166d00dd657d5401aba4a3c0c1400cfb0c7979fe3975f04658ca
Opcode Fuzzy Hash: 3be04f076b9296325cc5aefef03914f2986dc46e142b5b922412b7815989888e
Instruction Fuzzy Hash: A582E132119BC595E6B29B15F8803DAB3A4F7C9780F505226EBCD43BA9EF78C594CB40

Function 00000001400702C0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140070474
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140070482
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140070705
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140070713

Strings

value, xrefs: 000000014007039A, 0000000140070633

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: c79dc9ab7cfd5d78607e81de89503bfdf75eacdc8a43a0fa1debc858cf2cdfc1
Instruction ID: 2f0a74b06a620db2c6074f5de4abd2660f00365e9c853ea50482cebdeb1d6260
Opcode Fuzzy Hash: c79dc9ab7cfd5d78607e81de89503bfdf75eacdc8a43a0fa1debc858cf2cdfc1
Instruction Fuzzy Hash: 4C027A72A14BC085EB52CBB6D4803EE6761E7897E4F105312FB9D13AEADE78C185C740

Function 00000001400070E0 Relevance: 8.7, Strings: 2, Instructions: 6192COMMON

Download Yara Rule

Strings

0| , xrefs: 000000014000A83D
\| , xrefs: 000000014000C52D

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: 0| $\|
API String ID: 0-2050777373
Opcode ID: ad8b8a06ee8e7dbd9eb0ed87f328e0d9eefed4ef2557dac10ab3baeca558fbf1
Instruction ID: 284daf97a714ec00d6c1b3d7287322477c9a22568bbb2eccfed623d737d0f244
Opcode Fuzzy Hash: ad8b8a06ee8e7dbd9eb0ed87f328e0d9eefed4ef2557dac10ab3baeca558fbf1
Instruction Fuzzy Hash: D904D032915FC489D7759F39EC853D977A8F79978CF106219EB8C1AB29EB3483A08305

Function 00000001400398CD Relevance: 7.4, Strings: 5, Instructions: 1142COMMON

Download Yara Rule

Strings

users, xrefs: 000000014003A262
status, xrefs: 000000014003AD67
content, xrefs: 0000000140039B9F, 0000000140039F27, 000000014003A844
filename, xrefs: 0000000140039B46, 0000000140039ECE, 000000014003A762
config, xrefs: 0000000140039CDD

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: config$content$filename$status$users
API String ID: 0-2677590375
Opcode ID: 949dde43ccd6764ae27f181f54f9d3c0a95e321b57695debdbefde8e21984097
Instruction ID: 8466b02c89f5d3f5ca8fd9f45cea41b65bbce8c294ac8a6e5fda3690ef307a81
Opcode Fuzzy Hash: 949dde43ccd6764ae27f181f54f9d3c0a95e321b57695debdbefde8e21984097
Instruction Fuzzy Hash: 3CC23B72611BC589DB329F36D8903DD6361F789798F405216EB9D4BBAAEF38C684C340

Function 00000001400BD804 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400BD865
IsDebuggerPresent.KERNEL32 ref: 00000001400BD87D
OutputDebugStringW.KERNEL32 ref: 00000001400BD88E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000001400BD887

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 9ee4415ca50324c33a3d5a57874f9cc99ad178eb9645fb895110d63af1d9e2c1
Instruction ID: 156b50a59491b522b95133cc87a66bc9d4c90f318aca79d238700763b05f87d6
Opcode Fuzzy Hash: 9ee4415ca50324c33a3d5a57874f9cc99ad178eb9645fb895110d63af1d9e2c1
Instruction Fuzzy Hash: 5F115A32210B40A7F75A9B27E6943E933A1FB4C786F449125EB4983A70EF78D0B8C750

Function 00000001400AA44F Relevance: 6.4, Strings: 5, Instructions: 198COMMON

Download Yara Rule

Strings

1#SNAN, xrefs: 00000001400AA4C2
1#QNAN, xrefs: 00000001400AA4CB
1#INF, xrefs: 00000001400AA4DB
W$, xrefs: 00000001400AA530
1#IND, xrefs: 00000001400AA49F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$W$
API String ID: 3215553584-4287779413
Opcode ID: e914ef83dae64b72f50003c00f300a4745ddd1fbbdf1c541f482026cce5ebf66
Instruction ID: 4d4210e12aeee8e9f5e94711e4e8cd733dc4b39c4ec79285a3ee6235da0bb1d1
Opcode Fuzzy Hash: e914ef83dae64b72f50003c00f300a4745ddd1fbbdf1c541f482026cce5ebf66
Instruction Fuzzy Hash: 93711172B242414BE7228F3AD4447EDB3A1A7AD3D4F044725BB199BAE5DB3CD9818F00

Function 0000000140099038 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 000000014009908F
GetSystemInfo.KERNEL32 ref: 00000001400990A8
VirtualAlloc.KERNEL32 ref: 0000000140099116
VirtualProtect.KERNEL32 ref: 0000000140099131

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 6131e7ac5c004b666fb02de1823fa69e50ababb2f1d6eff18536aed83fe204ab
Instruction ID: 2006030ddcdfcd66f6cc748a20a45c9b0152b93ab0e2963e6fa905ca9af8d5f1
Opcode Fuzzy Hash: 6131e7ac5c004b666fb02de1823fa69e50ababb2f1d6eff18536aed83fe204ab
Instruction Fuzzy Hash: 84311632310A859EEB21DF36D8547D923A5F74CBC8F944125AA494BB68DF38D646C740

Function 00000001400A36A8 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A3ADE
_get_daylight.LIBCMT ref: 00000001400A3B79
_get_daylight.LIBCMT ref: 00000001400A3B92

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 91154ea289c3556cf103cf6e37fc2ba0624cd5322ab1aec8ddf48183395d8b30
Instruction ID: 4fad86f6d9d594f3f7bfe3a69b32873ea402f7dc870d61de0be478661a220898
Opcode Fuzzy Hash: 91154ea289c3556cf103cf6e37fc2ba0624cd5322ab1aec8ddf48183395d8b30
Instruction Fuzzy Hash: 4D92E03660479087EB668F26D5503EE37A5F7A97C8F548215FB8907FA9DB38C990CB00

Function 00000001400BB170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000001400BB196
FormatMessageA.KERNEL32 ref: 00000001400BB1C9

Strings

!x-sys-default-locale, xrefs: 00000001400BB189

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: e9313e5009c165bfc27bb14f9f63cf4f23352891cc12b2974ad7925588fd8796
Instruction ID: 3c92f31fd4891f13edf4352e9aacb77233aaeb4dc1a43732f9876fdfe1b241ce
Opcode Fuzzy Hash: e9313e5009c165bfc27bb14f9f63cf4f23352891cc12b2974ad7925588fd8796
Instruction Fuzzy Hash: 61018C72714B8083EB229F57B8647AA67A2F7887C5F848025EB5547AA8CB7CC606C700

Function 0000000140093150 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00000001400931B6
memcpy_s.LIBCPMT ref: 00000001400931E1

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: eb07a1fe8bff8429000d82fc6708e1dd14e73367c47fa60bb37c8b50ad77a0f3
Instruction ID: c4b91031d082ce85d0071a6aadb3f9c9206e35f87d0b51ac34ed733270a5ee20
Opcode Fuzzy Hash: eb07a1fe8bff8429000d82fc6708e1dd14e73367c47fa60bb37c8b50ad77a0f3
Instruction Fuzzy Hash: 70C1167231468487EB26CF1AE0447AEB7A1F39CBC4F459125EB5A43BA4DB39E901CF40

Function 00000001400A90C8 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140099EEC: GetLastError.KERNEL32 ref: 0000000140099EFB
Part of subcall function 0000000140099EEC: FlsGetValue.KERNEL32 ref: 0000000140099F10
Part of subcall function 0000000140099EEC: SetLastError.KERNEL32 ref: 0000000140099F9B

Part of subcall function 0000000140099EEC: FlsSetValue.KERNEL32 ref: 0000000140099F31

GetLocaleInfoW.KERNEL32 ref: 00000001400A9134

Part of subcall function 000000014008FBA0: _invalid_parameter_noinfo.LIBCMT ref: 000000014008FBBD

GetLocaleInfoW.KERNEL32 ref: 00000001400A917D

Part of subcall function 000000014008FBA0: _invalid_parameter_noinfo.LIBCMT ref: 000000014008FC16

GetLocaleInfoW.KERNEL32 ref: 00000001400A9245

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 8cdfe7f1b5fd9999da327c4f4609675d5690c7bae2d768c40d9912784c01383a
Instruction ID: 5aa2a0d1c8725bc235ac10c78bb89a9ef32e388b198462fc47fde5f37f4abd7d
Opcode Fuzzy Hash: 8cdfe7f1b5fd9999da327c4f4609675d5690c7bae2d768c40d9912784c01383a
Instruction Fuzzy Hash: 3761B2327006419AEB369FA6E5503ED73A1F7AC7C5F408325EB9A936E1DB38D591CB00

Function 00000001400763A6 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

EXayy7tI8YZ2RBeXAy50u39uvyoII2IeIv51t8gZ9hA=, xrefs: 0000000140076449
port, xrefs: 000000014007705F
czrMHYWulnc=, xrefs: 00000001400764D1

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: EXayy7tI8YZ2RBeXAy50u39uvyoII2IeIv51t8gZ9hA=$czrMHYWulnc=$port
API String ID: 0-4226204186
Opcode ID: e2bb2ed4faeef6878684d7fd7acdfbc19a653c94f585a990c483827dae273339
Instruction ID: 9b4862e95f6fcc26d2417899f4ab57a580ce994f7de1a64d19b262a48ac5c7d0
Opcode Fuzzy Hash: e2bb2ed4faeef6878684d7fd7acdfbc19a653c94f585a990c483827dae273339
Instruction Fuzzy Hash: 0A724C72629BC485EA61CB25E4803DEB3A5F7D9784F505215EBCD13BA9EF38C191CB04

Function 000000014009F0D8 Relevance: 3.9, Strings: 3, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 000000014009F262
e+000, xrefs: 000000014009F1E5
-, xrefs: 000000014009F237

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: -$e+000$gfff
API String ID: 0-2620144452
Opcode ID: c7e19593615f5b016f33edca04d76eabfb088503034d3aa1c419b3a715446e94
Instruction ID: 5492b00e63e4a759c2255974a7dbe939dc967fd202c0368106c7b13000663624
Opcode Fuzzy Hash: c7e19593615f5b016f33edca04d76eabfb088503034d3aa1c419b3a715446e94
Instruction Fuzzy Hash: C45157767147C486E7268F36E9017A9BB91F348BD4F48D222EBA48BBE5CB79C445C700

Function 0000000140051AF0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000000140051D4E

Strings

parse_error, xrefs: 0000000140051B7E

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error
API String ID: 592178966-3903021949
Opcode ID: 4660bb8badf8c6dd0aeb7cc38a1e76cc4e5f3e3823a0b1328e24b7fae0a98b52
Instruction ID: 3c4670f40cc9ab17b43fc29367b9fa31500672bc97c50587d62b6602c41e7cfc
Opcode Fuzzy Hash: 4660bb8badf8c6dd0aeb7cc38a1e76cc4e5f3e3823a0b1328e24b7fae0a98b52
Instruction Fuzzy Hash: FEA17E72B10B8489EB12CB66E4403ED6362E79D7D8F109711EF9C17AAAEB39C195C340

Function 000000014009E020 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000000014009E094

Strings

GetLocaleInfoEx, xrefs: 000000014009E03C, 000000014009E04D

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 099550578a3a416ea78b7fa52ed638fc0f733537aeae7f3447c0ea0cdfd8c17a
Instruction ID: fb935f9c2ab31aa5e90575f03674e7bf2486afca9488b688b185203ea02026ac
Opcode Fuzzy Hash: 099550578a3a416ea78b7fa52ed638fc0f733537aeae7f3447c0ea0cdfd8c17a
Instruction Fuzzy Hash: 80016D35704A8086EB569B57F4407DAA761FB9CBC0F984426FF4913BBADE38C9428790

Function 000000014007C8E0 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000014007C943
ShellExecuteW.SHELL32 ref: 000000014007CF8A

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: a9930aa51e6af6aed28113d84c62410ac396fb6bf6f1d180f11b06186f4ae6ab
Instruction ID: 5fd44ca7600df07536896c6d8f236d3cf04f38ac0af448961f63f8dd7fa29135
Opcode Fuzzy Hash: a9930aa51e6af6aed28113d84c62410ac396fb6bf6f1d180f11b06186f4ae6ab
Instruction Fuzzy Hash: 60120772625FC48ADB518F2AE88079EB3A5F788794F506215FF9D57B68EB38C150C700

Function 0000000140078020 Relevance: 3.2, APIs: 2, Instructions: 248COMMON

Download Yara Rule

APIs

BCryptDecrypt.BCRYPT ref: 00000001400781E0

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CryptDecrypt
String ID:
API String ID: 2620231605-0
Opcode ID: a15f310f6230dab8b2c439189cf4db1ee8969c8c9a52d6e13aa6a1d9d343b1fb
Instruction ID: f7f5fd7e2185f9db639c3601158b2a71c7d2ea5875eccf7afe32dc6e5bc30884
Opcode Fuzzy Hash: a15f310f6230dab8b2c439189cf4db1ee8969c8c9a52d6e13aa6a1d9d343b1fb
Instruction Fuzzy Hash: 7FB16A72B48B809AEB61CB66E4503AD37B5F34978CF008216EF4817BA9DB79C599D340

Function 00000001400A14E4 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00000001400A1733
RaiseException.KERNEL32 ref: 00000001400A1744

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 7fa2203b5ce5cf4252278981a869295bf258e597fb1a3e488d01a74adacce12a
Instruction ID: ce3cffeaddecb57bd5aa004852814d0472f37fd234069d5227336842901e8d70
Opcode Fuzzy Hash: 7fa2203b5ce5cf4252278981a869295bf258e597fb1a3e488d01a74adacce12a
Instruction Fuzzy Hash: 82B1FD77610B848BEB56CF2AD44539C7BE0F398B98F198A15EB59877B4CB39C491CB00

Function 00000001400AC128 Relevance: 3.2, APIs: 2, Instructions: 208COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400AC1CD
_invalid_parameter_noinfo.LIBCMT ref: 00000001400AC38F

Part of subcall function 000000014009DA30: HeapAlloc.KERNEL32 ref: 000000014009DA85

Part of subcall function 000000014009D3C8: HeapFree.KERNEL32 ref: 000000014009D3DE
Part of subcall function 000000014009D3C8: GetLastError.KERNEL32 ref: 000000014009D3E8

Part of subcall function 00000001400AD894: _invalid_parameter_noinfo.LIBCMT ref: 00000001400AD8C7

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast_invalid_parameter_noinfo$AllocFree
String ID:
API String ID: 749460637-0
Opcode ID: 6120cd2db9c099bf974b85608473aedc748567b28a25adf1687327546a1749dc
Instruction ID: a0cc71780de81b772317908ff88ec895ebc3ca39ef53a965ae4e9244de46f0ae
Opcode Fuzzy Hash: 6120cd2db9c099bf974b85608473aedc748567b28a25adf1687327546a1749dc
Instruction Fuzzy Hash: 92612B3231478142EB669F67A810BEEB3D1B7DCBC0F454626BF49477A5EE38C8818B04

Function 0000000140086540 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 0000000140086657
EnumDisplayDevicesW.USER32 ref: 00000001400866FB

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: DevicesDisplayEnum
String ID:
API String ID: 2211661463-0
Opcode ID: efc3b5e339676c8b80197b2938f6d85a335b7ecceb1b7679b6c81ff67d52d715
Instruction ID: c35878f14fd4ace50e34acaeaa391da43f012d67d0405fd52747271c3f58506e
Opcode Fuzzy Hash: efc3b5e339676c8b80197b2938f6d85a335b7ecceb1b7679b6c81ff67d52d715
Instruction Fuzzy Hash: 7E81AB33A14B8486E721CF26E84479E77A5F388798F515215EF9C17BA9EF78C681CB00

Function 0000000140037C20 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140037CAD
LocalFree.KERNEL32 ref: 0000000140037D3F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 34d943551a4b9f41df1ee0f5e8d59b3a172d2e47d97a60c44756803dac96181a
Instruction ID: 7f40ee8586bf01c3048f34f820df491f9ea945d51269d3c7e357f259fb1b8b85
Opcode Fuzzy Hash: 34d943551a4b9f41df1ee0f5e8d59b3a172d2e47d97a60c44756803dac96181a
Instruction Fuzzy Hash: D2616632B14B809AEB22DF76E4403DD73B1E75978CF008229EB8D17E9ADB78C5948350

Function 0000000140078B00 Relevance: 3.0, Strings: 2, Instructions: 529COMMON

Download Yara Rule

Strings

%, xrefs: 0000000140079164
+, xrefs: 000000014007917F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 5b96eee8d12b20b883142cf5d31d9b5b4c074048313c0e0595a3f5201f946071
Instruction ID: 4f07d37735d6ed429a9df18d9a74b6349316186db300b3afe0c233002630e10c
Opcode Fuzzy Hash: 5b96eee8d12b20b883142cf5d31d9b5b4c074048313c0e0595a3f5201f946071
Instruction Fuzzy Hash: 1F221333B14A848AFB26CB66E4503ED67A2E7597D8F444222EF4917BE9DB3CC445C350

Function 00000001400A46E4 Relevance: 2.9, Strings: 2, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 00000001400A4993
a/p, xrefs: 00000001400A49FE

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: d4351435efb39c397654aac4863534f6b364d586ca34e5132229a126b3ed6b80
Instruction ID: 282e28f27db02fe1aa2beadafee1f9428e67b57fa7ec56f663f6cb2ab2f17a07
Opcode Fuzzy Hash: d4351435efb39c397654aac4863534f6b364d586ca34e5132229a126b3ed6b80
Instruction Fuzzy Hash: A0E1ED3A61468085EB668F2791547FE23A4FBB97C4F654302FB4A07FA4DB38C991CB11

Function 0000000140030A80 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

dumps, xrefs: 0000000140030AC8
emoji, xrefs: 0000000140030AF0

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: dumps$emoji
API String ID: 0-2873254224
Opcode ID: 9c1d1d90ca4f88bc8268b0322e863aaa792dfa8aa99b6ae742cb4d4f1446b717
Instruction ID: de1d32d498b1603b3283e1e425eee834114ee630492cf4a12f2e42a933c28d9c
Opcode Fuzzy Hash: 9c1d1d90ca4f88bc8268b0322e863aaa792dfa8aa99b6ae742cb4d4f1446b717
Instruction Fuzzy Hash: EEB1FA32929BC486E661CB25E88039AB7A4F79D788F116315FBCD53B59DB38D290CB00

Function 0000000140060AC0 Relevance: 2.0, APIs: 1, Instructions: 470COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140060B3B

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 837dce3a7638e622362a98dae6413cb48e0848b1bbd54b8037b6e21237e2d6ea
Instruction ID: 3ea09d183f0e17230624784c327211b13ac9c21796c8a57e93de2c3ba86a3c65
Opcode Fuzzy Hash: 837dce3a7638e622362a98dae6413cb48e0848b1bbd54b8037b6e21237e2d6ea
Instruction Fuzzy Hash: 9F029B72711B8585EB11CFA6D8403EE63A2E748BD8F589622EF9C177A9DF34C495C380

Function 00000001400A6A68 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000001400A6BB0

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 0aeda05f8e17a057bf0c4e30c5f8b36998a1f9dbcc3846e21ecfb66c9c3a146b
Instruction ID: a529babc2d6e8ba6f5e828ff2b22bd3019f6cc999c29afac651c8859d6e64573
Opcode Fuzzy Hash: 0aeda05f8e17a057bf0c4e30c5f8b36998a1f9dbcc3846e21ecfb66c9c3a146b
Instruction Fuzzy Hash: 06128A32A08BC486E752CF3994457ED73A4F76D788F459316EB98876A2EB34D2C4CB00

Function 00000001400A71D8 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d8af75c0a56fd72291b2102bcd836d71eb6da3f8600b046377b4d4d31aea83
Instruction ID: bb940daf5543c1f9a79ee97aaadeda5922451d7e61c1cde4f32fc15d938a2440
Opcode Fuzzy Hash: c6d8af75c0a56fd72291b2102bcd836d71eb6da3f8600b046377b4d4d31aea83
Instruction Fuzzy Hash: 4CE15036704B8086E721DB62E4417EE77A4F3A97C8F418626EF8D53B66EB78D245C700

Function 000000014005C0F0 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014005C40B

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ba6e798b33c31b8babce7982aa7647becf1fe59b5221b68f800a875ca2996f14
Instruction ID: 3367cc3590d20919b635da020e6a9838ec97f649690dd723de14dcaa02d71857
Opcode Fuzzy Hash: ba6e798b33c31b8babce7982aa7647becf1fe59b5221b68f800a875ca2996f14
Instruction Fuzzy Hash: 4DA17932715B9889EB02CBAAD4803EC37B0F359B88F548516EF8E57B69DB39C195C350

Function 000000014005BAB0 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014005BDC4

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: baf6e9e96fe520b1ae0ed223b090e5a862bb2f1c033f3b610d442a665e70a209
Instruction ID: e7e758f77b730658fa2183651e0bcda9456a6a66edef94dbe68809bbbcb91688
Opcode Fuzzy Hash: baf6e9e96fe520b1ae0ed223b090e5a862bb2f1c033f3b610d442a665e70a209
Instruction Fuzzy Hash: 4AA18932615B98C9EB01CB6AD4803EC3BB0F359B88F548516EF8D57769DB79D191C310

Function 000000014005B780 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014005BAA9

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e35d31433939dc0543c08c43d2f0dc283812906ada797f849c1cd6b06b58ce4c
Instruction ID: fa854fabc025c76a206bed3a6f1c0845178dcea3b927583e1f4c4cda74e7147e
Opcode Fuzzy Hash: e35d31433939dc0543c08c43d2f0dc283812906ada797f849c1cd6b06b58ce4c
Instruction Fuzzy Hash: 0FA18A32A15B98C9EB01CBAAD4803EC77B0F359B88F548516EF8D57B69DB39D095C300

Function 000000014005B480 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014005B778

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4b8af6986515120270ba365742b96f2dd5aa66236f7c22f50c2dfd717eb9943c
Instruction ID: d35a4813ebe911b3f3d06accd323ebf2fe1b7b1083f9830a8cc86ee30199d110
Opcode Fuzzy Hash: 4b8af6986515120270ba365742b96f2dd5aa66236f7c22f50c2dfd717eb9943c
Instruction Fuzzy Hash: D2A17832715B98C9EB12CB6AD4803EC67B0F359B88F648416EF8D57BA5EB39D095C300

Function 000000014005C420 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014005C718

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 92ccbd0a8e0b9bab8b316c06ea776526206f989eac8567461fb4490da54086ea
Instruction ID: 854463cf17bdd6b58da1f7546ddcdbe712e6ab292ec46fef6426cf4f233b86a0
Opcode Fuzzy Hash: 92ccbd0a8e0b9bab8b316c06ea776526206f989eac8567461fb4490da54086ea
Instruction Fuzzy Hash: 4FA19C72721B9889EB02CBAAD4907EC37B0F359B88F549416EF8E57B65DB39C191C340

Function 00000001400A9310 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140099EEC: GetLastError.KERNEL32 ref: 0000000140099EFB
Part of subcall function 0000000140099EEC: FlsGetValue.KERNEL32 ref: 0000000140099F10
Part of subcall function 0000000140099EEC: SetLastError.KERNEL32 ref: 0000000140099F9B

Part of subcall function 0000000140099EEC: FlsSetValue.KERNEL32 ref: 0000000140099F31

GetLocaleInfoW.KERNEL32 ref: 00000001400A9378

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: d3f265d93177da05e9e3079d3dae9c7822de4fa7ba26229b0f968e85ede82faf
Instruction ID: a4ca8649259d75ba04167a6e259112765b42d28c6b5c3f01e538b8ae298da7d2
Opcode Fuzzy Hash: d3f265d93177da05e9e3079d3dae9c7822de4fa7ba26229b0f968e85ede82faf
Instruction Fuzzy Hash: 9431713270468186EF6ADB67E4513DE73A1F79C7C4F408225BB8A876A5DF38D691CB00

Function 0000000140026510 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

QN , xrefs: 0000000140026877

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: QN
API String ID: 0-3349929942
Opcode ID: 4adeaebae40e5ff169471ee5d4a8d23a557c17ee84dec89bc840266fd6fece81
Instruction ID: 4f3d7730723fade62404a711111efc0fb212951dde9af45be0f290200e40d11c
Opcode Fuzzy Hash: 4adeaebae40e5ff169471ee5d4a8d23a557c17ee84dec89bc840266fd6fece81
Instruction Fuzzy Hash: BB02D432915BC489E7628F39E8813D977A4F7AD788F105315EBCC6BB69EB74C2908740

Function 00000001400A9518 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140099EEC: GetLastError.KERNEL32 ref: 0000000140099EFB
Part of subcall function 0000000140099EEC: FlsGetValue.KERNEL32 ref: 0000000140099F10
Part of subcall function 0000000140099EEC: SetLastError.KERNEL32 ref: 0000000140099F9B

GetLocaleInfoW.KERNEL32 ref: 00000001400A954F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 8a450860209e15821de9f16c01ed0612a725223f9a4b72f88eafb3edea00904a
Instruction ID: a262072600bdabd7c0679cf6d9857ba45dbebfe756d1e7f3d1e5b58b444c0772
Opcode Fuzzy Hash: 8a450860209e15821de9f16c01ed0612a725223f9a4b72f88eafb3edea00904a
Instruction Fuzzy Hash: B1110A32B1495183E7778777A04179E62A1E76C7E4F548721F766477E4E636C8C18B00

Function 00000001400A9030 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140099EEC: GetLastError.KERNEL32 ref: 0000000140099EFB
Part of subcall function 0000000140099EEC: FlsGetValue.KERNEL32 ref: 0000000140099F10
Part of subcall function 0000000140099EEC: SetLastError.KERNEL32 ref: 0000000140099F9B

EnumSystemLocalesW.KERNEL32 ref: 00000001400A90AE

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 0c241287891358d20c5c1590d81d3974ae3e0a48a457f3cbc01ffa927b921278
Instruction ID: 6ae5d8b3708d6626887a23f7dbcc4907dd0624352dc3dc594ae9d114bdff575e
Opcode Fuzzy Hash: 0c241287891358d20c5c1590d81d3974ae3e0a48a457f3cbc01ffa927b921278
Instruction Fuzzy Hash: 4D01D472B042808AEB128FA7E440BD976A1E768BE4F458321E765473E9CB7588C1CB00

Function 00000001400783C0 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BCryptCloseAlgorithmProvider.BCRYPT ref: 00000001400783D9

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: AlgorithmCloseCryptProvider
String ID:
API String ID: 3378198380-0
Opcode ID: a49c3b6583adfaba8861ffbea0360190acc6ca0004127818107b2a19b5c9d09e
Instruction ID: 46cd3e4ecf0bf3881bc472a46e152dc7da49fa282612d15e85770da4dfb79c46
Opcode Fuzzy Hash: a49c3b6583adfaba8861ffbea0360190acc6ca0004127818107b2a19b5c9d09e
Instruction Fuzzy Hash: E901AFB2700A8481EF299B22E4583AD2361E748FC9F944410EF4C076A9DFBDC8858380

Function 000000014009DAE0 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000000014009DB2F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 17140df511fe09419b9fc83be2d2c34c2fb9fdba42dd4bc62a26aeb66c77a399
Instruction ID: de712f23fd13e8c4d5100720269348e510cf31078cf0cbf84c59e1ff34ea8840
Opcode Fuzzy Hash: 17140df511fe09419b9fc83be2d2c34c2fb9fdba42dd4bc62a26aeb66c77a399
Instruction Fuzzy Hash: D8F037B2304B4083E705DB2AF8907D973A2E79DBC0F549126EB4983379CE38C9A1C300

Function 0000000140096164 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

, xrefs: 0000000140096346

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d56b133698f6429a15668cf33a50c2b0452d3e907794045ce25e286071ddca93
Instruction ID: 5985c16e8c7ee05d195531540a6d0c9df7fc115bbda66a9a795bdfadb218e8cb
Opcode Fuzzy Hash: d56b133698f6429a15668cf33a50c2b0452d3e907794045ce25e286071ddca93
Instruction Fuzzy Hash: CCB16D72204B848AEB66CF3AD0503AD3BB4F34DF88F684116EB8A473A5DB36C951C745

Function 00000001400283D0 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0538767b6b45461ea7b05e4291f3168d71c376be44ab5dc851c2711e80cf8c7
Instruction ID: 11b7f8a1af85b3332e8e9ec774ad9aafbdc42df1fa3ac2c6f6e342fe0cafe42d
Opcode Fuzzy Hash: d0538767b6b45461ea7b05e4291f3168d71c376be44ab5dc851c2711e80cf8c7
Instruction Fuzzy Hash: 6AA27136615FD88AD7418FAAEC8129973B6F748BA8B101619EFCC57F18EBB4C164C740

Function 0000000140025520 Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e35f03aa72f71c4cef63a3631f52340a7714b9513cad78216b5a0f5b68282a1
Instruction ID: beef6051a45bce1b1226442735bbb051317004564f72870a77c8f5785136e9d7
Opcode Fuzzy Hash: 5e35f03aa72f71c4cef63a3631f52340a7714b9513cad78216b5a0f5b68282a1
Instruction Fuzzy Hash: B092B432915BC88AD7718F25E8813DAB7A8F79D788F505315EACC16B19EB38D394C704

Function 0000000140062750 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction ID: 1d33147da6fef292ddb6e3dfce7d4f5fb46f2d394935471198070cec947208fe
Opcode Fuzzy Hash: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction Fuzzy Hash: 23C1D073725A9487EB56CF63D9447A9B762F3D8BE0F55D120EB4A07B98CA38C846C700

Function 0000000140006610 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7a290a570e9d3cc73f624a0d47eda25802d2b86087ba3fde031420589ba8c2
Instruction ID: dae7188b58aa12ed6a721d46ece6e361adde1b5e6735e4fc9e27f5ef3900fc0f
Opcode Fuzzy Hash: fe7a290a570e9d3cc73f624a0d47eda25802d2b86087ba3fde031420589ba8c2
Instruction Fuzzy Hash: DD12C532619BC88AE7718F29E84139AB7A4F79D788F505315EBCC57B19EB38C254CB04

Function 0000000140075AB0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction ID: 447b2b773560c4beaa4e67ccb80f79841d332dbb345d5add23c245d827f16df0
Opcode Fuzzy Hash: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction Fuzzy Hash: 38C1C4B3A146948BE355CF2DD401A5D7BA0F398B84F40A629EB56C3B01E778D9A5CF80

Function 000000014009A924 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: a2379e98abae736fe33e8b4f9fedcc0141c51f1be06055089ccb01d873b85599
Instruction ID: 81f69587606c8d6d2920975f800801ad71658ffe686509f5888f9c5868ecb4cc
Opcode Fuzzy Hash: a2379e98abae736fe33e8b4f9fedcc0141c51f1be06055089ccb01d873b85599
Instruction Fuzzy Hash: BFC1C27630468086EB629B6799107EA37A1F79ABC8F404115FF8A8BBE5EF3CC545C740

Function 000000014009666C Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c2dc1868310f7be340402d514fcc5ddbcaaf30b09b4b1a75e66e521b583746
Instruction ID: 3a803396a737e7e09fc37ffe396adff213b7af43b5bde25c7abf1f4bb1d46515
Opcode Fuzzy Hash: f0c2dc1868310f7be340402d514fcc5ddbcaaf30b09b4b1a75e66e521b583746
Instruction Fuzzy Hash: 21C1B832604A4486EB2ACF3BC5507AE37A0E749BCCF248215EF595B7E5DB3AC846D740

Function 00000001400A8674 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: 468b93f19c7ca54f8d79ce9aecab092ca155e8bca1880fa3cbddf3014db9fedd
Instruction ID: 219554444d32d0e4537ad1326bba152ffa5b4e92018c9ef7381ea1e0fb4a3fed
Opcode Fuzzy Hash: 468b93f19c7ca54f8d79ce9aecab092ca155e8bca1880fa3cbddf3014db9fedd
Instruction Fuzzy Hash: A8B1CE7261468482EB76DF22D4117EA33A0F3A8BC8F544326EF56836E9DF78C595CB40

Function 0000000140054720 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8096616a82d0af589e55529d9e21aaaddb0a4067eb04550f42ec58ec897b5e0e
Instruction ID: b20235c530f76bdce2ee3876d0716f49ee890a7daca5df87e94b1965b3cc0896
Opcode Fuzzy Hash: 8096616a82d0af589e55529d9e21aaaddb0a4067eb04550f42ec58ec897b5e0e
Instruction Fuzzy Hash: 8661B172714BC882DB21CB2AE4453EDA3A1F75D7D8F549211EB9D47BA8EB79D280C340

Function 000000014009F7E6 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd72482e03d17e0c267891211c2a08fffdf3b2de236a6c27577c882ac387638
Instruction ID: e2c9dfdefbb9d112d0675f23ad41226c04d3d172fc5c8865881e53bf685bf733
Opcode Fuzzy Hash: afd72482e03d17e0c267891211c2a08fffdf3b2de236a6c27577c882ac387638
Instruction Fuzzy Hash: 4B51D87261878086EBB5CB2BA4413BAA690F74E7D4F544225FB9E43BE9DB3CC5409B00

Function 000000014007E2F0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138ce084abc59b7a62cd21c0bdb32c0536e72d2a6f022af23bd525f26c324e99
Instruction ID: 027d60879b43b0a81cc45adc781a0af0a38eddb82efb1c2e3e36529c8144405a
Opcode Fuzzy Hash: 138ce084abc59b7a62cd21c0bdb32c0536e72d2a6f022af23bd525f26c324e99
Instruction Fuzzy Hash: F85104A3B0568443DB248B49F842796F7A5FB987C5F00A126EE8D57B69EB3CD580C700

Function 0000000140095394 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: 99ad1355632ae1fd69952ade0b8b880547fb4266a066a210fa678cc3ea636d96
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: 6D519236624A5086E7669B2BD0543AC3BA1E35CFDEF258111EF89477B5C736C893C740

Function 0000000140095598 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 1a5f552ae487ea52881a4b4007291b9de41d1dc95850a7e92b2562e97dc69483
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 8B51C136224A50C6E7269B2BE0403A97BA1E34CFD9F684111EF49477B5D732CD43CB80

Function 000000014009579C Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: bf005c958525c39f9f98a73881a786616db269bc64c82d253bf23c47cd79f0e7
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: B3518036624A50C6E7269F2BC0503A93BA1E34DFA9F288111EF89577B4CB36CD43C780

Function 00000001400ABB90 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b072ca8265509c148f4541a461e9c46211a015d1fc6d543edcef350f88236ae8
Instruction ID: be5b461f7ee288339d9b570e5532cccf87377d3a7bff12cd17e984541771d2f7
Opcode Fuzzy Hash: b072ca8265509c148f4541a461e9c46211a015d1fc6d543edcef350f88236ae8
Instruction Fuzzy Hash: 7641B172310A5482EF19CF2BD9647A973A1B35CFD0F59A126EF0D87B68EE38C5818700

Function 00000001400D5160 Relevance: .1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089669ce669d081df486ff3b8b6641101563950708773524b1d9522e67aede12
Instruction ID: b7e38492203f7abc1e491ed0abd3b621df41d3afc1b4311ebdd3e988bab3f20c
Opcode Fuzzy Hash: 089669ce669d081df486ff3b8b6641101563950708773524b1d9522e67aede12
Instruction Fuzzy Hash: A53146BF54DBC00AF3536A7D4C2639E3F90AB96F45F0D815AAB81071E3E56648068B61

Function 00000001400D5168 Relevance: .1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783f2eec1859eb4d5e5f2fdf3af40a27b15019a7ed358256412597de850fea12
Instruction ID: b12bf3c16a5d6c12397175f3f1fd157ec23eaafdfc214c01a87de6655d36ac77
Opcode Fuzzy Hash: 783f2eec1859eb4d5e5f2fdf3af40a27b15019a7ed358256412597de850fea12
Instruction Fuzzy Hash: 673137BF54EBC00AF3535A7D4C3639D3F90AB96F45F0DC15AAB81071D3E56648068B61

Function 00000001400D5140 Relevance: .1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911394416a5fb5ac9b515dfc51e85484b9a328200e3329313af4be26ccdb30f5
Instruction ID: aa2f8a7dbb58fc365c3a8fd16ed59226eab26a5ada88dd2349ccc4f66fe2c2e5
Opcode Fuzzy Hash: 911394416a5fb5ac9b515dfc51e85484b9a328200e3329313af4be26ccdb30f5
Instruction Fuzzy Hash: F53158AF54DEC00AF3936A7D4C3639E3F90DB96F46F0D805AEB81031E3E42688024B61

Function 00000001400D53A0 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b6592297da477f47bc4ff112285600c105c28c02c61d9431ebaf8f23cc515d
Instruction ID: 2f5de9456db489e6349fe5fac7c728bb428c023e98d47e4a580f062c9bd56dbd
Opcode Fuzzy Hash: f1b6592297da477f47bc4ff112285600c105c28c02c61d9431ebaf8f23cc515d
Instruction Fuzzy Hash: 7A21CAF750DAC00AF3932E794D6A39C3F909B99F86F4DC159EB81031D3E8B598478622

Function 00000001400D52E0 Relevance: .1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621a476faf91e54c4cc03539473d8505f5c368e1576c38102583692f8d871d13
Instruction ID: 4fba5d05e34204c22b3bba82af6e1151bd841cf2facc8e2ab9ee4cf9954dd0da
Opcode Fuzzy Hash: 621a476faf91e54c4cc03539473d8505f5c368e1576c38102583692f8d871d13
Instruction Fuzzy Hash: 601187F740EFC00BF3931E794D6638D3F90AB96F81F0E804AEB80431D3A965A9069611

Function 00000001400D5720 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9961b442e1576310a3bba1fe8fed4727423dda6a192fd25a309501ccb606d3cb
Instruction ID: a3b66b0d6e5b57a215704f2c633b967f9b251cc1ef1c6aeecfa3ac384f4b1c13
Opcode Fuzzy Hash: 9961b442e1576310a3bba1fe8fed4727423dda6a192fd25a309501ccb606d3cb
Instruction Fuzzy Hash: D3118E9750EBC08FE3535A751C6534C2F70AB9AB91F5E8197D781832D3E559480A8732

Function 00000001400D5688 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7815c8413f6a2a8e18976f86c541d20a89cc1ea0eb2583e60f44d9e2c30b8a26
Instruction ID: f26107a927af884358f2b2e2f9d036376b3884f6f3bc3d4bc6ca4c542444a85c
Opcode Fuzzy Hash: 7815c8413f6a2a8e18976f86c541d20a89cc1ea0eb2583e60f44d9e2c30b8a26
Instruction Fuzzy Hash: 4C01F45744EBC50AF3531A350C6E39C6FA09B96B52F8E8097EBC0871E3E42ACC578721

Function 00000001400D54A0 Relevance: .0, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633a867117d452b22201e5b3a42ffd539ff400b71c35a34595b3eca8d68ef229
Instruction ID: 66166356e3e42663ba3445fde79f1660939963f8f762c774ba2af530c85eb0a1
Opcode Fuzzy Hash: 633a867117d452b22201e5b3a42ffd539ff400b71c35a34595b3eca8d68ef229
Instruction Fuzzy Hash: 25E092BB40EBC00FF3631EB548163AC3F50EF55B1AF08814AE782030E3993584468B23

Function 00000001400D56F8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92123dfd2565593975c2ad7267cbbd198131a2449c7d8256d9d4c0d27fe80176
Instruction ID: 411e9c7faa1a084a79b0b51271df2b4c76b6de559c48bc5e8d385bd3869b1003
Opcode Fuzzy Hash: 92123dfd2565593975c2ad7267cbbd198131a2449c7d8256d9d4c0d27fe80176
Instruction Fuzzy Hash: 70C012FFD0D48085FA53547958A53CC0FA1EB5B7E1F391459FB94431932011480B0AE1

Function 00000001400D5660 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1e26d69dec6fa3d579c7cf62eb550d907964fe41f0c23f1b18bb165fa07a59
Instruction ID: d9db0127e48baae59ecc09d6b894aedd09a0dc822727eeae0400bf5bc600f074
Opcode Fuzzy Hash: db1e26d69dec6fa3d579c7cf62eb550d907964fe41f0c23f1b18bb165fa07a59
Instruction Fuzzy Hash: 6BE0ECA751C6C619E3535B794C68B582F409B5A725F9D43D6DBE0471E2E46484028211

Function 0000000140074A30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140074A86
Process32FirstW.KERNEL32 ref: 0000000140074ACA
Process32NextW.KERNEL32 ref: 0000000140074ADF
OpenProcess.KERNEL32 ref: 0000000140074B1B
OpenProcessToken.ADVAPI32 ref: 0000000140074B42
GetTokenInformation.ADVAPI32 ref: 0000000140074B6E
GetLastError.KERNEL32 ref: 0000000140074B7C
GetTokenInformation.ADVAPI32 ref: 0000000140074BBC
ConvertSidToStringSidA.ADVAPI32 ref: 0000000140074BD3
CloseHandle.KERNEL32 ref: 0000000140074C46
CloseHandle.KERNEL32 ref: 0000000140074C51
CloseHandle.KERNEL32 ref: 0000000140074CB6
Process32NextW.KERNEL32 ref: 0000000140074CC3
CloseHandle.KERNEL32 ref: 0000000140074CE9
CloseHandle.KERNEL32 ref: 0000000140074CF2
CloseHandle.KERNEL32 ref: 0000000140074D07

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: b7cdb7a7c6588e50aaab37c0fa57b8db1cd1071ffc72c1321cf755afb8342ce3
Instruction ID: 68b79e17468d5ffc7bdb11eb9da1f300de3bde19eb7119fa88f07868e24a99b8
Opcode Fuzzy Hash: b7cdb7a7c6588e50aaab37c0fa57b8db1cd1071ffc72c1321cf755afb8342ce3
Instruction Fuzzy Hash: E1815636215B8082EB52DB27E8507AEA7A4FB8CBD5F404115EF8947BA8DF7CC506CB00

Function 0000000140057C00 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 202COMMON

Download Yara Rule

Strings

unexpected key without object, xrefs: 00000001400592EA
quote was opened but not closed., xrefs: 0000000140059236, 00000001400592AB
key opened, but never closed, xrefs: 00000001400593BF
key declared, but no value, xrefs: 000000014005925D, 0000000140059284, 0000000140059398
No closed word, xrefs: 0000000140059317, 000000014005933E
word wasnt properly ended, xrefs: 0000000140059365, 00000001400593EC
unexpected '}', xrefs: 0000000140059413
object is not closed with '}', xrefs: 000000014005920F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: No closed word$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 0-2700065129
Opcode ID: d4d6e1f00baca8fa5c785b120d7762d1877a4de986df126110b89ab9b3beed74
Instruction ID: 44ba6145ae1bfc3c9eee5221331825ba00ebf41b129be2c708582a987009f12d
Opcode Fuzzy Hash: d4d6e1f00baca8fa5c785b120d7762d1877a4de986df126110b89ab9b3beed74
Instruction Fuzzy Hash: E3B1FB72111BC698EB72EF62DC817D83364E758388F809616E74D4B9BAEF74C699C700

Function 0000000140090254 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140090283
_invalid_parameter_noinfo.LIBCMT ref: 0000000140090353

Strings

0, xrefs: 0000000140090325
0, xrefs: 000000014009037D
0, xrefs: 000000014009038F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0
API String ID: 3215553584-3137946472
Opcode ID: 4b936a4394e80428ad7bf41d875096a3e7add69c0315c25dc0869b4c3066c4ac
Instruction ID: 3213ef2b50ecd163c7d14e926568a975ace41416199d29b45c1ca283887101a0
Opcode Fuzzy Hash: 4b936a4394e80428ad7bf41d875096a3e7add69c0315c25dc0869b4c3066c4ac
Instruction Fuzzy Hash: BDE1D532506A858EF7629F2AC5903ED3BE5E75ABC4F558012FB84477F6C739886AC700

Function 0000000140089B70 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000000140089BA1
GetProcessId.KERNEL32 ref: 0000000140089BAA
RmStartSession.RSTRTMGR ref: 0000000140089BCA
RmRegisterResources.RSTRTMGR ref: 0000000140089BF5
RmGetList.RSTRTMGR ref: 0000000140089C2E
RmGetList.RSTRTMGR ref: 0000000140089C90
RmEndSession.RSTRTMGR ref: 0000000140089CCB
RmEndSession.RSTRTMGR ref: 0000000140089D02
RmEndSession.RSTRTMGR ref: 0000000140089D17

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: 4ddc3a5b4f8c6342cd3dcf0c0e78daa6693b2bbe667ef408570da53bc05ca548
Instruction ID: 4c793500f816d282acb2aabb8fc29ea38f6b32d5493fd496aff2a0b1b3cfbeb8
Opcode Fuzzy Hash: 4ddc3a5b4f8c6342cd3dcf0c0e78daa6693b2bbe667ef408570da53bc05ca548
Instruction Fuzzy Hash: 96512A32B10A518AFB11DFA6E4507DD33B1B78C789F54412AEF0A67BA8DE38C906C750

Function 000000014009DB5C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000000014009DCD8
GetProcAddress.KERNEL32 ref: 000000014009DCE4

Strings

ext-ms-, xrefs: 000000014009DC35
api-ms-, xrefs: 000000014009DC22

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ca7c09baf792878f96d911292d21648074434898d998409f668d6f16be7d0add
Instruction ID: f73114aa169cb76ed7bb151e5edde51fcbf1469d6d678e3e652b687f2da571e4
Opcode Fuzzy Hash: ca7c09baf792878f96d911292d21648074434898d998409f668d6f16be7d0add
Instruction Fuzzy Hash: 6341AE72351A1182FA27DB27A8147DA33D5BB4DBE1F494626BF0D877A8EE78C446C340

Function 000000014007B2D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 000000014007B33B
InternetOpenUrlA.WININET ref: 000000014007B370
InternetReadFile.WININET ref: 000000014007B391
InternetReadFile.WININET ref: 000000014007B3CF
InternetCloseHandle.WININET ref: 000000014007B3DC
InternetCloseHandle.WININET ref: 000000014007B3E5

Strings

File Downloader, xrefs: 000000014007B334

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 1e9de7057c166f37b575db31b5f1dc468b519a1c6aad4c6b10908d5ac9de1539
Instruction ID: 6b715f6a660270e928626361db48bc2de02284253a52f84719e93bd1f762254a
Opcode Fuzzy Hash: 1e9de7057c166f37b575db31b5f1dc468b519a1c6aad4c6b10908d5ac9de1539
Instruction Fuzzy Hash: 6B313B32214B8486EB229F26F85079EB3A1FB89BC5F545116FF8943B68DF7CC5958B00

Function 00000001400938F0 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140093933
_invalid_parameter_noinfo.LIBCMT ref: 0000000140093D20
_invalid_parameter_noinfo.LIBCMT ref: 0000000140093FBC

Strings

f, xrefs: 0000000140093A55
p, xrefs: 00000001400939E5
p, xrefs: 0000000140093A5D

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: eea83e675726579202ae46558f478e57f494447b85c4049c91ddb9471f815998
Instruction ID: 8ef2ce2b4433a5174d3e3dbe1a20b96cbda26b55fe283d1aa6820eb14bd99968
Opcode Fuzzy Hash: eea83e675726579202ae46558f478e57f494447b85c4049c91ddb9471f815998
Instruction Fuzzy Hash: 8912E572A0864186FB229B16E0687FA76A1F7887D4FC84115F7D6876F4D738C980CF10

Function 00000001400B43CC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000001400B4451
GetLastError.KERNEL32 ref: 00000001400B445F
LoadLibraryExW.KERNEL32 ref: 00000001400B4489
FreeLibrary.KERNEL32 ref: 00000001400B44F7
GetProcAddress.KERNEL32 ref: 00000001400B4503

Strings

api-ms-, xrefs: 00000001400B4471

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 081807f0f237e99e654a6d52eb3ba83cc0c1c8883019cc9f4ec60aedd52be443
Instruction ID: d2d2b12301ccee3db6092258b470e539f8c69494279eba12926322fb6e990f4b
Opcode Fuzzy Hash: 081807f0f237e99e654a6d52eb3ba83cc0c1c8883019cc9f4ec60aedd52be443
Instruction Fuzzy Hash: C2315831212A9092EF23DF97A8007A963E4BB4CBE5F498625EF191B7A4EF38C5558310

Function 00000001400AC8CC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000001400AC8FD
GetLastError.KERNEL32 ref: 00000001400AC909
CloseHandle.KERNEL32 ref: 00000001400AC921
CreateFileW.KERNEL32 ref: 00000001400AC94C
WriteConsoleW.KERNEL32 ref: 00000001400AC96B

Strings

CONOUT$, xrefs: 00000001400AC92D

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 53dac6272d403f79ff27e653aa55d51cb6535fcae6368453f164039c5e4e95e8
Instruction ID: f15e57fd0cbad3ac117247ebeab47ab85c390eb31785d7c6841302a8b2ce117c
Opcode Fuzzy Hash: 53dac6272d403f79ff27e653aa55d51cb6535fcae6368453f164039c5e4e95e8
Instruction Fuzzy Hash: A111BC35324B8086F7529B07E85479AA3A4FB9CFE9F040224EF5987BB4CF78C8858740

Function 00000001400BD42C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000001400BD4D9
MultiByteToWideChar.KERNEL32 ref: 00000001400BD575
MultiByteToWideChar.KERNEL32 ref: 00000001400BD61E
MultiByteToWideChar.KERNEL32 ref: 00000001400BD648
MultiByteToWideChar.KERNEL32 ref: 00000001400BD6F0
CompareStringEx.KERNEL32 ref: 00000001400BD73D

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 26eb7e015d5d110b74ff0d84bcaa31491d724dbf353ec7a17117fafe3eaea0ab
Instruction ID: f3d77999423992fadc64f97f79b2d010f51e5ad261fed549977a36ea05826e58
Opcode Fuzzy Hash: 26eb7e015d5d110b74ff0d84bcaa31491d724dbf353ec7a17117fafe3eaea0ab
Instruction Fuzzy Hash: 44A1AD72645F8086EB339FA694507EDB7A1E749BE8F484622FB59077E5FB38C8448700

Function 00000001400BD0CC Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001400BD13C
MultiByteToWideChar.KERNEL32 ref: 00000001400BD1DA
LCMapStringEx.KERNEL32 ref: 00000001400BD243
LCMapStringEx.KERNEL32 ref: 00000001400BD295
LCMapStringEx.KERNEL32 ref: 00000001400BD33A
WideCharToMultiByte.KERNEL32 ref: 00000001400BD394

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 7d9f455a94f84a05f587d57d339c879795f99f0f1217d4298ff39db3fa6ba98e
Instruction ID: 6204e7013e5cadcd1b8727ff30a8d0596e87d4a89eb5434169e5949405e06915
Opcode Fuzzy Hash: 7d9f455a94f84a05f587d57d339c879795f99f0f1217d4298ff39db3fa6ba98e
Instruction Fuzzy Hash: EE81A572200B8086EB629F66E8407DDB3F5FB58BE8F144616FB5947BE9EB38C5418700

Function 0000000140090840 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400908B2
_invalid_parameter_noinfo.LIBCMT ref: 00000001400908E3
_invalid_parameter_noinfo.LIBCMT ref: 0000000140090923
_invalid_parameter_noinfo.LIBCMT ref: 0000000140090965
_invalid_parameter_noinfo.LIBCMT ref: 000000014009099A
_invalid_parameter_noinfo.LIBCMT ref: 0000000140090A17

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 619b2885e3fd1682f6a864358b33df5452abb606e6c6f730ccce56a3fdc98189
Instruction ID: 7b56d8f3e7d84661432cdb72d15b1222586d501d367448fe89141b583d9e4598
Opcode Fuzzy Hash: 619b2885e3fd1682f6a864358b33df5452abb606e6c6f730ccce56a3fdc98189
Instruction Fuzzy Hash: D0517633605B8489FB639F26D0603ED37A1A75EFC4F998052E7D8473A6CA3D8846C752

Function 000000014009A064 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000014009A073
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,0000000140094E71,?,?,?,?,000000014009D3FC), ref: 000000014009A0A9
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,0000000140094E71,?,?,?,?,000000014009D3FC), ref: 000000014009A0D6
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,0000000140094E71,?,?,?,?,000000014009D3FC), ref: 000000014009A0E7
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,0000000140094E71,?,?,?,?,000000014009D3FC), ref: 000000014009A0F8
SetLastError.KERNEL32 ref: 000000014009A113

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 74a32285de0c47ab91a83967746158860d645ca39d00d75b6023be0ced2f28da
Instruction ID: eeff4923b96ffbeaac783fc6dd0fa1487e36d7b8cfc170d4ae8f5156a2ba4d41
Opcode Fuzzy Hash: 74a32285de0c47ab91a83967746158860d645ca39d00d75b6023be0ced2f28da
Instruction Fuzzy Hash: 98111C3034568042FA5BA7336A623FD62925B8D7F0F544729BB3B07BF6DE39D4419241

Function 000000014002DCE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000000014002DD3F

Part of subcall function 00000001400BB260: AreFileApisANSI.KERNEL32 ref: 00000001400BB272

__std_exception_destroy.LIBVCRUNTIME ref: 000000014002DFE7
__std_exception_destroy.LIBVCRUNTIME ref: 000000014002E0A1

Strings

: ", xrefs: 000000014002DDFA
", ", xrefs: 000000014002DE2D

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: 29093f96ef1d6a647cffed8f9725008a32391bd012f0b91b210945c5385b3f31
Instruction ID: a0ebd77add875ad15dad381f545e36b6a5c96292ae31a13c06a59994470402d1
Opcode Fuzzy Hash: 29093f96ef1d6a647cffed8f9725008a32391bd012f0b91b210945c5385b3f31
Instruction Fuzzy Hash: 2DB19C72700A8086EB05EF66E4943ED3361E758BC8F508526EF5D17BAADF38C895C384

Function 00000001400A11C8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001400A1207
_set_statfp.LIBCMT ref: 00000001400A1225
_set_statfp.LIBCMT ref: 00000001400A124E
_set_statfp.LIBCMT ref: 00000001400A148A

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c46414ac3fdd85b4477068871368765e537dd3c713840e1e7e27798a249fd8b8
Instruction ID: 7c99d57823d5afb7077b860ae2a769dfa0901ed505b92b6df9dbc51602fe9605
Opcode Fuzzy Hash: c46414ac3fdd85b4477068871368765e537dd3c713840e1e7e27798a249fd8b8
Instruction Fuzzy Hash: 8D81B232510A4449F7738B3BB4503EAA695AFAD7D8F144301BF96279F5E734C9D18E00

Function 000000014009A12C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000000140097EF7,?,?,00000000,0000000140098192,?,?,?,?,-2723E8D8DEBC5093,000000014009811E), ref: 000000014009A14B
FlsSetValue.KERNEL32(?,?,?,0000000140097EF7,?,?,00000000,0000000140098192,?,?,?,?,-2723E8D8DEBC5093,000000014009811E), ref: 000000014009A16A
FlsSetValue.KERNEL32(?,?,?,0000000140097EF7,?,?,00000000,0000000140098192,?,?,?,?,-2723E8D8DEBC5093,000000014009811E), ref: 000000014009A192
FlsSetValue.KERNEL32(?,?,?,0000000140097EF7,?,?,00000000,0000000140098192,?,?,?,?,-2723E8D8DEBC5093,000000014009811E), ref: 000000014009A1A3
FlsSetValue.KERNEL32(?,?,?,0000000140097EF7,?,?,00000000,0000000140098192,?,?,?,?,-2723E8D8DEBC5093,000000014009811E), ref: 000000014009A1B4

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 671a375f58b8ef2410b286a9e665e8ca28d49ab8a05773a6e334d4412765f13f
Instruction ID: 0eecc3e7c070fbf0bcafe1dd48680c6a3d0408fcd47933c8e5bef9cf617aa8ce
Opcode Fuzzy Hash: 671a375f58b8ef2410b286a9e665e8ca28d49ab8a05773a6e334d4412765f13f
Instruction Fuzzy Hash: 58118F3034524042FA5B93376A623FA62925B8D7F0F444325BB3E47BF6DE3CC4018240

Function 0000000140049990 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140049A00
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140049A48
_Getcoll.LIBCPMT ref: 0000000140049A7C

Strings

bad locale name, xrefs: 0000000140049B81

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 3cedb528a0617067bf225fdb437733a283f1ee60c151b7ce9961097dc3adec8a
Instruction ID: 9a2edcff680919b35428e1209fb65e27f44ba661b4d9c7d5374eb54866a69a42
Opcode Fuzzy Hash: 3cedb528a0617067bf225fdb437733a283f1ee60c151b7ce9961097dc3adec8a
Instruction Fuzzy Hash: 6E917A72B01B808AEB16DFA6E4903DD7362EB48BC8F044535EF5D57AAADF38C4558384

Function 00000001400BF0DC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BF3BB

Part of subcall function 00000001400AC4AC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400AC4C9

Strings

UTF-16LEUNICODE, xrefs: 00000001400BF359
ccs, xrefs: 00000001400BF2F6
UTF-8, xrefs: 00000001400BF33A

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: a61b9dafeebeef71c778538e02d1dd93d241f4be75a88b4b5df5efb2b9ec5def
Instruction ID: 8cb6542061ef7d37a80eb2345665ae9640161e3f439a4ea34f0695e2e3c1826a
Opcode Fuzzy Hash: a61b9dafeebeef71c778538e02d1dd93d241f4be75a88b4b5df5efb2b9ec5def
Instruction Fuzzy Hash: 02818A7A604A4085FBAB9FABC1503F93BF0E319BC8F958405EB02972B5D339CA41A741

Function 000000014002CA60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014002CACF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014002CB17
_Getctype.LIBCPMT ref: 000000014002CB55

Strings

bad locale name, xrefs: 000000014002CC0E

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 80f950e83455594405f3186e39a91f83d6c126c433fd171819c85ce53b8761c8
Instruction ID: 207d3642c3b50f17bf177e439d3fe9f40958c29cbdde464f884d1d612c46b59d
Opcode Fuzzy Hash: 80f950e83455594405f3186e39a91f83d6c126c433fd171819c85ce53b8761c8
Instruction Fuzzy Hash: 71516836711B408AEB16DFB2E4917EC33B5EB48788F044429EF8927AA6DF34C526D344

Function 00000001400BB210 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001400BB226
GetProcAddress.KERNEL32 ref: 00000001400BB236

Strings

GetTempPath2W, xrefs: 00000001400BB22C
kernel32.dll, xrefs: 00000001400BB21F

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 85c4015c5df5ee79752990f65a767554006cfd6127e60443cb10f02faa6b2ab0
Instruction ID: 8948df6339a09da6af2494f7b4aca6647369a72829e4e3643078e2be1e3806b8
Opcode Fuzzy Hash: 85c4015c5df5ee79752990f65a767554006cfd6127e60443cb10f02faa6b2ab0
Instruction Fuzzy Hash: 25E01231300A0582EE06AB12F9887AD6321FF8CBC2F985025EF0E07334EE3CC44A8710

Function 0000000140075180 Relevance: 6.5, APIs: 4, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140074A30: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140074A86
Part of subcall function 0000000140074A30: Process32FirstW.KERNEL32 ref: 0000000140074ACA
Part of subcall function 0000000140074A30: Process32NextW.KERNEL32 ref: 0000000140074ADF
Part of subcall function 0000000140074A30: OpenProcess.KERNEL32 ref: 0000000140074B1B
Part of subcall function 0000000140074A30: OpenProcessToken.ADVAPI32 ref: 0000000140074B42
Part of subcall function 0000000140074A30: CloseHandle.KERNEL32 ref: 0000000140074CB6
Part of subcall function 0000000140074A30: Process32NextW.KERNEL32 ref: 0000000140074CC3
Part of subcall function 0000000140074A30: CloseHandle.KERNEL32 ref: 0000000140074D07

ImpersonateLoggedOnUser.ADVAPI32 ref: 00000001400751DD
ImpersonateLoggedOnUser.ADVAPI32 ref: 00000001400756C8
RevertToSelf.ADVAPI32 ref: 00000001400756E6

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 1562318730-0
Opcode ID: e9adf443fdba402522f6b2fbfe08ffe1992486fea4281117de5b942d86f2cd93
Instruction ID: b989d0c3521bf1bda4b832789374d1dbd4a24a2220b16c2c936b04ff1824fe50
Opcode Fuzzy Hash: e9adf443fdba402522f6b2fbfe08ffe1992486fea4281117de5b942d86f2cd93
Instruction Fuzzy Hash: A722AB72B14B8086FB02AB6AD4443DD2761E7897E8F505615FBAD17AFADFB8C481C700

Function 000000014009C578 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000000014009C5F7
WriteFile.KERNEL32 ref: 000000014009C8BF
WriteFile.KERNEL32 ref: 000000014009C905
GetLastError.KERNEL32 ref: 000000014009C9BB

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 51ca5d62aa19301a18794717acfbf1a46562df65ce568f5fb7798e040ec77a5b
Instruction ID: 83f89cefb2d932c64b68d175d5ea0fe2b41a0143d6f3692f9e6e20abd60b4dae
Opcode Fuzzy Hash: 51ca5d62aa19301a18794717acfbf1a46562df65ce568f5fb7798e040ec77a5b
Instruction Fuzzy Hash: 4BD1CF72B24A808AE712CF6AD444BDC37B1F758BD8F444216EF9E97BA9DA34C446C740

Function 0000000140042C80 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400BC5EC: std::_Lockit::_Lockit.LIBCPMT ref: 00000001400BC609
Part of subcall function 00000001400BC5EC: std::locale::_Setgloballocale.LIBCPMT ref: 00000001400BC62C

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140042CC1
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140042CE6
std::_Facet_Register.LIBCPMT ref: 0000000140042D92
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140042DF4

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: c9a1a8139d8810aad24f7145a6566e187178f19033a855930054ed48ba3ff1cb
Instruction ID: be7052521538f46ca31769c5e8ad34a96fa69d07cef5d8ccdfe7c05edfc6c238
Opcode Fuzzy Hash: c9a1a8139d8810aad24f7145a6566e187178f19033a855930054ed48ba3ff1cb
Instruction Fuzzy Hash: 4E415A32324A8082EA66DF16E4507D973A4F78CBD4F9A5621FB99477B5DF38C482C704

Function 00000001400906FC Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140090775
_invalid_parameter_noinfo.LIBCMT ref: 00000001400907D1
_invalid_parameter_noinfo.LIBCMT ref: 000000014009080C
_invalid_parameter_noinfo.LIBCMT ref: 0000000140090831

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f1f9df1a05da3301ed415653e8360f7cb12179a044a2575d07df28b1a0800ec9
Instruction ID: 9d625922f0084f738925744b6ce75ac3468dc28db60b1638888baded20588c2c
Opcode Fuzzy Hash: f1f9df1a05da3301ed415653e8360f7cb12179a044a2575d07df28b1a0800ec9
Instruction Fuzzy Hash: 63417F32509A8489EB63CF66C4203ED7BA0FB4DFD4F4AC042EB88073A6DA39C446C711

Function 00000001400478A0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400478CB
std::_Lockit::_Lockit.LIBCPMT ref: 00000001400478F0
std::_Facet_Register.LIBCPMT ref: 000000014004799B
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400479E6

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: fce11bbf2716b712929d21612f2a8f238f427733906def6abb3c40e1e27c6ea6
Instruction ID: 13c908d1154428c6937b5c3509377b7ccdd79ff15f68ab15f939c0ebe6def4ce
Opcode Fuzzy Hash: fce11bbf2716b712929d21612f2a8f238f427733906def6abb3c40e1e27c6ea6
Instruction Fuzzy Hash: 70413932224A4081FA26DF17E850BD96760F78CBE4F591622EB9D477B9DF38D982C704

Function 000000014007AB80 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014007ABAB
std::_Lockit::_Lockit.LIBCPMT ref: 000000014007ABD0
std::_Facet_Register.LIBCPMT ref: 000000014007AC7B
Concurrency::cancel_current_task.LIBCPMT ref: 000000014007ACC6

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 73d040060e39de7473f733929aeeb815445ca65359d0c265211a911782271014
Instruction ID: 74d7fc06fc51955d11541e88f1d53fd6ed53de51744ee963c2a23d3aba2a14c1
Opcode Fuzzy Hash: 73d040060e39de7473f733929aeeb815445ca65359d0c265211a911782271014
Instruction Fuzzy Hash: E2415B36214A8096FA27DF27E8507DA67A0F78DBE4F581621BB9D477B5DE3CC4818700

Function 00000001400BB3F4 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400BB43D
GetLastError.KERNEL32 ref: 00000001400BB44B
WideCharToMultiByte.KERNEL32 ref: 00000001400BB480
GetLastError.KERNEL32 ref: 00000001400BB48E

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b0c4d9c72fcc6461851340ae7f6c093d4e41e08a8bab11e5154c9cbc0382217d
Instruction ID: a031f3bea18fd59b085b3d452c6f81a1a71a70fbd363d9f8fa6e03f334feb155
Opcode Fuzzy Hash: b0c4d9c72fcc6461851340ae7f6c093d4e41e08a8bab11e5154c9cbc0382217d
Instruction Fuzzy Hash: 0A216D76614B848BE7208F12E44435FBBB4F79DFD5F240128EB8997B65DB38C5028B00

Function 00000001400BB8E0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400BB210: GetModuleHandleW.KERNEL32 ref: 00000001400BB226
Part of subcall function 00000001400BB210: GetProcAddress.KERNEL32 ref: 00000001400BB236

GetLastError.KERNEL32 ref: 00000001400BB904

Part of subcall function 00000001400998B4: IsProcessorFeaturePresent.KERNEL32 ref: 00000001400998DA

GetFileAttributesW.KERNEL32 ref: 00000001400BB913
__std_fs_open_handle.LIBCPMT ref: 00000001400BB93C
CloseHandle.KERNEL32 ref: 00000001400BB94E

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: 6a84e7cc61d3f6faa1a02f0b285c9e89f06a54f244136a8e8d2e5cb925bd3053
Instruction ID: 62e66b62d14fa543578834bf2b4ef4b7e56291556af98af6738b9ddd7679e05d
Opcode Fuzzy Hash: 6a84e7cc61d3f6faa1a02f0b285c9e89f06a54f244136a8e8d2e5cb925bd3053
Instruction Fuzzy Hash: 4A11A032218A4087FB625FABA0843BE6371E78C7F0F100614BBB747AF5DAB8C5418B00

Function 00000001400AF908 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400AF934
GetCurrentThreadId.KERNEL32 ref: 00000001400AF942
GetCurrentProcessId.KERNEL32 ref: 00000001400AF94E
QueryPerformanceCounter.KERNEL32 ref: 00000001400AF95E

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4ffc0ff1ccd2cf120a16052376350404e0c91ed7b37e0d63ec5629fc76b72274
Instruction ID: b655b697fc6b073ddc816c875066984fbd2aa83c7f17d9a519f4fc4b792de05b
Opcode Fuzzy Hash: 4ffc0ff1ccd2cf120a16052376350404e0c91ed7b37e0d63ec5629fc76b72274
Instruction Fuzzy Hash: 1A111532710F008AEB01DB62E8543A833A4F71DB99F441A25EF6D877A4DF78C1A98380

Function 000000014002EBF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000000014002ED2B

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 7184a3ad5ff91fc1a1701c9c10d0429acf130cbf05f0541bdc6e2c022f7ee3be
Instruction ID: 9bf36a7d67488c1de92e381038431f8e667d7f893a013056b17c91b8c17c49e4
Opcode Fuzzy Hash: 7184a3ad5ff91fc1a1701c9c10d0429acf130cbf05f0541bdc6e2c022f7ee3be
Instruction Fuzzy Hash: DA71D172F10B9085FB02CF7AE8413DD67A1E799BD8F245215EF5917BAADB78C4828340

Function 000000014008E0C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000000014008E2A3

Strings

os_crypt, xrefs: 000000014008E0C6
out_of_range, xrefs: 000000014008E132

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: os_crypt$out_of_range
API String ID: 592178966-3828104817
Opcode ID: a1f6624c129788918c44e34af2e64e442266af5d95928219844bda15b680f5df
Instruction ID: 4f2fff603e58c947ecf32cdebf0283daead70b4db8106c5da3d201fcb65b89be
Opcode Fuzzy Hash: a1f6624c129788918c44e34af2e64e442266af5d95928219844bda15b680f5df
Instruction Fuzzy Hash: 64716D73B15B8089FB02DBB6D4513DC2362A79D7E8F509711AFAC17AE9EA78C185C340

Function 000000014007B100 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014007B16F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014007B1B7

Strings

bad locale name, xrefs: 000000014007B28C

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 829915ec12f2232d825db8a6b4ddec4dc6eb82e46016816ccbb5a951b3d0af81
Instruction ID: a70bdc5d483a3a6709f00792b18fb0141f1d3f3c4e5a5c8a55365fd5953b6739
Opcode Fuzzy Hash: 829915ec12f2232d825db8a6b4ddec4dc6eb82e46016816ccbb5a951b3d0af81
Instruction Fuzzy Hash: C7514D33702A408AEB56DFB2E4503ED33B4EB58B88F044025FF5967AA6DE38C5168344

Function 000000014004A600 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014004A66F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014004A6B7

Strings

bad locale name, xrefs: 000000014004A796

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: e577f3afaf8ac30996d405b8c9672a3754bdcc53408be29aeb9b653a438587d5
Instruction ID: 198352202ef1475b794fd52093b47f8c285fde63b82ab9b5d546a8a9e2019f38
Opcode Fuzzy Hash: e577f3afaf8ac30996d405b8c9672a3754bdcc53408be29aeb9b653a438587d5
Instruction Fuzzy Hash: 87513A32706A4089EB56DFB2E8907EC33B4EB58788F044535FB4967AA6DF38C525D348

Function 000000014009CC10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014009CD27
GetLastError.KERNEL32 ref: 000000014009CD49

Strings

U, xrefs: 000000014009CCD3

Memory Dump Source

Source File: 00000007.00000002.2519446987.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140000000_Xeno Executor.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 136ebf252562798dd94b0934f5b608a87eddbdd1c89cb1577b5bf7720501d192
Instruction ID: 265af7a89e28bd5e55a3246d438a373a726ea37e60e0b815f1dbf572d141d70c
Opcode Fuzzy Hash: 136ebf252562798dd94b0934f5b608a87eddbdd1c89cb1577b5bf7720501d192
Instruction Fuzzy Hash: A4419F72625A8082EB219F26E4447EA67A0F79CBD4F444121EF4D877A8EB3CC441CB40

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Xeno Executor.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
Xeno Executor.exe

Function 0000000140085B70 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Function 00000001400BB5B0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 0000000140065970 Relevance: 22.8, Strings: 18, Instructions: 304
COMMON

Function 0000000140066350 Relevance: 20.4, APIs: 1, Strings: 10, Instructions: 1136
COMMON

Function 000000014003D570 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 0000000140032CA0 Relevance: 16.5, APIs: 3, Strings: 6, Instructions: 789
registryCOMMON

Function 000000014007C600 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Function 00000001400320B0 Relevance: 14.7, APIs: 3, Strings: 5, Instructions: 684
registryCOMMON

Function 00000001400A2E3C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 0000000140085240 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Function 00000001400C0658 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 000000014007F020 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre